Privacy Policy

1. Who we are

AI Garage is a software platform that helps UK independent garages manage their customers, bookings, vehicles, and communications. This default policy applies when a garage using our platform has not published their own privacy policy.

The garage you book with is the data controller for your personal data. AI Garage is a data processor acting on the garage's instructions, providing the technical infrastructure.

2. What we collect

• Identity: Name, email, phone number
• Vehicle: Registration plate, make, model, MOT/service/tax due dates
• Service history: Bookings, jobs, invoices, payments
• Communications: Messages we send you (email, SMS, WhatsApp) and your replies
• Technical: IP address, browser type when using customer portal

3. Why we use it (legal basis)

• Contract: Managing your bookings, sending appointment confirmations, issuing invoices
• Legitimate interest: MOT/service/tax reminders (you can opt out)
• Consent: Marketing communications (offers, news) — only sent if you opt in
• Legal obligation: Keeping invoice records for tax compliance (HMRC: 6 years)

4. Who we share with

• Email delivery: Resend (resend.com) — sends transactional and marketing emails
• SMS delivery: Twilio (twilio.com)
• WhatsApp: Meta WhatsApp Business API
• Hosting: Vercel (vercel.com) — runs the platform
• Database: Supabase (supabase.com) — stores your data
• AI message drafting: Anthropic Claude — drafts reminder text. No data sold or used to train models.
• DVLA/DVSA: We query public vehicle records (MOT, road tax) using your registration plate

We never sell your data. We never share for third-party advertising.

5. How long we keep it

• Invoices and payment records: 6 years (HMRC requirement)
• Customer profile and vehicle: 7 years from last service, then anonymized on request
• Reminder/message history: 2 years
• Marketing consent records: Until you withdraw consent

6. Your rights (UK GDPR)

You can ask the garage to:

• Access — get a copy of your personal data
• Rectify — correct anything inaccurate
• Erase — delete your personal data (except records we're legally required to keep, like invoices)
• Restrict — limit how we use it
• Object — to direct marketing (we'll stop immediately)
• Withdraw consent — at any time, for any consent-based processing
• Data portability — receive your data in a machine-readable format

Contact the garage directly to exercise these rights. If they cannot resolve your concern, you can complain to the UK Information Commissioner's Office (ICO): ico.org.uk.

7. Cookies

We use essential cookies to keep you logged in and remember your preferences. We do not use tracking, advertising, or analytics cookies that profile you.

8. Security

• Data is encrypted in transit (HTTPS) and at rest
• Access to the platform requires authentication; staff access to your records is restricted to the garage you booked with
• Passkey (WebAuthn) and email magic-link sign-in supported; passwords are stored hashed
• Staff sessions automatically expire 12 hours after sign-in, requiring re-authentication. This protects shared garage devices.

9. Contact

For data protection questions, contact the garage you booked with directly. For platform-level questions about AI Garage, email privacy@ai-garage.co.uk.