This policy explains how MyGaragio ("MyGaragio", "we") handles personal information: what we collect, why, where it is kept, for how long, who we share it with, and the rights you have. It is written for shop owners and staff who use MyGaragio, visitors to mygaragio.com, and people whose information a repair shop keeps in MyGaragio.
In short: we collect what we need to run the service for repair shops, we don’t sell or rent personal information, we don’t use advertising or analytics cookies, the shops’ data is hosted in Canada, and you can reach our privacy officer at privacy@mygaragio.com.
1. Our two roles
As the organization responsible (the "controller"), we decide how to handle the information of our own customers and contacts: shop owners and staff who have accounts, billing contacts, people who write to us, and visitors to our website.
As a service provider (the "processor"), we host and process the information each shop keeps about its own customers, vehicles and staff. The shop decides what it collects and how it uses it; we handle that information only to provide the service, under our Data Processing Addendum. If you are a customer of a repair shop and have a question about your information, please contact that shop first — we will help the shop answer you.
2. Person in charge of the protection of personal information
Questions, requests and complaints about personal information go to MyGaragio’s person in charge of the protection of personal information (by default under Quebec law, the person with the highest authority in the business), at privacy@mygaragio.com.
Our privacy governance policy explains who does what at MyGaragio, how we handle complaints and how fast, how long we keep information and how we destroy it, and how we assess new projects.
3. What we collect
| Information | Examples | Where it comes from |
|---|---|---|
| Account information | Name, email address, phone number, role, language, password (stored only as a secure hash), two-step sign-in settings, PIN (hashed) | You, or the owner or manager who invites you |
| Shop information | Shop name, address, phone, tax numbers, settings, prices | The shop’s owner or managers |
| Billing information | Billing contact, billing address, subscription and invoices, the card brand and last four digits | You, and our payment processor Stripe — we never see or store full card numbers |
| Usage and technical information | IP address, browser and device type, pages and actions in the app, error reports, times of sign-in, the shop’s activity log | Your browser and our servers, automatically |
| Correspondence | Messages sent through our contact form or to our @mygaragio.com addresses, and our replies | You |
| Website visits | Server logs only (IP address, page, browser) — no analytics or advertising trackers | Your browser, automatically |
4. Why we use it
- To provide the service: create and secure accounts, sign people in, run the features the shop uses, and back up its data.
- To keep accounts and the service safe: detect and block password guessing and abuse, investigate problems, keep audit records.
- To bill subscriptions and keep the accounting records the law requires.
- To support you and answer your questions.
- To send service emails you need (sign-in links, security notices, invoices, important changes). We send marketing emails only with your consent, and every one lets you unsubscribe.
- To improve the service using aggregated statistics that don’t identify anyone.
- To comply with the law and respond to lawful requests.
We collect only what we need for these purposes and ask for your consent where the law requires it (for example, for optional marketing emails). Most processing is necessary to provide the service you signed up for.
5. Information shops keep about their customers
A repair shop using MyGaragio may keep its customers’ names and contact details, vehicles (VIN, licence plate, mileage), service history, estimates, invoices and payments, inspection photos and videos, text messages and emails, and — when the shop uses the phone features — call recordings, voicemails and transcripts. The shop is responsible for that information and its own privacy notice; we process it only on the shop’s instructions, keep it separate from every other shop (each shop has its own database), and never use it for our own purposes.
6. AI features and automated processing
MyGaragio’s AI features (assistant, writing help, reading photos and documents, text and voice receptionists) send the information needed for each request — which can include a customer’s name, vehicle, messages or a call transcript — to our AI provider, listed on the Subprocessors page. Its terms do not allow it to use that information to train its models.
These features assist people; they do not make decisions about anyone that produce legal or similarly significant effects. The receptionists answer customers on the shop’s behalf from the shop’s own data, and a shop owner can turn AI features off at any time. If we ever make decisions based exclusively on automated processing, we will tell the people concerned as Quebec law requires.
7. Who we share information with
- Subprocessors that host, back up, email, bill or run AI features for us, under contracts that protect the information — see the list of subprocessors.
- Services a shop connects itself (for example its own Stripe, Twilio, QuickBooks or parts-supplier accounts): the shop shares its information with them under its own agreements.
- Authorities, when the law requires it, and to protect the rights and safety of people or the service.
- A buyer or successor of our business, who must protect the information as this policy describes.
We do not sell personal information, and we do not share it for cross-context behavioural advertising. We show no ads.
8. Where information is stored
Shops’ data is hosted in Canada, in Amazon Web Services (Lightsail)’s Montréal, Canada region. Encrypted off-site backups are kept with Amazon Web Services in Canada (Montréal).
Some subprocessors handle information in the United States (for example, AI requests and our subscription billing). Before information is communicated outside Quebec, we assess whether it will receive adequate protection, taking into account its sensitivity, the purpose, the safeguards and the legal framework where it goes, and we protect it by contract. Information processed outside Canada may be accessible to the authorities of that country under its laws.
9. How long we keep it
| Information | Kept for |
|---|---|
| Account and shop data | As long as the account is open; after it ends, 60 days in read-only mode, then deleted. A deletion request takes effect after a 7-day cooling-off period. |
| Off-site backups of each shop’s database | Every night: daily copies are kept for 30 days and monthly copies for 12 months; a removed copy stays recoverable for 30 more days. After a shop is deleted, its last copies are gone within 62 days. |
| Server snapshots (database, photos and documents) | Daily, kept for 7 days |
| Off-site copy of photos and documents | Updated every night; a removed file is erased from it after 30 days |
| Server logs | 30 days |
| Register of confidentiality incidents | At least 5 years |
| Billing and accounting records | As long as tax laws require (generally 6 years in Canada) |
| Correspondence with us | Up to 3 years after our last exchange |
When information is no longer needed, we delete it or anonymize it. Our privacy governance policy describes how.
10. How we protect it
Encryption in transit (HTTPS) everywhere, encrypted storage and backups, a separate database for each shop, role-based permissions, optional two-step sign-in, hashed passwords and session tokens, lockouts after repeated failed attempts, audit logs, and access to production systems limited to the people who need it. More on our Security page.
11. Your rights
Depending on where you live, you can ask to:
- access the personal information we hold about you and learn how it is used and shared;
- correct information that is inaccurate, incomplete or out of date;
- delete it, or ask us to stop disseminating it or to de-index a link to it where the law provides this;
- withdraw your consent to a use that relies on consent;
- receive the computerized information you provided in a structured, commonly used technological format (data portability).
Write to privacy@mygaragio.com. We will confirm your identity before answering and respond within 30 days. It is free, except for a reasonable fee for a copy that requires substantial work, which we would tell you about first. If a shop’s customer writes to us about the shop’s data, we forward the request to the shop and help it answer.
To make a complaint, write to us first: we acknowledge it within 5 business days and answer within 30 days, as our governance policy describes. If you are not satisfied with our answer, you can complain to the Commission d’accès à l’information du Québec (cai.gouv.qc.ca) or the Office of the Privacy Commissioner of Canada (priv.gc.ca).
12. United States residents
Residents of California and other US states with privacy laws have the right to know the categories and specific pieces of personal information we collect (listed in section 3), the purposes (section 4) and the categories of recipients (section 7); to delete and to correct it; and not to be discriminated against for using these rights. We do not sell or share personal information as those laws define it, and we do not use sensitive personal information to infer characteristics about anyone, so there is nothing to opt out of.
To make a request, write to privacy@mygaragio.com. We verify requests by confirming control of the account’s email address, answer within 45 days (extendable once when the law allows), and accept requests from an authorized agent with your signed permission.
13. Confidentiality incidents
We keep a register of confidentiality incidents (unauthorized access, use, communication or loss of personal information). When an incident presents a risk of serious injury, we promptly notify the Commission d’accès à l’information and the people concerned, and the Office of the Privacy Commissioner of Canada when there is a real risk of significant harm, as the law requires. When an incident affects information we process for a shop, we notify the shop without undue delay and give it what it needs for its own notices.
14. Cookies and tracking technologies
We use only the cookies and browser storage the service needs (for example, to keep you signed in and remember your language). We use no advertising or analytics cookies and no technology that locates or profiles you or follows you from site to site. Details are on the Cookies page.
15. Children
MyGaragio is a business tool and is not directed at children. We do not knowingly collect information from people under 14.
16. Changes to this policy
We update this policy when our practices change. The "Last updated" date shows the current version; for significant changes we notify account owners by email and in the app before they take effect.
17. Contact
Privacy questions and requests: privacy@mygaragio.com. Security reports: security@mygaragio.com.