Privacy Policy

This Privacy Policy explains how WrenchDeck (“WrenchDeck,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards information when you visit wrenchdeck.com or use the WrenchDeck web application (the “Service”). By using the Service you agree to this Policy. If you do not agree, do not use the Service.

1. Information we collect

1.1 Information you provide

• Account information: name, email address, and password (hashed) or third-party OAuth identifier when you sign up or sign in.
• Shop & business data you enter: customer/client records, vehicle and trailer records, mileage, VINs, invoice line items, service history, inspection results, parts inventory, notes, signatures, uploaded photos or documents, and any other content you save in the Service.
• Support communications: messages you send us and any information you include in them.

1.2 Information collected automatically

• Device and log data: IP address, browser type, operating system, referring URLs, pages viewed, timestamps, and error diagnostics.
• Local storage: we store form drafts, wizard progress, session tokens, and preferences in your browser’s localStorage, sessionStorage, cookies, and IndexedDB so you don’t lose work between sessions.
• Service worker cache: to enable offline use, the Service caches pages and assets on your device.

1.3 Information we do NOT intentionally collect

We do not intentionally collect government IDs, payment card numbers (we do not process payments through the Service today), health information, or sensitive personal categories. Do not upload information that you are not authorized to share.

2. How we use information

• Provide, operate, maintain, and secure the Service.
• Authenticate you and manage your account.
• Generate the invoices, estimates, inspection reports, and PDFs you create.
• Debug errors, prevent abuse, and enforce our Terms.
• Communicate with you about the Service, updates, and support requests.
• Comply with legal obligations.

We do not sell your personal information. We do not use your shop or customer data to train AI models.

3. Third-party processors and what they receive

We rely on the following third-party service providers to run the Service. Each processes information on our behalf and has its own privacy practices. You should review their policies.

3.1 Lovable Cloud (Supabase infrastructure)

Purpose: hosting, database, authentication, file storage, and serverless functions.
Data received: all account data, all shop/business data you save in the Service, session tokens, IP address, and request metadata.
Policy: lovable.dev/privacy and supabase.com/privacy.

3.2 Google (Sign in with Google / OAuth)

Purpose: optional single sign-on.
Data received by Google: the fact that you signed in to WrenchDeck, your IP address, and device metadata. If you choose to sign in with Google, Google shares your name, email address, Google account ID, and profile picture with us so we can create or match your account.
Policy: policies.google.com/privacy.

3.3 Google Fonts

Purpose: serving the web fonts used by the Service.
Data received: IP address and user-agent of the requesting browser when the Service loads.
Policy: policies.google.com/privacy.

3.4 Twilio (SMS delivery)

Purpose: sending SMS/text notifications you initiate from the Service, such as “job ready” alerts, invoice notifications, appointment reminders, and remote VIN-capture links to your technicians.
Data received by Twilio: the destination phone number, the sender phone number, message content, and delivery metadata (timestamps, status, carrier error codes).
Consent: WrenchDeck only sends SMS to a phone number after the account holder or client has affirmatively opted in inside the Service. Recipients can reply STOP at any time to unsubscribe, or HELP for assistance. Message and data rates may apply.
Policy: twilio.com/legal/privacy. See also our SMS Terms.

3.5 Plausible Analytics

Purpose: privacy-friendly, cookieless website analytics so we can understand aggregate traffic and improve the Service.
Data received by Plausible: page URL, HTTP referrer, browser and operating system, device type, country (derived from IP address at request time; the raw IP address is not stored or logged), and outbound link clicks. Plausible does not use cookies and does not build cross-site profiles.
Policy: plausible.io/privacy and plausible.io/data-policy.

3.6 Cloudflare (CDN, DNS, WAF)

Purpose: DNS resolution, TLS termination, content delivery, DDoS mitigation, and web application firewall (WAF) protection for wrenchdeck.com.
Data received by Cloudflare: IP address, request URL and method, HTTP headers, user-agent, TLS metadata, and timing information for every request routed to the Service. Cloudflare may set a short-lived security cookie (e.g. __cf_bm) to distinguish humans from bots.
Policy: cloudflare.com/privacypolicy.

3.7 NHTSA vPIC (VIN decoder)

Purpose: decoding Vehicle Identification Numbers (VINs) into make, model, year, and specifications using the U.S. Department of Transportation’s public vPIC API.
Data received by NHTSA: the VIN string you decode and the requesting server’s IP address. No customer name, contact information, or other account data is transmitted. The vPIC API is a public U.S. government dataset.
Policy: vpic.nhtsa.dot.gov.

3.8 Lovable email infrastructure

Purpose: sending transactional and authentication emails (sign-up confirmations, password resets, magic links, invoice notifications, plan receipts, and other account-related mail).
Data received: recipient email address, sender identity, subject, message content, and delivery metadata (timestamps, bounces, complaints, opens where applicable). Email is delivered through Lovable’s managed email pipeline, which may use downstream SMTP relays under Lovable’s control.
Policy: lovable.dev/privacy.

If we add new third-party processors (for example a payments processor or error monitoring service), this section will be updated before those services process your data.

4. Sharing and disclosure

• With processors listed in Section 3, only to the extent needed to operate the Service.
• To comply with law: we may disclose information if required by a valid legal request, subpoena, court order, or to protect our rights, users, or the public.
• Business transfer: if we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. We will notify you if your information becomes subject to a different privacy policy.
• With your direction: when you generate an invoice, estimate, or inspection PDF and share or send it to a customer, that customer receives the content you chose to include.

5. Data retention

We retain your account and shop data for as long as your account is active or as needed to provide the Service. When you delete a record inside the Service, it is removed from active storage; encrypted backups may retain it for up to 30 days. When you close your account, we delete or anonymize your data within a reasonable period, except where retention is required for legal, tax, accounting, security, or dispute resolution purposes.

6. Security

We use industry-standard measures including TLS in transit, encryption at rest through our infrastructure provider, row-level access controls, and least-privilege server credentials. No method of transmission or storage is 100% secure. You use the Service at your own risk. You are responsible for keeping your password confidential and for all activity under your account. Notify us immediately at support@wrenchdeck.com if you suspect unauthorized access.

6.1 Breach notification

If we become aware of a security incident that has compromised your personal information, we will notify affected users and applicable regulators as required by law, without undue delay.

7. Your choices and rights

• Access, correction, deletion: you can edit or delete records inside the Service, or request a full account deletion by emailing support@wrenchdeck.com.
• Export: invoices and inspection reports can be exported as PDF from within the Service. For a broader data export, email us.
• Cookies and local storage: you can clear these through your browser at any time. Doing so will sign you out and may clear drafts.

7.1 California residents (CCPA/CPRA)

You have the right to know, delete, correct, and opt out of the “sale” or “sharing” of personal information. We do not sell or share personal information as those terms are defined by the CCPA/CPRA. To exercise your rights, contact us using the details below.

7.2 EU/UK residents (GDPR/UK GDPR)

Our lawful bases are (a) performance of a contract, (b) our legitimate interest in operating and securing the Service, and (c) your consent where required. You have the right to access, rectify, erase, restrict, and port your data, and to lodge a complaint with your supervisory authority.

8. Data you enter about third parties (your customers)

When you enter your customers’ contact details, vehicle records, or service history into the Service, you are the controller of that data and we are the processor. You are responsible for having a lawful basis to collect and store that information and for providing your own customers with any required notices. On request, we will assist with reasonable data-subject requests directed at your records.

9. International transfers

Our infrastructure providers may process data in the United States and other countries. Where required, we rely on Standard Contractual Clauses or equivalent safeguards for cross-border transfers.

10. Children

The Service is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

11. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the “Effective date” above and, where appropriate, notify you within the Service or by email.

12. Contact

WrenchDeck
Email: support@wrenchdeck.com
Please update this address with your real business contact info if you have a formal legal entity.