Privacy Policy

Carpanion is shop management software for independent automotive repair shops and dealers. We are operated as Carpanion in Alberta, Canada. Shops buy Carpanion at carpanion.ca and run their day to day work at shop.carpanion.ca.

This policy explains what personal information passes through the platform, who is responsible for it, and what you can do about it. If anything here is unclear, write to support@carpanion.ca.

There are two different relationships here, and the difference matters.

A shop's own customer records belong to the shop. The shop decides what it collects about its customers, what it enters, and how long it keeps it. We hold and process those records on the shop's behalf and under the shop's instructions. We do not decide what goes in them.

Carpanion is responsible for the shop's own account data. That means staff logins, billing records, support correspondence, and product telemetry about how the software is used. For that information, we make the decisions and this policy is the full account of them.

If you are a vehicle owner and you want your record corrected or deleted, contact the shop that holds it. The shop can act on that directly, and we help the shop do it. If you cannot reach the shop, write to us at support@carpanion.ca and we will pass your request on and follow it up.

Depending on what a shop uses, the platform handles:

• Shop staff accounts. Name, email, role, and authentication credentials handled by Supabase Auth.
• Shop customers, entered by the shop. Name, phone, email, and postal address.
• Vehicles. VIN, licence plate, make, model, year, mileage readings, service history, and photos and video taken during inspections.
• Work records. Appointments, estimates, inspections, work orders, invoices, payments, deposits, warranty forms, and Alberta compliance forms including AMVIC, salvage, and vehicle for hire.
• Signatures and documents. Signatures captured on waivers, deposit agreements, and deal documents, plus scans of documents a shop uploads.
• Messages. Messages a shop sends to its customers by SMS, email, and Facebook Messenger, including their content and delivery status.
• Payment records. Amounts, method, card brand, the last four digits, and the processor's own payment identifiers.
• Operational logs. Application logs and an immutable audit trail of who changed what, kept for the shop's own protection.

We handle this information to run the software a shop has bought: to keep its records, produce its estimates, inspections, invoices and compliance documents, deliver the messages it sends to its customers, record the payments it takes, keep an audit trail of changes, provide support when a shop asks for it, and bill for the subscription.

We do not use a shop's customer data for any purpose the shop has not asked for.

Carpanion never stores full card numbers. Cards are entered on Stripe's or Clover's own hosted surfaces, or on the shop's Clover terminal. Those companies are PCI compliant payment processors and the card details stay with them.

What we keep is the record of the payment: the amount, the method, the card brand, the last four digits, and the processor's own payment identifiers. That is what a shop needs to reconcile a job, and it is all we hold.

Running the platform means working with other companies. Each one gets only what its job needs:

• Supabase. Database, authentication, and file storage.
• Google Cloud Run. Application programming interfaces and document rendering, in a Canada adjacent United States region.
• Vercel. Website hosting.
• Stripe. Card payments, payouts to shops, and Carpanion's own subscription billing.
• Clover. Card payments taken online, on a pay link, or on a shop's terminal.
• Telnyx. Text messages and voice.
• Resend. Transactional email.
• Meta. Facebook Messenger and vehicle listing syndication, only where a shop connects it.
• Google Business Profile. Posts, reviews, and hours, only where a shop connects it.
• Intuit QuickBooks. Accounting export, only where a shop connects it.
• Nexpart. Parts ordering, only where a shop connects it.
• Anthropic. Drafting assistance for blog posts, review replies, and document parsing. Shop data is sent only when a shop uses those features, and it is not used to train models.
• Sentry. Error monitoring.
• Flagsmith. Feature flags.

Data is stored and processed in the United States and Canada.

We do not sell personal information. We do not use a shop's customer data for advertising.

Cookies are limited to what signs a user in and remembers their preferences. There is no third party advertising and no cross-site tracking on the app.

Data is encrypted in transit and at rest. Access inside a shop is limited by role, so a technician sees what a technician needs. Each shop's data is isolated from every other shop's. Changes to records are written to an audit trail that records who changed what and when.

No system can be guaranteed secure, and we are not going to claim otherwise. What we can say is that we design for the case where something goes wrong: the audit trail exists so a shop can reconstruct what happened, and errors are monitored so we find out about them.

For a shop's customer records, the shop decides. It sets what is collected and how long it is kept, and it can correct or remove a record at any time. The audit trail of changes is retained for the shop's own protection.

For a shop's account data, we keep it while the shop has an account with us and for as long as we need it to meet our own legal and accounting obligations.

Canada's federal private sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), and Alberta's Personal Information Protection Act (PIPA) give you the right to ask what personal information is held about you, to get access to it, and to have it corrected if it is wrong.

If you are a vehicle owner or a shop customer, send that request to the shop. The shop holds the record and decides on it. If the shop needs our help to find, export, correct, or delete something, we provide it.

If you are shop staff and the request is about your own account data, write to us at support@carpanion.ca and we will handle it directly. You can also delete your account yourself, in the app or on the web.

If you are unhappy with how your information has been handled, there is an order to follow:

• Start with the shop that holds the record. Most questions are answered fastest there.
• If that does not resolve it, or the issue is with the platform itself, write to us at support@carpanion.ca.
• If you are still not satisfied, you can complain to the Office of the Privacy Commissioner of Canada, or to the Office of the Information and Privacy Commissioner of Alberta.