Privacy policy
Draft. This text is not yet in force and has not been reviewed by a lawyer. Still to be filled: legalName, legalForm, registeredAddress, gstin, supportEmail, supportPhone, grievanceOfficer, effectiveDate.
This explains what personal data Garage Master handles, why, and what you can do about it. [to be filled] runs Garage Master. It is written to follow India's Digital Personal Data Protection Act, 2023.
Two kinds of data, two roles
Your account: the email you sign in with, your name if you give it, and your garage's name, address, GSTIN and phone. For this we decide how it is used, and this policy is our notice to you.
Your garage's records: your customers' names, mobile numbers, vehicles, job cards, photos, bills and payments. The garage decides what to collect and why. We only store and process these for the garage, on its instructions. If you are a garage's customer and want your data corrected or removed, ask the garage; it has the tools to do it.
What we collect and why
Sign-in email and second-factor settings: to let you in and keep others out.
What your garage enters: to provide the service to your garage.
A record of who changed what and when (the audit log): so money and security changes can be traced. It records that a customer was erased, never who they were.
Subscription details from Dodo Payments (plan, status, dates): to know whether your plan is active. We never see or store card numbers or UPI PINs; Dodo Payments handles the payment.
Counts of use (job cards, bills, AI briefs, downloads): to apply plan limits and stop abuse.
We do not run advertising trackers or sell data. The website keeps only what is needed in your browser to keep you signed in and to remember light or dark mode.
Who else handles it
Supabase hosts the database, files and sign-in, in its Mumbai (India) region. Vercel serves the website. Dodo Payments sells the plans and takes payments, as merchant of record. Meta (WhatsApp) carries messages a garage chooses to send. An AI model provider writes the daily brief from a garage's figures. For the brief it is sent the day's totals and, for stuck jobs and the largest dues, the customer's name, vehicle and amount. Mobile numbers are not sent.
Each is bound by its own terms to protect the data. We give data to the authorities only when the law requires it.
How it is protected
Every record carries its garage's identity, and the database refuses any request for another garage's rows. This is tested against every table on every change.
A second factor can be turned on for any account, and is required for our own staff. Changing where customers pay (UPI ID or bank details) needs a second factor that has been on for a day. Sign-ins can be ended everywhere at once.
No system is perfectly secure. If a breach affects your data we will tell the garage's owner and the Data Protection Board as the law requires, with what happened and what to do.
How long we keep it
While the garage's account is open, we keep its records.
After a garage closes: bills, payments and credit notes are kept for 72 months after the due date of the annual return for their year, because GST law requires it, and are then removed. AI keys, briefs and the reminder log are removed at closing.
A garage can erase a customer at any time. A customer who was never billed is removed with their vehicles and job cards. A customer who was billed stays on those bills, as issued, because a bill is a tax record; everything else about them is removed.
Your rights
You can see and correct your account details in the app, download your garage's data, withdraw consent by closing the account, and name someone to act for you. A garage's customer can stop reminders with the link in any reminder.
To use a right or to complain, write to [to be filled]. Our grievance officer is [to be filled], at [to be filled], phone [to be filled]. We answer within 7 days. If you are not satisfied you may complain to the Data Protection Board of India.
Children
The service is for businesses. It is not meant for anyone under 18.
Changes
If we change this policy in a way that matters, we will tell garage owners in the app before it takes effect.