This Data Processing Addendum ("Addendum") is part of the Terms of Service between your shop and MyGaragio. It applies to the personal information your shop puts into MyGaragio about other people ("Shop Personal Information"). Your shop is the organization responsible for that information (the "controller"); MyGaragio processes it on your behalf as your service provider (the "processor"). Where this Addendum and the Terms differ on data protection, this Addendum prevails.
Accepting the Terms accepts this Addendum. If you need a signed copy for your records, write to privacy@mygaragio.com.
1. Details of the processing
| Subject and purpose | Providing MyGaragio to your shop: storing and organizing your records, sending the messages you ask it to send, running the features you use (inspections, scheduling, payments, reports, AI features), backing up and securing the data, and supporting you. |
| Duration | The term of your account, plus the deletion periods in section 9. |
| Categories of people | Your customers and their contacts, the drivers of their vehicles, your staff, your vendors’ and partners’ contacts. |
| Categories of information | Names, phone numbers, email and postal addresses, language; vehicles (VIN, licence plate, mileage); service history, estimates, invoices, payments and balances (no full card numbers); inspection results, photos and videos; text messages, emails, call logs, call recordings, voicemails and transcripts; signatures and approvals; staff accounts, schedules and time records; notes your team writes. |
| Sensitive information | MyGaragio is not designed for sensitive information (health, government identifiers, full card numbers). Do not enter it in notes or uploads; see the Acceptable Use Policy. |
2. Processing only on your instructions
We process Shop Personal Information only to provide the Service and according to your documented instructions — the Terms, this Addendum, and how you configure and use MyGaragio — unless the law requires otherwise, in which case we tell you first when the law allows. We tell you if we believe an instruction breaks the law. We never sell Shop Personal Information, use it for our own marketing or advertising, or combine it with information from other shops or sources.
Each shop has its own database, separate from every other shop’s.
3. Confidentiality of our people
Only people who need access to provide, secure or support the Service can reach Shop Personal Information, they are bound by confidentiality obligations, and access to production systems is logged. Support staff look at your data only to answer a request from you or to keep the Service secure.
4. Security measures
We maintain appropriate technical and organizational measures, which include:
- encryption in transit (HTTPS / TLS) for every connection to the Service, and encrypted storage and off-site backups;
- a separate database per shop, and access controls in the app by role (for example, technicians never see costs);
- hashed passwords, PINs and session tokens; optional two-step sign-in with an authenticator app; lockouts after repeated failed attempts;
- an activity and audit log in each shop;
- nightly encrypted off-site backups of each shop’s database (daily copies are kept for 30 days and monthly copies for 12 months) a nightly off-site copy of photos and documents (a removed file is erased from it after 30 days) and daily snapshots of the server’s storage, including photos and documents (kept 7 days), with tested restores;
- least-privilege access to production systems and prompt security updates;
- an incident-response process and a register of confidentiality incidents.
More detail is on our Security page. We may improve these measures over time without reducing the overall level of protection.
5. Subprocessors
You authorize us to use the subprocessors listed on our Subprocessors page. We bind each one by written contract to protections at least as strong as this Addendum, and we remain responsible for their work.
We will give account owners at least 30 days’ notice by email (and update the page) before adding or replacing a subprocessor that processes Shop Personal Information. If you object on reasonable data-protection grounds and we cannot address the concern, you may terminate the affected service and receive a pro-rated refund of prepaid fees for the remaining period.
Services you connect to your account yourself (your own Stripe, Twilio, QuickBooks, parts-supplier or email accounts) are your own providers, not our subprocessors.
6. Requests from individuals
MyGaragio gives you tools to find, export, correct and delete a customer’s information. If you need more help answering a request to access, correct, delete or port information, we will provide it within 10 business days of your request. If a person writes to us directly about your shop’s data, we forward the request to you and do not answer it ourselves unless you ask us to.
7. Confidentiality incidents
If we become aware of a confidentiality incident affecting Shop Personal Information (unauthorized access, use, communication or loss), we will notify the account owner without undue delay — within 48 hours of confirming it when possible — and tell you what happened, what information and people are involved, what we have done and what we recommend. We will update you as we learn more, take reasonable steps to limit the harm, and give you the information you need for your own notices (to the Commission d’accès à l’information, the Office of the Privacy Commissioner of Canada, US state authorities and the people concerned). We record every incident in our register.
8. Where the information is processed
Shop Personal Information is hosted in Canada. Some subprocessors process parts of it in the United States, as listed on the Subprocessors page with their location and purpose. We give you the information you need for your own privacy impact assessment before communicating information outside Quebec, and we protect it there by contract.
9. Return and deletion
You can export all Shop Personal Information at any time while the account exists, including during read-only periods. When you ask us to delete the account, deletion starts after a 7-day cooling-off period. When deletion takes place, the shop’s data is removed from our live systems. Photos and documents remain only in the server’s daily snapshots, which are erased after 7 days, and in the off-site copy of the files, where they are erased after 30 days. In our encrypted backups (daily copies are kept for 30 days and monthly copies for 12 months), a deleted shop’s monthly copies are removed the next night and its daily copies after 30 days, then 30 more days in the versioned bucket: the last ones no later than 62 days after deletion. Until then they are used only to recover the service after a loss of data. When an account ends for another reason, the periods in the Terms apply. We confirm deletion in writing on request.
10. Information and audits
We answer reasonable security questionnaires and provide the information needed to show compliance with this Addendum. If that is not enough, you may audit our compliance once a year, at your cost, with 30 days’ notice, during business hours, in a way that does not disrupt the Service or expose other shops’ information, and under confidentiality.
11. United States privacy laws
For shops subject to the California Consumer Privacy Act and similar state laws, MyGaragio is your "service provider" or "processor". We do not sell or share Shop Personal Information, retain, use or disclose it outside our direct business relationship with you or for any purpose other than the business purposes in this Addendum, or combine it with personal information from other sources except as those laws allow. We comply with those laws, provide the same level of protection they require, and will tell you if we can no longer meet our obligations, in which case you may take reasonable steps to stop unauthorized use.
12. Liability and order of precedence
Each party’s liability under this Addendum is subject to the limits in the Terms, except where the law does not permit them. This Addendum lasts as long as we process Shop Personal Information for you.
13. Contact
Data protection questions: privacy@mygaragio.com. Security: security@mygaragio.com.