GarageBay CRM - Premium Mechanic Workshop Management

This Privacy Policy describes how SPJTEX AI LTD (“we”, “us”, or “our”) collects, uses, processes, and protects personal data when you use the GarageBay CRM platform (the “Service”), located at www.garagebaycrm.com.

We are committed to protecting the privacy of both our direct users (garage owners and staff) and the customers whose details are managed within the Service (garage clients). This Service is operated in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Information We Collect

A. Information Provided by Garage Owners & Staff (Users)

To create and maintain your account, we collect:

Account Details: Full name, business name, workshop phone number, and account email.
Authentication Info: Hashed passwords (stored securely and never readable by us).
Billing Details: Credit card and billing info, securely processed directly by our payment processor, Stripe. We do not store full payment card details on our servers.

B. Customer and Vehicle Data Managed by You (CRM Records)

In providing the Service, you input information about your workshop operations and clients. For these records, you act as the Data Controller, and we act as the Data Processor:

Customer Records: Client names, phone numbers, email addresses, postal addresses, and notes.
Vehicle Records: Registration plates, makes, models, VIN/chassis numbers, repair logs, work orders, and mileage history.
Calendar & Bookings: Appointment dates, start times, assigned service bays, and duration.

C. Automated Usage Information

Log Data: IP addresses, browser types, operating systems, and page navigation logs to monitor platform performance and prevent malicious activity.
Cookies: Technical cookies necessary to keep you authenticated and maintain your active session.

2. How We Use Your Information

We process personal data under the following lawful bases:

Performance of a Contract: To create your garage account, process payments via Stripe, and run the scheduling, invoicing, and vehicle lookup features.
Consent: When you explicitly opt-in or enter client data into the CRM.
Legitimate Interests: To improve platform stability, troubleshoot bugs, and provide technical support.

We do not sell, lease, or distribute your data or your customers' data to third parties for marketing or advertising purposes. We will not send promotional newsletter campaigns.

3. Data Processors and Third-Party Sharing

We share data only with trusted service providers essential to running the platform:

Stripe: Payments infrastructure for billing subscriptions.
Supabase / PostgreSQL: Database and cloud hosting services.
Vercel: Hosting infrastructure for frontend web applications.
Vehicle Lookup API (VDG): To query vehicle details based on UK registration plates.

All third-party processors are vetted to ensure they adhere to strict security and GDPR guidelines.

4. Data Security & Retention

Security Measures: We use industry-standard measures to safeguard your information: HTTPS/TLS encryption for all data in transit, secure database encryption at rest, and regular automated dependency scanning.

Data Retention: User accounts persist as long as your garage account remains active. Customer profiles, vehicle records, or bookings deleted by you are permanently deleted from active database slots. If you terminate your GarageBay account, all related database records are purged within 30 days.

5. Your Rights (UK & EU GDPR)

Under the GDPR, you (and your customers) have the following rights: access to your data, rectification of inaccurate data, request for deletion ("Right to be Forgotten"), restriction of processing, and data portability in structured format.

6. Contact Us

If you have any questions about this Privacy Policy, your rights, or wish to make a request, contact our Data Protection Officer:

Operator: SPJTEX AI LTD

Support Email: Support@garagebaycrm.com