Privacy Policy

This Privacy Policy explains how ScalePath [insert full legal entity name and form], the operator of the Garage Cost Control Garage Management System (the "Service"), collects, uses, discloses, and protects information in connection with the Service. It should be read together with our Terms of Use and Disclaimer. Capitalized terms not defined here have the meaning given in the Terms of Use.

1. Roles: who is responsible for what data

It is important to understand the different roles at play, because they are not all ours to control:

• Account & billing data (your name, email, workspace details, subscription and payment records) — we act as the data controller: we decide why and how this information is processed, in accordance with this Policy.
• Tenant Content (customers, vehicles, work orders, invoices, and any Tenant Customer information the Tenant chooses to enter) — the Tenant acts as the data controller, and we act only as a data processor on the Tenant's instructions. The Tenant is responsible for having a lawful basis to collect and store its Tenant Customers' information in the Service, for honoring any rights those Tenant Customers may have, and for its own compliance with data-protection law in respect of that data. We are not a party to the relationship between a Tenant and its Tenant Customers — see our Disclaimer.

2. Information we collect

• Account information: name, email address, phone number (optional), password (hashed, never stored in plain text), and role within a Workspace.
• Workspace / Tenant Content: customer records, vehicle records, work orders, invoices, inventory, appointments, expenses, and any photographs or documents you or your Authorized Users upload — including any Tenant Customer information you choose to enter.
• Billing information: subscription plan, billing history, and payment status. Card details are collected and processed directly by our payment processor (Stripe) and are not stored on our servers.
• Technical & usage data: IP address, browser and device information, log data, and diagnostic information, collected automatically to operate, secure, and improve the Service.
• Communications: messages you send us for support, or that flow through the Service's notification features (for example, the Tenant's own WhatsApp contact link, which the Tenant configures and controls).

3. How we use information

• To provide, operate, and maintain the Service, including authenticating users and enforcing tenant isolation;
• To process Subscriptions and payments, and to communicate about billing, including suspension or cancellation for non-payment (see our Terms of Use, Section 4.1);
• To send transactional communications — account verification, password resets, staff invitations, and payment receipts;
• To monitor, secure, and improve the reliability and performance of the Service, including diagnosing technical issues;
• To comply with legal obligations, and to enforce our Terms of Use.

We do not sell personal information, and we do not use Tenant Content to train third-party AI models.

4. Tenant isolation & security

Every Workspace is a logically and, where applicable, cryptographically separated tenant. Application-level access controls restrict each Tenant's data to that Tenant's own Authorized Users, reinforced by database-level row-level-security policies as a defense-in-depth measure. Platform personnel access Tenant Content only where necessary to provide support, investigate abuse, or comply with law, and such access is limited and logged. We use industry-standard technical and organizational measures — including encrypted connections, hashed credentials, and access controls — designed to protect information against unauthorized access, alteration, disclosure, or destruction. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

5. How we share information

We share information only as necessary to provide the Service, and never sell it. Our sub-processors include:

• Payment processing: Stripe, to process subscription payments and manage billing.
• Hosting & infrastructure: our cloud hosting and database providers, to run and store the Service.
• Object storage: a cloud storage provider (where configured) for uploaded images such as logos and vehicle documents.
• Email delivery: an email service provider, to send transactional emails such as verification and password reset links.

We may also disclose information where required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets (in which case we will require the successor to honor the commitments in this Policy).

6. International transfers

Depending on where you and your infrastructure providers are located, information may be processed in countries other than your own. Where we transfer personal information across borders, we take steps intended to ensure it receives an adequate level of protection, consistent with applicable law.

7. Data retention

We retain account information and Tenant Content for as long as the Workspace remains active, and for a reasonable period after cancellation or termination to allow data export and to comply with legal, tax, or accounting obligations, after which it is deleted or anonymized in accordance with our internal retention practices. If a Subscription is suspended or terminated for non-payment as described in our Terms of Use, Tenant Content may be deleted following termination.

8. Your rights

Depending on your location and applicable law, you may have rights to access, correct, export, or request deletion of your personal information, or to object to or restrict certain processing. Where the Tenant is the data controller of Tenant Content (see Section 1), such requests concerning Tenant Customer information should generally be directed to the relevant Tenant in the first instance; we will support the Tenant in responding to such requests as required by applicable law. For account-level requests, contact us using the details in Section 11.

9. Cookies & similar technologies

We use strictly necessary cookies to maintain your session and language preference. We do not use third-party advertising or cross-site tracking cookies. Where non-essential cookies are introduced in the future, we will provide appropriate notice and choice as required by applicable law.

10. Children's privacy

The Service is intended for business use by adults and is not directed at children. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can take appropriate action.

11. Changes to this Policy & contact

We may update this Privacy Policy from time to time; we will update the effective date above and, for material changes, provide reasonable notice. For privacy questions or requests, contact us at [insert privacy contact email, e.g. "privacy@scalepath.me"] or via scalepath.me.