Privacy Policy

Account information. When a shop owner signs up, we collect the business name, owner name, email, phone, city, state, and chosen plan. We also create a unique workspace for the business and an owner login.

Payment information. Card details entered during signup are tokenized by our payment processor (Stripe) before reaching our servers. We store only the card brand, last four digits, expiration month and year, cardholder name, and billing ZIP. We never persist a full card number or CVC.

Operational data (Tenant Data). When Shops use MotoFlow Pro, they enter information about their End Customers, vehicles, appointments, parts inventory, invoices, inspections, and accounting. This data belongs to the Shop and we process it on the Shop's behalf.

Customer-facing portal data. When a Shop's End Customer follows a portal or estimate link, we may store their name, contact information, vehicle, and service-request details to relay them back to the Shop.

Usage and device data. We log requests to the Service (IP address, user agent, pages visited, timestamps) for security, debugging, and to improve the product. We also maintain an internal audit log of sensitive admin actions and a short-lived error log for diagnosing runtime exceptions.

Sensitive personal information. Certain features collect information that may be classified as sensitive personal information under California or other state laws:

• Precise geolocation. When a Shop's technician enables GPS sharing on a job marked en-route, we collect device location at intervals to power the customer-facing live tracking link. Location data is purged after the job is completed plus 90 days.
• Inspection photos. Digital Vehicle Inspection (DVI) features let Shop technicians attach photos to inspection items. These may incidentally capture license plates, household items in driveways, or other identifying information. Photos are stored only against the Inspection record and shared only with the Shop and (via the public receipt link) the specific End Customer the inspection is for.
• Account credentials. Passwords are stored only as bcrypt hashes; we never have access to plaintext.

We do not collect government identifiers (SSNs, driver's license numbers, etc.), health information, racial or ethnic origin, religious beliefs, or sexual orientation. We do not knowingly process biometric data.

Push notification tokens. If you enable push notifications, we store the device tokens issued by your operating system or browser so we can deliver alerts. These tokens identify your device, not you personally.

Cookies and similar technologies. We use the following categories of cookies (no third-party advertising cookies, no cross-site tracking pixels):

• Strictly necessary. One HMAC-signed session cookie for authenticated users and an "active tenant" cookie that scopes the workspace for multi-shop users. Without these, login and tenant isolation cannot function.
• Functional. A theme-preference cookie (light/dark) and a preferred-language cookie for the customer portal. These reflect choices you make in the UI.
• Attribution. A 30-day referral-attribution cookie set when an End Customer or Shop visits a referral short-link (/r/<code>) so the referring Shop can be credited.

Optional third-party integrations. If a Shop connects a third-party service (Stripe Connect, Square, Twilio, Resend, Google Calendar, QuickBooks, etc.), we store the OAuth tokens or API credentials needed to operate that integration on the Shop's behalf.

We use the information described above to:

• Provide, secure, and improve the Service;
• Bill Shops for their MotoFlow Pro subscription and process trial conversions;
• Send transactional messages (signup confirmations, billing notices, trial-end reminders, support replies);
• Relay messages between Shops and their End Customers (estimates, invoices, appointment confirmations);
• Detect, prevent, and respond to fraud, abuse, or security incidents;
• Comply with legal obligations and enforce our Terms of Service.

We do not use Tenant Data to train any general machine-learning model. AI-feature payloads sent to Anthropic, PBC are processed under Anthropic's enterprise commitment that data submitted via API is not used for model training. See Section 5 for specifics.

We do not sell personal information. We do not "share" personal information for cross-context behavioral advertising. We have not done so in the preceding 12 months and have no current plans to do so.

We share information with the service providers listed below ("Sub-Processors") only to the extent necessary for them to provide their service to MotoFlow. Each Sub-Processor is contractually bound to confidentiality and to use the data only as instructed. The current list is:

• Stripe, Inc. — subscription billing, payment tokenization, tenant Connect onboarding, and (when enabled) Stripe Financial Connections / Link for "pay by bank" ACH. The bank-link UI is hosted entirely by Stripe; we never see customer banking credentials.
• Square (Block, Inc.) — payment processing for Shops who choose Square as their processor.
• Twilio, Inc. — outbound SMS, when a Shop connects Twilio credentials.
• Resend, Inc. — transactional email (account verification, password reset, billing reminders).
• Apple Push Notification service (Apple Inc.) — iOS push delivery for Shops using our iOS app.
• Firebase Cloud Messaging (Google LLC) — Android push delivery for Shops using our Android app.
• Geoapify GmbH — geocoding and routing for live ETA and the customer tracking map.
• OpenStreetMap contributors — base map tiles for tracking views.
• Translation providers — DeepL, Google Cloud Translation, LibreTranslate, or MyMemory (configurable per deployment) for customer-portal language switching.
• Anthropic, PBC — AI features (Claude). When a Shop user clicks an AI button in the workspace, we send a focused, purpose-specific payload to Anthropic's Messages API. See Section 5.
• Google LLC — when a Shop connects Google Calendar, we push appointment details (title, time, customer first and last name, vehicle year/make/model, service address, and the link back to the job in MotoFlow) to the connected Google Calendar. We never read events back from the calendar.
• Sentry (Functional Software, Inc.) — error tracking, when configured.
• Cloud infrastructure providers — database, hosting, and backups. The current production deployment uses Vultr (The Constant Company, LLC) for compute and is operated under our control. We will name additional providers on request.

Sub-Processor changes. We will update this list when we add or remove a Sub-Processor. For Shops on annual plans or with a separate Data Processing Addendum, we will provide at least 30 days' notice of new Sub-Processors before they begin processing Tenant Data, during which time the Shop may object.

Other disclosures. We may also disclose information (a) to comply with applicable law, legal process, or governmental request; (b) to enforce our Terms of Service; (c) to protect the rights, safety, or property of MotoFlow, our users, or others; or (d) in connection with a merger, acquisition, or sale of all or part of our business, in which case we will require the recipient to honor commitments materially equivalent to this Privacy Policy with respect to your information.

We do not use any solely-automated decision-making or profiling that produces legal or similarly significant effects about you. AI-generated text in MotoFlow Pro is always a draft presented for human review and approval; no AI output is sent to an End Customer, used to bill an End Customer, or used to take adverse action against a Shop without a person at the Shop or at MotoFlow explicitly approving it.

When AI features are enabled by your Shop's plan, the following data is sent to Anthropic, PBC for the stated purpose. No other data is sent. Customer phone numbers, addresses, payment card data, government IDs, and SSNs are never sent to Anthropic. Anthropic's enterprise API terms preclude use of API submissions for model training.

• Inspection summary: the items, statuses, and tech notes on that inspection, plus the vehicle's year/make/model and the customer's first name.
• Service recommendations: the vehicle's year/make/model/engine/mileage/VIN and a list of services completed on that vehicle in the last 12 months.
• Estimate line rewriter: the line description text only.
• Vehicle history briefing: the vehicle's year/make/model/mileage, the customer's name, and the last 6 months of appointment titles, statuses, and tech notes.
• Support reply assistant (admin-side): the support ticket subject and the last 12 messages on the thread, plus a static MotoFlow help digest.
• Book-time generator (workspace labor field): the operation description and the vehicle year/make/model/engine the technician is working on.

AI features are disabled by default on Basic plans and can be disabled per-feature by your Shop owner from the workspace settings, or by the MotoFlow platform team on request. We log token counts and dollar cost per AI call in our own database for usage analytics, but no Tenant Data is retained by Anthropic on our behalf beyond what their API normally caches for fraud / safety review (30 days, per Anthropic policy).

Shops own the data they enter into MotoFlow Pro about their business and their End Customers. We process Tenant Data only to provide the Service or as the Shop instructs. End Customers should direct privacy requests about Tenant Data to the Shop they do business with; we'll cooperate with the Shop to fulfill those requests.

Data Processing Addendum. Shops subject to GDPR, UK-GDPR, the CCPA, or other applicable data protection law may execute a Data Processing Addendum with MotoFlow by emailing privacy@motoflowpro.com.

We use industry-standard safeguards, including TLS 1.2+ in transit, encrypted backups, bcrypt password hashing, HMAC-signed session cookies, role-based access controls, scoped tenant isolation, and tokenized card storage. No system is perfectly secure.

Breach notification. If we discover a personal information breach affecting your data, we will notify affected Shops without undue delay and, where required by applicable law, no later than 72 hours after we become aware of the breach (the GDPR standard, which we apply globally as a baseline). Notification will describe the nature of the breach, the categories of data and individuals affected, the likely consequences, and the measures taken to address it.

We retain different categories of information for different periods, summarized below. Where law requires longer retention (e.g., tax records, financial transaction logs), the longer period controls.

• Active Shop account data: retained for the duration of the subscription plus 30 days after cancellation, after which it may be deleted on request or routinely purged within 90 days.
• Platform invoices and billing records: retained for 7 years to satisfy US tax and accounting record-keeping obligations.
• Audit logs (sensitive admin actions): retained for 2 years.
• Request logs (IP, user agent, timestamps): retained for 90 days.
• Error logs: retained for 30 days.
• Geolocation data: purged within 90 days of the associated job completing.
• Push notification tokens: purged when the device unsubscribes or after 365 days of inactivity, whichever is sooner.
• Card metadata (brand/last4/expiry): deleted when a payment method is removed.

Depending on where you live, you may have some or all of the following rights with respect to your personal information. We honor these rights regardless of whether the applicable law requires us to:

• Right to know / access. Confirmation of whether we process your data and a copy of it.
• Right to correct / rectify. Correction of inaccurate or incomplete information.
• Right to delete / erasure. Deletion of your data, subject to legal retention requirements.
• Right to portability. Export of your data in a structured, machine-readable format. Shops can self-serve from Settings → Data export.
• Right to opt out of sale or sharing. We do not sell or share personal information for cross-context behavioral advertising, so this right is honored by default.
• Right to limit use of sensitive personal information. You may ask us to limit our use of geolocation or other sensitive data to the purposes described in this Policy.
• Right to non-discrimination. We will not deny service, charge different prices, or provide a different level of service because you exercised any of these rights.
• Right to appeal. If we deny a request, you may appeal by replying to our decision; we will respond to appeals within 45 days.

How to exercise rights. Email privacy@motoflowpro.com with your request. We will respond within 45 days (extendable by an additional 45 days where reasonably necessary, with notice) for US state law requests, and within 30 days (extendable by 60 days) for GDPR / UK-GDPR requests. We may need to verify your identity before fulfilling the request.

Authorized agents. You may designate an authorized agent to make a request on your behalf. We will require written proof of authorization and may verify your identity directly.

Account self-service. Shop owners can update or correct account information from workspace settings, export their Tenant Data from Settings → Data export, and disable AI features per-feature without contacting us.

California (CCPA / CPRA). The categories of personal information we collect (per Cal. Civ. Code §1798.140) are: identifiers (name, email, IP); customer records (account information); commercial information (transactions, billing); internet activity (usage logs); geolocation (precise, when GPS sharing is enabled); professional information (Shop role); and sensitive personal information limited to precise geolocation and account login credentials. We collect, use, and disclose each category for the business purposes described above. We do not sell or share personal information. California residents have the rights enumerated in Section 9.

Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Nebraska, Indiana, Kentucky, Rhode Island. Residents of these states have rights substantially similar to those enumerated in Section 9, subject to the specifics of each state's law. Email privacy@motoflowpro.com to exercise them.

Nevada residents. Although we do not sell personal information, Nevada residents may submit a verified opt-out request to the email address above.

When a Shop sends SMS through the Service, the Shop — not MotoFlow — is the sender. End Customers can reply STOP to that Shop's number to opt out of all future SMS from that Shop. Reply HELP for help. Message and data rates may apply. Frequency varies by Shop. Opt-outs are honored within 24 hours and propagate to all message categories (tracking links, review requests, appointment reminders, payment reminders).

You can disable push notifications at any time from your device settings, your browser settings, or from the Notifications panel inside the workspace.

MotoFlow Pro operates from the United States. By using the Service, you understand that information may be transferred to and processed in the United States and other countries where our Sub-Processors operate. When we transfer personal information of EEA, UK, or Swiss residents outside those regions, we rely on the European Commission's Standard Contractual Clauses or equivalent transfer mechanism. Additional information on our transfer safeguards is available on request.

The Service is not intended for individuals under 16. We do not knowingly collect information from children. If you believe a child has provided personal information to us, contact privacy@motoflowpro.com and we will delete it.

We may update this Privacy Policy from time to time. When we do, we'll revise the "Last updated" date above and, for material changes that expand the categories of data collected or the purposes of processing, provide at least 30 days' advance notice in the Service or by email before changes take effect.

Questions about this policy? Email privacy@motoflowpro.com. For general support, email support@motoflowpro.com.