Privacy Policy

1. Who we are

This Privacy Policy describes how INU Technologies Inc., a corporation incorporated under the laws of the Province of Ontario, with its official business address at 350 Bay St Suite 1300b, Toronto, ON M5H 2S6, Canada (“INU Technologies”, “we”, “us”, or “our”), handles personal information in connection with the operation of the CarFix website and Customer, Manager, and Admin mobile apps (together, the “Platform”). INU Technologies is the operator of the Platform and is the business that contracts with Customers and Shops. “CarFix” is the brand under which INU Technologies offers the Platform, the legal entity is INU Technologies Inc.

We handle personal information under applicable privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA), the Alberta and British Columbia Personal Information Protection Acts, and Canada’s antispam legislation (CASL). PIPEDA governs commercial transfers across provincial and national borders. Applicable provincial privacy law governs processing within its jurisdiction. Mandatory protections under Quebec law remain available where that law applies.

INU has selected the privacy requirements of Quebec’s Act respecting the protection of personal information in the private sector as its compliance standard across the Platform. This standard applies alongside PIPEDA and other applicable privacy laws. Statutory jurisdiction and mandatory rights remain governed by the applicable law.

2. Our approach to privacy and governance

INU Technologies' privacy governance procedures set out how personal information is classified, collected, used, disclosed, retained, and destroyed, how subprocessors are reviewed, how privacy impact assessments are carried out under our whole Platform Quebec standard, including projects to acquire, develop or overhaul information systems and the assessments and written agreements for covered processing outside Quebec, how we respond to access, correction, and complaint requests, and how we handle security incidents. The title and contact details of the person in charge of the protection of personal information are set out in Section 19.

We follow the ten fair information principles established under Schedule 1 to PIPEDA: accountability, identifying purposes, consent, limiting collection, limiting use and disclosure, accuracy, safeguards, openness, individual access, and challenging compliance. This Policy is written in plain language so that you can understand what we do with your information before you provide it. More technical governance documentation is held internally and is available on request, to the extent permitted by law, from the Privacy Officer.

3. What information we collect

We collect different categories of information depending on how you use the Platform. Some information you provide to us directly, some is generated automatically by your device or our systems, and some is supplied by a Shop about its customers or team members. This includes people who do not have a CarFix account. We treat the categories marked “private” and “sensitive” below with a higher level of access control than public content.

3.1 Account and contact information (identifying)

Your name, email address, phone number, a salted password hash when you register with a password (we never store passwords in plain text), your account role (customer, shop owner, team member, or administrator), and your notification preferences, saved locations, and favourite Shops. A Shop owner’s verified phone number is also used to verify the Shop.

3.2 Vehicle information (sensitive)

Your vehicle year, make, model, and trim, odometer readings, and, if you choose to provide it, your Vehicle Identification Number (VIN), licence plate, and powertrain code. Optional coverage and purchase records can include a coverage provider or dealer, contract or reference number, coverage dates, deductible, purchase date and mileage, and notes you enter. Vehicle service history in your garage is populated from (a) entries you make manually, and (b) appointments completed through the Platform that you chose to associate with a vehicle. During a visit for a vehicle you attached, the Shop can record its odometer reading. You can approve it, which can update the odometer in your garage, or decline it, and any reading of your own that you give is shown to the Shop. Next to its reading, the Shop sees the odometer figure in your garage and whether it is estimated or reported by a connected vehicle. When you are not asked, for example on a walk in visit, a visit with no attached vehicle, for a vehicle you have archived or while your account is deactivated or scheduled for deletion, the Shop keeps its reading with the visit only. These readings are kept with the appointment and are included in your data export. Vehicle information is visible to a Shop only when you expressly attach a vehicle to a quote request or a booking with that Shop. Vehicle information is not displayed publicly or shared with other users. VIN data, combined with mileage and service history, can be identifying in combination, we therefore restrict internal access to these fields to the circumstances described in Section 9.

3.3 Private service coordination content (private)

The description of the problem you submit in a quote request, the list of services you select in a quote request and any flag indicating that you will supply your own parts for a service (a “BYOP” flag), photos and inspection videos associated with a quote or an appointment, text and voice messages you exchange with a Shop through the in app messaging feature (voice messages are stored as short audio recordings alongside message text, duration, and related metadata), digital vehicle inspection (DVI) findings recorded by a Shop for a job you authorized, and your inspection approvals or declines and their timestamps. This content is visible to the Shop you selected and to authorized CarFix staff under the conditions in Section 9. It is not displayed publicly.

3.4 Shop business information

For Shops: business legal name, trade name, business address, opening hours, services offered, pricing, amenities, certifications, specialties, public photos, insurance or licensing details uploaded during onboarding, team member records, and public business contact details. A Shop's public profile page is visible to anyone who visits the Platform, uploaded licensing or insurance documents are not public and are used only for verification and compliance. The owner’s verified phone number, and the verification phone number that some older Shop records still hold, are used only for verification and are not displayed as public business contact numbers. Shops can provide separate public business contact channels for profile visitors.

Shop managed operational records. Shops on the paid plan may use additional internal record keeping features that store business data about jobs done for Customers: inventory and parts (the Shop's own SKU list, stock counts, parts metadata, and per appointment deductions) and internal notes written by Shop staff about a Customer or appointment. Inventory data and internal notes are shown to authorized Shop staff rather than in the Customer interface. A request to access personal information within a note is assessed under Section 14, including any necessary third party redaction.

Shop invoices and receipts. Shops may use CarFix to create, store, and send invoices and receipts. These records can include your name and contact details, vehicle information, service date, itemized charges, discounts, taxes, payment terms, and the payment date and method recorded by the Shop. They can also show the Shop’s own payment details, such as its bank account, the account holder’s name and an electronic transfer email address. Issued documents preserve a snapshot of these details and the Shop's identity and tax registrations. A recipient without an account may receive an invoice link that stays valid for thirty (30) days. Anyone holding that link can open the document while it is valid.

Walk in customers and customer property. A Shop may enter a non account customer's name, phone number, email address, vehicle details, and service notes to arrange work. Shops may also record property left in their care, its condition, storage or related fees, and pickup details. The Shop is responsible for explaining its own collection and obtaining any required consent. You can contact the Shop or our Privacy Officer about personal information held in these records. If you later accept an invitation from that Shop with a CarFix account, the records of that visit, such as its invoice, appear in your account. If the invitation was sent to the email address or phone number the Shop recorded for you, and your account has confirmed that same address or number, your data export also includes the invoices the Shop issued for your other visits under that record, and, for an invitation about stored tires or wheels, the sets the Shop stores for you move to your account. The Shop does not see this link, and it ends if the Shop changes that contact detail. If a second account confirms the same record, neither account receives those other invoices.

Team membership and wage records. Shops may record a member's role, permissions, active or inactive membership, and hourly wage history, including rate, currency, and effective date. These records support scheduling and estimated labour cost calculations. CarFix does not use this feature to pay wages or make payroll deductions.

Team member attendance records. A Shop on a qualifying plan may use CarFix to record when its team members start and end a work session. This information is about the team member, not about a Customer. Each record holds the start and end times taken from our servers' clock, any scheduled shift it matched, and, for each of the two moments described in Section 3.9, how far the member's device was from the Shop, the reported accuracy of that reading, and whether the result was verified or flagged. For the check in reading it also records which of the Shop's locations the comparison used. A member's coordinates are never stored. Where a session was flagged, the record also holds the reviewing manager's decision and any note they wrote. A member can ask for a correction, which is kept with its reason and any note. These records are visible to the team member, to the Shop owner, and to team members the owner has granted the team management permission. A team member can export their own attendance records through the data export tool described in Section 14. CarFix provides these records to the Shop as a record keeping tool, the Shop decides whether to use attendance features and is responsible for its own obligations to its staff, including any workplace electronic monitoring policy its jurisdiction requires.

Shop owner identity verification capability (Stripe Identity). This separate capability is currently disabled. It is not a universal prerequisite for current Shop setup or listing approval. Any future use requires separate approval of its purpose, sensitive and biometric processing, consent, protections and retention before collection begins. The proposed flow would send the owner’s email and an internal Shop identifier to Stripe, with documents and a selfie entered directly in Stripe’s flow. Existing verification records remain subject to record specific access and retention review.

3.5 Reviews and ratings (public)

Ratings and written reviews that you publish about a Shop after a completed service. Reviews are displayed publicly on the Shop's profile, and the name or handle you have chosen on your account is displayed with each review.

3.6 Support communications

The content of support tickets, emails, and chat messages you send to our support team, together with any attachments you upload.

3.7 Subscription billing information (Shops only)

New Shop subscription purchases are currently restricted to the approved company scope. Within that scope, purchases use Stripe Managed Payments. CarFix creates or reuses a Stripe customer record and sends the Shop owner’s email address, the Shop’s name, and an opaque internal Shop identifier. Checkout and subscription metadata can contain plan, interval and mode, product and price identifiers, trial and Early Partners details and an offer grant identifier. Stripe and Sold through Link, LLC (“Link SMP”) directly collect the payment method, billing address and any business or tax information entered at Checkout. This description does not make restricted purchasing available to every Shop.

Stripe's APIs and verified webhooks provide CarFix with customer, Checkout Session, subscription, subscription schedule, price, invoice, payment, refund, and tax information. CarFix retains the provider identifiers, billing periods, currency, line items, subtotal, tax, total, payment and refund status, and card brand and last four digits where available. For a new Managed Payments transaction, CarFix does not retain the full payment card number, CVV value, or Checkout billing address as part of its subscription invoice record. Link SMP may retain transaction and buyer records as required to act as merchant of record and provide transaction support.

Existing subscriptions created through standard Stripe Payments processing may continue until cancellation or an assisted migration. Their historical CarFix invoice records can retain Stripe customer, subscription, invoice, and hosted invoice identifiers together with an immutable buyer and seller billing snapshot, including the Shop billing name and address, and the payment summary described above. Online payments of Shop invoices, which are separate from subscription billing, are described in Section 3.7A.

For a payment failure, a required billing action, an upcoming renewal or the end of a subscription, CarFix may send the billing notice to the billing email on Stripe’s records. This can be a billing contact other than the account owner. Scheduled cancellation and resumed subscription notices go to the owner’s account email. These messages can contain the owner’s name, Shop name, plan, dates and, for a renewal or failed payment, the amount. A billing contact without a CarFix account may exercise privacy rights through the Privacy Officer in Section 19.

Link SMP uses order data for its own fraud prevention, security and product improvement purposes as well as providing the transaction. Link may collect online activity and use it for fraud prevention, product improvement and marketing. Stripe also collects online activity from visitors to its hosted Checkout, Billing Portal and invoice pages and uses it for fraud prevention, analytics and advertising. Stripe and Link determine these purposes under their own privacy notices, subject to applicable law and any required consent. They do not act solely on INU’s behalf for these purposes. You can consult Stripe’s Privacy Policy and Link’s Privacy Policy for their practices and rights channels.

3.7A Online service payment information (Customers and Shops)

Where a Shop has enabled online payment, a Customer can pay an invoice issued by that Shop through the Platform. The payment is processed by Stripe on the Shop's own Stripe account, and the Shop is the merchant of record. Card and other payment method details are entered into Stripe's secure payment form and go directly to Stripe. CarFix does not receive the full card number or security code. Where eligible, the payment form can also offer a digital wallet such as Apple Pay or Google Pay. The wallet provider gives Stripe a secure payment token for your card under its own terms, and CarFix records the payment as a card payment. To create the payment, CarFix sends Stripe the invoice amount and currency, the Customer's name as shown on the invoice, the Shop's country, which Stripe uses to offer only the payment methods available there, the Shop’s invoice number, and opaque CarFix identifiers. Stripe's APIs and verified webhooks provide CarFix with the payment's status, amount, and currency, the payment method type (for example, card, Klarna, or Affirm), the card brand and last four digits where available, any decline or failure code, refund and dispute status and amounts, the dispute evidence deadline, and Stripe payment, charge, refund, and dispute identifiers. CarFix keeps this information with the Shop's invoice record to show the invoice's paid status to the Customer and the Shop, prevent duplicate charges, reconcile refunds and disputes, and provide support. The billing details a Customer enters in the payment form, such as name, email address, address, and postal code, are collected by Stripe on the Shop's Stripe account. Some of Stripe's messages to CarFix about a payment, such as a refund notification, can contain these details. CarFix uses only the information listed above and does not store the billing details. Stripe retains them on the Shop's Stripe account, where the Shop, as merchant of record, can use them, including to respond to disputes. CarFix also sends the Customer’s account email to Stripe so Stripe can send the payment receipt.

If a Customer chooses a pay over time method, the financing provider, such as Klarna or Affirm, collects the information it needs to assess, approve, and administer the financing directly from the Customer or through Stripe, and processes it under its own privacy notice. CarFix does not receive the Customer's credit information or the reasons for the provider's decision. Besides the payment information listed above, including the payment method type, which shows that the Customer chose to pay over time, CarFix learns only whether the payment completed and, if it did not, the failure code Stripe reports, which may show that the provider declined the payment. CarFix keeps that code with the Shop's invoice record as described above.

To accept online payments, a Shop owner completes Stripe hosted onboarding for each Shop location. Identity, beneficial ownership, business registration, tax, and bank account details entered there go directly to Stripe, and Stripe may obtain information from credit agencies to verify the owner's identity. To prefill the Stripe account, CarFix sends Stripe the Shop's business name, country, and currency, a proposed statement descriptor based on the Shop's name, the owner's email address and language, the address of the Shop's public CarFix page, its business category, and its support contact details. CarFix receives and keeps the Stripe account identifier, whether charges and payouts are enabled, outstanding verification requirements, enabled payment method capabilities, the account's country and currency, whether the account's statement descriptor identifies the Shop, when Stripe rejected, suspended or terminated the account or placed it under review, and when and how the account's connection to CarFix ended (removed from CarFix, or closed). CarFix uses that Stripe status only to keep online payment disabled while it applies, to decide whether the Shop may connect a new Stripe account, and to show the Shop and CarFix support why online payment is unavailable. To determine it, CarFix reads the reason Stripe gives for disabling the account, which can indicate suspected fraud, a breach of Stripe's terms or a possible match against a list of prohibited persons or companies, and does not keep that reason. CarFix reads the statement descriptor, which can include the owner's name, only to determine whether it identifies the Shop, because CarFix may leave online payment disabled, or disable it, while the descriptor does not identify the Shop, as described in our Terms of Service. CarFix does not keep the descriptor Stripe reports. It keeps only the descriptor the Shop saves in CarFix. The account information Stripe sends CarFix can also include details of the Shop's payout accounts. For a bank account, these are the holder's name, the bank, the routing number (in Canada, the branch transit and institution numbers) and the last four digits. For a debit card, they are the cardholder's name, billing address, card brand, expiry date and last four digits. The information can also include some of the owner's or business's details. CarFix does not use or store any of them. CarFix does not receive the owner's identity documents, full bank account numbers or full card numbers through this flow.

3.8 Technical and security information

• Usage data. Your session history (device name, browser or app, IP address, sign in time and last activity) and the request logs our hosting provider keeps. We do not record the pages you visit or what you click or tap, except that an error report can include the steps that led to the error (Section 7).
• Device and connection data. IP address, user agent string, browser type, operating system, device type, and coarse language and time zone settings.
• Security and abuse prevention signals. Login attempts, rate limit triggers, and suspicious pattern flags.
• Cookies. Session and preference cookies used to keep you signed in and to remember settings. We do not use third party advertising cookies.
• Performance and product analytics. CarFix does not use analytics. Vercel Analytics, Speed Insights and our own activity events are turned off, whatever you choose in the cookie banner. Our servers log request timings without identifiers to keep the Platform reliable. When a search finds no Shop, we keep the words searched, with a count, to improve search. These words are not linked to an account, but they are kept until we delete them and can include anything typed into the search. None of this is used for advertising.
• Push notifications. If you allow notifications in your browser or in a CarFix app, we store the registration it gives us: an Expo push token for an app, or a browser push endpoint with its delivery keys, together with the platform, the app and the account or session it belongs to. We use it only to deliver your notifications. A notification about a message, an appointment or a quote shows its title and a short preview of its text, without any price. In that preview, email addresses, card numbers, VINs, phone numbers and licence plates in common formats are replaced, but text a person wrote can still contain other details. A notification about an invoice, a payment or a subscription shows the Shop’s name and a fixed sentence, with no amount, invoice number or payment outcome. Other notifications show a general text. The link in a notification identifies only the item it opens. Notifications can appear on your lock screen unless you hide previews in your device settings. A registration is removed when you turn notifications off or sign out, when the push service reports it invalid, when your sessions are revoked and when your account is erased. If the app cannot finish that removal, it retries the next time it opens. A registration is not removed because of its age alone.

3.9 Location information

We use location information for two purposes: showing you Shops near a place that matters to you, and providing optional location context for Shop team members who use attendance features. Depending on how you use the Platform, that information can come from five sources:

• A place you type. A city or postal code you enter into the shop search form. It is used to run that search.
• Your device's location, with your permission. If you grant location access through your browser or your device's operating system, we use your device's coordinates to find Shops near you and to sort results by distance. Coordinates used for a shop search are processed transiently to answer that search and are not saved to your account. You can decline or revoke this permission at any time in your browser or device settings, and every location feature has a manual alternative (typing a place).
• A service location you attach to a quote request. When you provide a location for a quote request (a typed address, a saved location from your account, or, with your permission, your device's current location), that address and its coordinates are stored with the request so that the Shops you contact can assess distance and respond. Saved locations you add to your account are stored until you delete them and may be used as your default search area.
• An estimate from your IP address. If you search for Shops without granting location access and without typing a place, we may estimate your approximate location (your city and province, and an approximate point within them) from your IP address (part of the connection data described in Section 3.8) so that your first results default to Shops near you rather than a generic list. This estimate is coarse (city level), is computed only for the search in front of you, and is not stored on your account. You can override it at any time by typing a place or granting device location access.
• A team member's device location when they check in or check out. If you are a team member of a Shop that uses attendance features and you grant location access, the CarFix Manager app requests one location reading using balanced accuracy when you tap check in and one when you tap check out. Depending on your device settings and the operating system response, that reading may include precise coordinates. We use the reading as optional context by comparing it with the Shop's address, computing an approximate distance, and marking the session as verified or flagged for manager review. The coordinates are used for that comparison and are not stored, only the derived distance, reported accuracy, and result are kept. Location is read at those two taps only, never in the background and never while you are working. Location is not required to check in. If permission is declined, device location is off, or no reading is available, the app lets you retry or deliberately check in without location. A no location check in is recorded and flagged for manager review. Checking out also remains available without location and closes the session with a review flag. Section 3.4 describes the resulting record.

We do not track your movements, build location histories, or collect location in the background. The CarFix mobile apps request foreground (“while using the app”) location access only, and each reading described above is taken once, in response to something you tapped.

3.10 Cookies, device storage, and your choices

Necessary storage supports sign in, security, your consent choice, a language you explicitly select, and drafts and layout settings that keep a page as you left it. Optional functional storage remembers display preferences, including language inferred from a public page you visit. The optional Performance choice allows your browser to send error reports and performance measurements to Sentry (Section 7). It does not turn on analytics, which CarFix does not use. You can accept, reject, or choose optional categories in the consent banner and reopen those controls using Privacy Preferences in the website footer. Saving a new choice changes future collection, it does not erase records already collected. You can also clear cookies and local storage in your browser.

Native apps keep session credentials in operating system secure storage. They also keep settings, a cached profile, and, depending on the app and feature, local drafts or cached screen data in app storage on the device. Push, location, camera, microphone, and photo permissions are controlled separately by your device. Grant these only for features you choose to use, and revoke them in device settings.

Contract and communication records

Where our document delivery process is used, we retain delivered document versions and hashes, the French delivery receipt, the express contract language choice and acceptance time. Other account acceptance paths record the accepted versions, interface language, source and time without that French delivery receipt. An interface language setting is not an express choice of contract language. Amendment notice and refusal records are kept where that process is used. Booking confirmations preserve their accepted scope, price, policies and legal versions. Review moderation and hashed email opt out records support appeals and communication choices. These records follow the record specific retention and legal obligations described in this Policy.

Online payments and financing are available only for the permitted Shop scope and actually enabled payment methods. A described payment method is not a promise that it is enabled for your Shop. Store verification calls, identifiable Smartcar transfers and commercial VIN transfers are disabled pending their separate approval. Incoming billing evidence can still be retained for existing entitlements, refunds and disputes.

4. Required versus optional information

Some information is required for the Platform to work, other information is discretionary. If you choose not to provide the required information, we may not be able to provide the corresponding feature.

• Required to create an account: name, email address, and phone verification, with a password or a supported sign in provider.
• Required to submit a quote request: vehicle make, model, year, and a description of the issue.
• Required to book an appointment: a confirmed account, the accepted quote, and the time slot you select.
• Required for a Shop to go live: business name, address, services, opening hours and owner contact details. Current Shop setup requires verification of the owner’s account email address and phone number. Public listing requires Shop review approval. Stripe Identity is a separate capability described in Section 3.4.
• Optional everywhere: VIN and licence plate, mileage logs, photos attached to a quote, avatar image, social media links, secondary contacts on your account, and marketing communications.
• Optional per search: city or postal code, you can browse without entering either.

We rely on your consent to collect, use, and disclose personal information. Consent may be express (for example, ticking an opt in box) or implied from the circumstances (for example, submitting a quote request implies that the information in the request may be sent to the Shops you selected). You may withdraw consent at any time, subject to reasonable notice and to legal or contractual restrictions, by contacting our Privacy Officer using the details in Section 19. Withdrawing consent may limit our ability to provide some or all of the Platform's features.

Marketing communications require separate, express opt in consent. Creating an account, submitting a quote request, or booking an appointment does not, by itself, constitute consent to receive marketing (see Section 13).

5. How we use your information

We use the information described in Section 3 for the purposes below, and only to the extent necessary for each purpose:

• To create and maintain your account and to authenticate your sessions.
• To operate the marketplace, match Customers with Shops, and deliver quote requests, quote responses, bookings, and appointment confirmations.
• To share a Customer's phone number with the selected service provider only after the Customer accepts a quote or books an appointment, so the provider can coordinate the authorized service.
• To provide informational features, including maintenance reminders, mileage prompts, tracking of factory and optional vehicle warranty coverage, and recall notifications relayed from the U.S. National Highway Traffic Safety Administration (NHTSA).
• To administer subscribed Shops' CarFix plans and to handle entitlement, accounting, provider reconciliation, invoices, refunds, disputes, transaction support, and tax records related to subscription billing.
• Where a Shop chooses to accept online payment, to help it open and keep its own Stripe account through Stripe hosted onboarding, and, once the Shop has enabled online payment, to let a Customer pay the Shop's invoice through Stripe, show whether the invoice is paid, prevent duplicate charges, reconcile refunds and disputes, and provide payment support.
• To send service related communications (booking confirmations, reminders, policy updates, security alerts). These are transactional and are not marketing. Shops may use CarFix to generate, store, and send their invoices and receipts. The Shop issues these documents and receives the Customer's payment, either directly or, where the Shop has enabled online payment, into its own Stripe account.
• To support Shop operations, including walk in service coordination, customer property records, inspections and approvals, team scheduling, attendance, and wage based cost estimates.
• To send marketing communications, only where you have given separate express consent.
• To provide customer support and to investigate issues reported by you or by another user.
• To detect, investigate, and prevent fraud, abuse, spam, credential compromise, security incidents, and breaches of our Terms of Service.
• To comply with legal obligations, respond to lawful requests from regulators, law enforcement authorities, or courts, and to establish, exercise, or defend legal claims.
• To improve the Platform, using aggregated or deidentified information that does not identify you individually, such as counts of searches that found no Shop.

We do not sell your personal information, and we do not rent or trade it. We do not use your personal information to target third party advertising to you on other platforms.

6. What CarFix does not do

To avoid any ambiguity about how your data flows, the following activities are outside the scope of the Platform:

• CarFix does not hold or route funds between a Customer and a Shop for repair, maintenance, diagnostic, or any other motor vehicle service. Where a Shop has enabled online payment, the Customer's payment of the Shop's invoice is processed by Stripe directly into the Shop's own Stripe account (Section 3.7A), otherwise, service payment happens directly between the Customer and the Shop.
• CarFix does not store full payment card numbers or CVV values. A historical standard Stripe subscription invoice may retain the Shop billing address in an immutable buyer and seller snapshot for the purposes described in Section 3.7.
• CarFix does not collect customer deposits and does not operate a payout system to Shops, Stripe pays out a Shop's online payments to the Shop. Refunds of an online payment are issued by the Shop through Stripe, except that CarFix may instruct Stripe to refund, from the Shop's Stripe account, an online payment for an invoice that was already paid, through the Platform or directly to the Shop as the Shop recorded, or a payment completed after the Shop voided the invoice, as described in our Terms.
• CarFix does not sell, rent, or trade your personal information to advertisers or data brokers.
• CarFix does not share your personal information with third party generative artificial intelligence providers for the purpose of training their models.
• CarFix does not collect precise device GPS coordinates without your permission.
• CarFix does not knowingly collect personal information from minors without appropriate parent or guardian involvement (see Section 18).

7. Service providers and what data they receive

The providers below support existing operations, historical records or capabilities that are currently restricted or disabled. Listing a provider does not mean every described capability is available. Some act on our behalf, while some also determine their own purposes under their privacy notices. For processing on our behalf, our compliance standard requires appropriate written protections. Provider approval and feature availability are assessed separately.

• Supabase (Supabase Pte. Ltd.). Primary database and file storage, Canadian region. Receives and stores all structured Platform data, including account records, vehicle data, quote and appointment records, private messages, review content, and uploaded files.
• Vercel (Vercel Inc.). Application hosting and global edge network. Processes inbound HTTPS requests, request logs (including IP address and user agent), performance telemetry, and build artifacts. Processes application requests and responses, with caching and logs subject to the service configuration and provider retention settings. CarFix does not use Vercel Analytics or Vercel Speed Insights.
• Stripe (including Stripe Payments Canada, Ltd., Sold through Link, LLC, and their affiliates). Used for the four functions below, the first three are Shop only. (i) Stripe Managed Payments. Link SMP acts as merchant of record for new Shop subscription purchases. Stripe and Link receive the information described in Section 3.7, calculate and handle applicable indirect tax, send receipts and invoices, support subscription management, and provide transaction level support. (ii) Legacy standard Stripe subscription billing. Existing subscriptions and their invoice history may remain available until cancellation or assisted migration. (iii) Stripe Identity. If this separate Shop owner verification capability is used, Stripe processes the document, selfie and related verification information described in Section 3.4 under its own privacy notice. (iv) Stripe Connect online payments. Stripe hosts the onboarding and identity verification of a Shop that chooses to accept online payment. Once the Shop has enabled online payment, Stripe also processes a Customer's payment of that Shop's invoice on the Shop's own Stripe account and pays the proceeds out to the Shop. Stripe receives the information described in Section 3.7A, including the payment details the Customer enters in Stripe's payment form and the onboarding details the Shop owner provides. When you provide personal data in connection with online payments or Stripe onboarding, Stripe receives that personal data and processes it in accordance with Stripe's Privacy Policy. Link SMP is not involved in online payments of Shop invoices. If a Customer chooses a pay over time method, the financing provider, such as Klarna or Affirm, receives the information it needs for the financing, as described in Section 3.7A.
• Resend (Plus Five Five, Inc.). Transactional email delivery. Receives the recipient's email address, subject, body, and attachments, such as Shop issued invoice PDFs, booking confirmation records and calendar invitations, for emails sent through the Platform. Resend’s terms also provide for its own use of account and service usage information, including sender and recipient metadata, for account administration, security, fraud prevention, legal compliance and service performance. See Resend’s Privacy Policy.
• Twilio (Twilio Inc.). Twilio Verify sends and checks the one time codes that confirm your phone number and let you sign in with it. Twilio also sends text messages about your account, bookings and billing. Each of these messages says only that you have an update and asks you to sign in to CarFix to read it, so it carries no name, amount or other detail. Twilio receives your phone number and the text of each message and passes the message to the phone carrier that delivers it. CarFix does not send Twilio your account identifier and never sends marketing text messages. You can stop text messages by replying STOP, and replying START turns them back on. When you reply, Twilio sends us your number and your reply. Twilio’s data processing terms also describe its own use of message content and communications usage data, including for security, abuse prevention and related internal model training, legal compliance, improving its services and business analytics. These terms do not establish which uses occurred for a particular account. See Twilio’s Privacy Notice.
• Upstash (Upstash, Inc.). Provides distinct Redis, QStash, and Workflow services. Upstash Redis is hosted in the AWS Central Canada region and is used for rate limiting, single use security token markers, bounded mobile session recovery metadata, aggregate zero result search analytics, and real time event delivery. Redis receives trusted IP addresses or internal user or Shop identifiers with rate limit counters, SHA256 hashes of phone verification tokens, mobile refresh token identifiers, and mobile refresh attempt identifiers, bounded mobile token expiry timestamps, account role, and successor token identifiers, the encrypted Apple authorization code and tokens while an interrupted Sign in with Apple is completed, a hashed Sign in with Apple challenge, a short lock keyed by the Shop owner’s internal identifier during subscription checkout, normalized user entered search terms with aggregate counts, and short lived real time metadata such as internal user, Shop, appointment, quote request, notification, and message identifiers, status changes, and typing display names. Raw mobile tokens and raw refresh attempt identifiers are not stored in Redis. Real time event history does not include chat message bodies. Upstash QStash and Workflow are hosted in the AWS US East region and are used for delayed notifications and quote lifecycle workflows. The general notification queue receives a job identifier, a version, the notification kind and a publication identifier, and its failure callback repeats the job and publication identifiers. A job identifier can contain internal CarFix record identifiers, such as an invoice or account identifier, but no name or contact detail. The recipient's contact details and rendered email, SMS, or push content stay in our primary database under a claim check design. Appointment reminder jobs contain an internal appointment identifier and scheduling metadata. Quote workflow jobs contain an internal quote request identifier and timing, step, and status metadata. Upstash does not receive passwords, payment card details, or identity documents through these services.
• Sentry (Functional Software, Inc., d.b.a. Sentry). Technical error monitoring used for security and reliability. Receives stack traces, exception messages, request paths, HTTP status codes, and a limited set of request metadata. Events may include an internal account identifier to associate faults with an affected account. Our configuration filters selected sensitive fields and request metadata, but diagnostic text can contain personal information, so it is treated as restricted data. On the website, your browser sends error reports and performance measurements to Sentry only if you allow the Performance choice in the cookie banner, and never from a payment page. Crash and error reporting from the CarFix apps to Sentry is currently disabled. An app version installed before it was disabled may still send crash and error reports to Sentry, without a separate consent step, until it is updated. We use Sentry because it is necessary to detect and fix faults in the Platform. It is not used for analytics or advertising.
• Google (Google LLC). Two integrations: Sign in with Google for optional account creation, and Google Maps Platform (Places Autocomplete and Place Details, Maps JavaScript, Geocoding, Time Zone) for address entry, Shop location mapping and a Shop's time zone. See Section 8 for the full description of what each Google integration accesses, how we use it, and how to disconnect.
• Apple (Apple Inc.). Sign in with Apple for optional account creation and authentication, plus Apple's account and private relay status notifications. Apple provides a stable account identifier, signed authentication credentials, and, when you choose to share them, your name and email address or an Apple private relay address. See Section 8A for how CarFix uses, retains, and disconnects this information.
• Expo (650 Industries, Inc.). Delivers notifications to the CarFix apps and provides their updates. For a notification, Expo receives the device’s push token, the notification text described in Section 3.8 and a link that identifies only the item it opens, and passes them to Apple or Google for delivery. Each time a CarFix app opens, it asks Expo whether an update is available. That request carries a random installation identifier kept on the device, the platform, the app’s version and update channel and, after a crash, the error message of that crash, and Expo also receives the device’s IP address. CarFix does not send Expo your email address, phone number, account identifier or payment details. The CarFix apps do not include Expo Observe.
• Push delivery services (Apple, Google, Mozilla and Microsoft). Apple Push Notification service and Google Firebase Cloud Messaging receive the device token and the notification text from Expo and show the notification on your device. For a browser notification, the push service your browser uses, operated by Google, Mozilla, Apple or Microsoft, receives the notification encrypted so that only your browser can read it. Each service processes this information under its own terms.
• Cloudflare (Cloudflare, Inc.). Authoritative DNS hosting only since October 7, 2026. Cloudflare resolves the Platform’s domain names. It does not proxy the Platform’s application requests or receive their content through our DNS configuration.
• NHTSA (U.S. National Highway Traffic Safety Administration). Decodes a VIN into the vehicle’s make, model and specifications, and reports safety recalls. CarFix’s server sends the VIN and never an account identifier. When a recall check by VIN fails or finds no recall, it is repeated with the vehicle’s make, model and model year. A nightly job rechecks recalls for active vehicles that have a VIN. A Shop can also decode the VIN of a customer’s vehicle, including a walk in customer’s. If you add a photo of a VIN, CarFix reads it on its own server and may check similar VINs to correct a misread character. Decoded details and recalls are saved with the vehicle. A recall found by make, model and model year does not confirm that a particular VIN is affected.

Team shift reminder jobs sent to QStash contain only an internal shift identifier, its schedule version, and the scheduling trigger. They do not contain a team member's name, email address, or private shift note.

We may also disclose personal information to professional advisers (such as lawyers and auditors), and to regulators, law enforcement authorities, or courts, where required by law, pursuant to valid legal process, or to establish, exercise, or defend legal claims.

Stripe’s and Link’s own purposes and notices to a separate billing contact are described in Section 3.7.

As part of its service, Resend may review a small sample of email content for trust and safety on infrastructure it operates, and it states that neither it nor its subprocessors use email content to train models. Resend and its subprocessors store email data in the United States. Resend states that it keeps email content and delivery logs for thirty (30) days and backups for seven (7) days. Copies that Resend must keep for an incident or a legal reason can be kept longer.

8. Google API Services and the Limited Use requirements

CarFix integrates with several services operated by Google LLC (“Google”) to provide core Platform functionality. This Section describes what information from those services we access, how we use it, how we store and protect it, and how you can disconnect or request deletion. CarFix's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can review the Google API Services User Data Policy on Google’s developer site.

8.1 Sign in with Google (optional account creation)

Both Customers and Shops may choose to create or sign in to a CarFix account using “Sign in with Google” instead of an email and password registration. When you sign in with Google we receive your name, your Google account email address, and a link to your Google profile picture. We do not save that link or show the picture. A new account starts with your initials, and your name is only a suggestion you confirm. We do not request any additional Google scopes during this flow beyond the standard OpenID Connect basics (openid, email, profile).

We use this information solely to create or authenticate your CarFix account and to fill in your basic profile. We do not store Google’s access or refresh tokens. We keep only the identifier Google gives your account, so that we can recognize you when you sign in again. CarFix maintains its own web and mobile sessions. You can revoke CarFix's access at any time by signing in to your Google Account at myaccount.google.com/permissions and removing CarFix from the list of connected apps, or by deleting your CarFix account from your account settings.

8.2 Google Maps Platform (Maps, Places, Geocoding, Time Zone)

CarFix uses Google's Maps Platform APIs to support address entry during quote requests and Shop onboarding (Places Autocomplete), to display the location of Shops on a map (Maps JavaScript API), and to resolve postal addresses to and from geographic coordinates (Geocoding API), and to determine a Shop's time zone from its coordinates (Time Zone API). These integrations are used by both Customers and Shops and do not require Google sign in.

When you type an address into a CarFix input field, the text fragments you type are sent to Google's Places Autocomplete API through our server side proxy so that Google can return matching suggestions. Autocomplete requests may also include a temporary session identifier, language and country settings, and supplied proximity coordinates to rank nearby suggestions. We do not include your CarFix account identifier or unrelated form fields. When a Shop location is displayed on a map, the latitude and longitude of the Shop are sent to Google to render the map tiles. Geocoding requests send a postal address to Google to retrieve matching coordinates, or coordinates to Google to retrieve the corresponding address. When you choose to use your current location to fill in an address, your device’s coordinates are read only after your browser asks your permission, and they are rounded to about one kilometre before they are sent, so Google returns only your area, not a street address. Google receives these requests as an independent business under its own terms and privacy policy.

We do not retain Google Maps Platform responses beyond what is needed to fulfill your immediate request. Coordinates we receive for a Shop location are stored on the Shop record so that we do not have to call Google again to display the same map, coordinates derived from Customer entered addresses are kept with the related quote request or saved account location. Saved locations remain until you delete them, quote location retention follows Section 12.

8.3 Limited Use commitment

Our use of information accessed through Google APIs is subject to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google API data only to provide and improve the user facing features described in this Section (account sign in, address entry, mapping, and time zone lookup).
• We do not sell, rent, or licence Google API data to any third party for advertising, marketing, lead generation, or analytics.
• We do not use Google API data for advertising or to retarget you on or off the Platform.
• We do not use Google API data to train, fine tune, or otherwise contribute to any artificial intelligence or machine learning model, whether operated by us or by a third party.
• We do not allow human read access to Google API data except (i) where you provide affirmative agreement for a specific session, (ii) where necessary for security purposes (such as investigating an integrity issue or a suspected breach), (iii) where required to comply with applicable law or valid legal process, or (iv) for internal operations on deidentified data that cannot reasonably be linked back to you.

8.4 Disconnecting and requesting deletion

• Sign in with Google: sign in to your Google Account at myaccount.google.com/permissions and remove CarFix from the list of connected apps, or delete your CarFix account from your account settings.
• All Google sourced data: contact our Privacy Officer using the details in Section 19, identifying the integration the request concerns.

8A. Sign in with Apple

Customers may choose Sign in with Apple on the CarFix website or in the CarFix iOS app instead of email and password registration. Apple provides CarFix with a stable Apple account identifier, a signed identity token and authorization code, and, when you choose to share them, your name and email address. If you use Hide My Email, the address is an Apple private relay address rather than your underlying Apple Account address. Apple normally supplies a person's name only on the first authorization.

CarFix verifies the signed identity token and exchanges the authorization code on our server. We retain the resulting Apple identity, refresh, and access tokens with the linked CarFix account so we can authenticate the account, maintain the provider link, and ask Apple to revoke the authorization when the CarFix account is deleted. These credentials are not used for advertising, marketing, contact discovery, or access to unrelated Apple services.

Apple may send CarFix signed server notifications when an authorization is revoked, an Apple account is deleted, or Hide My Email forwarding is enabled or disabled. We verify the notification before acting. A revocation or account deletion event removes the matching Apple provider link, ends active CarFix sessions, and removes mobile push subscriptions. A relay disabled event places the normalized relay address on our email suppression list so we do not continue sending to an unavailable destination. A later relay enabled event removes only that Apple owned suppression. Provider event identifiers are used to reject duplicate deliveries. A separate hashed relay state record prevents delayed older events from replacing newer forwarding state.

You can disconnect CarFix in the Sign in with Apple area of your Apple Account settings. You can also delete your CarFix account from CarFix account settings. When we receive Apple's verified revocation notice, or when CarFix account deletion is requested, we attempt to revoke and clear the linked Apple authorization credentials. If automated revocation cannot be confirmed, CarFix directs you to remove CarFix in your Apple Account settings. Apple's own handling of your Apple Account data is governed by Apple's privacy policy.

9. When CarFix staff can access your data

Access to personal information by INU Technologies personnel is limited to what is reasonably necessary for an authorized business purpose. Access is role based, with the audit coverage described below. Staff may access the categories of information in Section 3, including private service coordination content (quote descriptions, photos, and in app messages) and vehicle information, only in the following situations:

• When responding to a support ticket or enquiry you have submitted, and only to the extent necessary to answer it.
• When resolving an online payment for an invoice that was already paid, through the Platform or directly to the Shop as the Shop recorded, or an online payment completed after the Shop voided the invoice, including when the refund of that payment fails or has not completed, as described in Section 3.7A and our Terms of Service, and only to the extent necessary to resolve it.
• When investigating a report of abuse, harassment, fraud, safety risk, or a breach of our Terms of Service, and only to the extent necessary for that investigation.
• When reviewing a Shop application or an audit flag related to Shop verification.
• When operating, debugging, or repairing the Platform, in which case personal identifiers are minimized or pseudonymized where possible.
• When responding to a lawful request from a regulator, law enforcement authority, or court, after a reasonableness check.
• When establishing, exercising, or defending a legal claim that involves your use of the Platform.

Staff access to these categories is subject to access controls. We log privileged actions and designated private data views, including administrator quote detail reads and controlled IP address reveals. These logs do not represent a recording of every screen or database read. We do not allow staff to browse private messages, vehicle information, or quote content for curiosity, marketing, or any purpose outside the situations listed above.

10. Storage location and cross border processing

Our primary application database and Customer file storage are hosted in Canada. Some service providers listed in Section 7 are based outside Canada or operate global infrastructure, and may process limited personal information outside Canada in the course of providing their service. In particular:

• Vercel’s edge network may process requests outside Canada. Cloudflare provides DNS hosting only and does not proxy application requests. A Canadian application server region does not confine all network, log, or support processing to Canada.
• Stripe, Sold through Link, LLC, and their affiliates may process subscription billing data, online service payment data, and Shop Stripe onboarding, identity verification, and bank account data in the United States and in other jurisdictions where their infrastructure operates. A financing provider a Customer chooses at checkout, such as Klarna or Affirm, may process that Customer's financing information in the United States or elsewhere under its own privacy notice.
• Resend (Plus Five Five, Inc.), our transactional email provider, processes outgoing email in the United States, using its delivery infrastructure and applicable subprocessors. The personal information involved is limited to the recipient's email address, message contents, and attachments, which may include your name, quote, booking, or vehicle details and Shop issued invoice PDFs. Resend provides email delivery under its data processing terms. Its separate account and service usage purposes are described in Section 7. INU remains accountable for processing on its behalf.
• Upstash Redis is hosted in AWS Central Canada. The separate Upstash QStash and Workflow project is hosted in AWS US East and processes the limited opaque identifiers and scheduling or workflow metadata described in Section 7.
• Twilio, Sentry, Google, Apple, Expo, Mozilla and Microsoft may process information in the United States or other jurisdictions.
• NHTSA VIN decoding and recall requests go to servers operated by the United States government.

Personal information processed outside Quebec or Canada may be subject to foreign laws permitting access by courts, law enforcement authorities and national security agencies. Our compliance standard requires a prior privacy impact assessment of sensitivity, purpose, safeguards and the destination’s legal framework, adequate protection and the required written agreement before a covered communication or mandate outside Quebec. This standard applies across the Platform, including services stored in Montreal that allow access from outside Quebec. A Canadian storage region does not establish that all access or copies remain in Quebec. Provider and flow reviews must establish the applicable protections. INU remains accountable for processing on its behalf and reviews comparable protection under PIPEDA. You may request information about provider countries, purposes, safeguards and retention from the Privacy Officer in Section 19. These disclosures also address Alberta PIPA sections 6 and 13.1 where they apply. Stripe’s and Link’s own purposes are described in Section 3.7.

11. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against loss, theft, and unauthorized access, disclosure, copying, use, or modification. These include: encryption in transit (TLS), encryption at rest for our primary database, salted hash password storage, role based access controls, controlled access to infrastructure and production data, security logging and monitoring, rate limiting, application layer input validation, and periodic review of access rights, dependencies, and security configurations. No method of electronic storage or transmission is perfectly secure, and while we use commercially reasonable means, we cannot guarantee absolute security.

12. Retention

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, for legal or regulatory obligations, or for the establishment, exercise, or defence of legal claims. Our retention schedule below describes the ordinary retention limits. Deletion is performed through scheduled cleanup and Privacy Officer review, not every category has an automatic age based deletion job. Expiry of a quote or an account session does not itself erase the underlying record.

• Account records. While your account is open. For an eligible account, ordinary deletion is scheduled thirty (30) days after your request and processed by daily cleanup, unless you reactivate the account, or erasure is delayed by an unresolved dispute, a review appeal that is still open, a hold placed on one of your records for a dispute, a legal matter, a security incident or an access request, a data export being prepared or an app store subscription cancellation not yet confirmed. Some records, such as billing evidence, consent or delivery suppression records, and records needed for a lawful hold, may remain for their separate purposes. Shop ownership or records that require assisted resolution may prevent self service deletion. Some surviving business records or free text can still identify you even after an account link is removed, contact the Privacy Officer for a record specific search and any applicable exception.
• Sign in with Apple credentials and relay state. Apple identity, refresh, and access tokens are retained while the Apple provider link is active. CarFix attempts to revoke and clear them when the link is revoked, Apple reports account deletion, or CarFix account deletion is requested. If automated revocation cannot be confirmed, the deletion flow directs you to Apple Account settings, any remaining provider credentials are removed with final account erasure. An Apple owned relay suppression remains only while forwarding is disabled. A Resend permanent bounce or complaint suppression may remain independently under the email delivery rules. Apple event receipts and the current hashed relay state receipt are removed after approximately thirteen (13) months, and relay state linked to an erased account is removed during erasure.
• Unverified accounts. An account created with an email address and password whose address is never verified is kept until you delete it or we remove it under this rule. We may remove it once it is at least thirty (30) days old if it has no verified phone, linked Google or Apple identity, vehicle, quote, appointment, Shop, team membership, data export or pending deletion, and no sign in within the previous ninety one (91) days. This cleanup is paused while older accounts are reviewed, so no unverified account is removed automatically today. A second registration with an email address that already belongs to an account is refused.
• Vehicle and garage data (including VIN). While the vehicle is in your garage. You can archive a vehicle to keep its history, and an archived vehicle is kept until you delete it or your account. When you delete a vehicle, it is removed at once with its mileage, service and recall records. Records a Shop keeps about work on the vehicle, such as its invoices and the odometer readings it recorded at a visit, follow their own retention. On account deletion, vehicle data is handled on the same schedule as account records.
• Quote requests and appointments. Twenty four (24) months after the matter is finally closed, for service continuity, as a record of the work for any warranty matter between you and the Shop, and for dispute resolution. A quote request closes when it is cancelled or expires, or when the appointment that resulted from it closes. An appointment closes when it is completed, cancelled, marked as a no show or expires, and any related dispute, support ticket, stored property, invoice or payment follow up has ended. Reopening the same matter restarts only its own period.
• In app messages and chat transcripts. Twenty four (24) months after each message was sent. For a message about an appointment, the period starts when that appointment's matter closes, if that is later.
• Photos and other service attachments. Follow the related record's lifecycle. Erasure requests removal of associated files, and a separate sweep removes unreferenced files after its safety window. There is no additional twelve month photo archive.
• Reviews. While the reviewing account exists and the Shop remains on the Platform. A removed review is hidden from the Platform and kept, with its moderation record and a copy in the related support conversation, while the reviewing account exists. You can appeal a removal within thirty (30) days.
• Shop invoice and receipt records. These are retained separately for the Shop's accounting, tax, dispute, and legal needs. Deleting a Customer account removes its account link but does not erase the identifying snapshots in issued documents. A draft invoice that a Shop has not issued and has not edited for ninety (90) days is removed, unless it belongs to work still in progress, a payment, stored property, a dispute or a hold. Issued invoices, with their corrections, payments and refunds, are kept for at least six (6) years after the end of the last tax year to which they relate, and longer where the law or a hold requires. Contact the Privacy Officer for a record specific review. Online payment records linked to an invoice (payment status, amounts, payment method summary, refund and dispute status, and Stripe identifiers) follow the retention of the invoice record they belong to, and records of an open payment dispute are kept until the dispute and any related claim are resolved. The Shop's Stripe account and Stripe's own transaction records are retained by Stripe under its legal obligations.
• Customer property records. A record of property a Shop holds for you is kept while the Shop holds it and for twenty four (24) months after you pick it up. Storage fees follow the retention of the related invoice.
• Subscription billing records (Shops). CarFix's schedule is seven (7) years after the end of the relevant fiscal year for current Stripe Managed Payments records and legacy standard Stripe invoice history, subject to longer legal requirements. This is CarFix's retention period, the Canada Revenue Agency's general minimum is six (6) years from the end of the last tax year to which the records relate. Stripe and Link apply their own legally required retention periods.
• Security, audit, and abuse prevention logs. Ordinarily twelve (12) months, subject to preservation arranged separately for a documented investigation or legal hold. Daily cleanup removes expired or revoked account session history once its last activity is more than twelve months old, and removes expired verification tokens. Active sessions are retained while needed for sign in. Provider log retention depends on the relevant service settings.
• Auxiliary Upstash Redis records. Rate limit records use library managed expiry tied to the configured window, currently ranging from seconds to twenty four (24) hours. Hashed phone token markers expire after eleven (11) minutes, mobile refresh token reuse and bounded recovery records after ninety one (91) days, and real time event history after three (3) days with a cap of 500 events per channel. Encrypted Apple sign in records are deleted once that sign in is settled, and a hashed proof of it is kept for twenty four (24) hours. The Sign in with Apple challenge marker expires after fifteen (15) minutes and the subscription checkout lock after five (5) minutes. Aggregate zero result search terms and counts are not linked to an account, but the current application code does not set an automatic expiry for them, so they remain until administratively deleted.
• Queued notification claim check payloads. Recipient contact details and rendered notification content awaiting QStash delivery remain in our primary database until delivery or terminal failure. A daily lifecycle process removes any orphaned payload older than twenty four (24) hours.
• Team member attendance records. These expire in two parts. The location verification evidence (how far the member's device was from the Shop, the reported accuracy of that reading, and which Shop location the check in was compared against) is erased three (3) years after the shift, and the session itself is kept. A session still waiting on a manager's review decision, or with a correction request still open, is an exception: its evidence is held until that review or request is resolved, so a record under dispute is not erased while the dispute is open. The timekeeping record (the start and end times, any linked shift, whether each reading was verified or flagged, a manager's review decision and note, and any correction the member requested with its reason) is retained while both the team member's CarFix account and the Shop exist, so that the Shop can meet its own employment record keeping obligations, and is deleted when the team member's account is erased or the Shop is deleted. Deactivating a team member ends their access but does not delete their past attendance records, because those records belong to the Shop's employment history.
• Marketing consent records. For the period you are opted in, and for three (3) years after withdrawal of consent, to demonstrate compliance with CASL.
• Privacy incident and breach register. PIPEDA breach records are retained for at least twenty four (24) months after we determine that the breach occurred. Where Quebec law applies, incident register information is retained for at least five (5) years after we become aware of the incident. We apply the longer applicable period.

Support correspondence, Shop operational records, wage history, and optional coverage records are reviewed for continuing service, employment, warranty, dispute, and legal needs. Their retention can depend on the record and the applicable jurisdiction. Contact the Privacy Officer for the retention basis for a specific record or an earlier deletion request. Backups are separate recovery copies governed by the provider's retention and rotation settings, deleting a live record does not immediately remove it from an existing backup. Restored data must be checked against prior deletion requests before normal use resumes.

After the applicable retention period, we delete personal information or irreversibly anonymize it. In some cases, such as legal holds or active investigations, a longer retention period may apply.

Push registration retention. Registrations are retained while needed for authorized delivery and removed through the lifecycle described in Section 3.8. No new inactivity expiry is established by a registration’s creation date. The self service export includes only your registration identifiers, platform and app scope, without delivery endpoints, tokens, keys or session handles.

Delivery and replay evidence. Delivery facts and minimum replay receipts support reconciliation, prevention of duplicate sends and the ordering of consent, billing and provider events. Queued, retryable, leased or uncertain outcomes are retained while their reconciliation purpose remains. A stale lease does not establish that no send occurred. The ordinary security log period does not automatically dispose of every delivery or replay record. A receipt finishing after account erasure can retain delivery facts with its recipient link removed. Removed links and hashes are not proof of anonymity. Ordinarily, failure text is removed thirty (30) days after a delivery reaches its final outcome, failure codes after ninety (90) days, and the link to your account after twelve (12) months. The identifiers needed to recognize late provider events and to prevent duplicate sends are kept.

Surviving records. Account erasure removes your appointments. If a Shop still holds your property, it keeps your name and one way to contact you, so that it can return the property, until the property is picked up or the Shop records a new owner for it. Invoice snapshots, walk in rosters, storage notes and inventory references may still identify you. Contact the Privacy Officer for a record specific search and assessment of outstanding access, preservation or deletion obligations.

Preservation and cleanup. Scheduled cleanup can be paused for a documented preservation requirement. Each hold has a defined scope and review responsibility. A hold on audit deletion does not establish preservation of other records, backups or provider copies. Live record deletion, unlinking and prospective diagnostic filtering do not establish deletion of historical copies. Any restoration must respect prior erasure requests before normal use resumes.

Email suppression records. We keep a normalized address, suppression reason and source while the suppression applies. A separate address hash and latest provider event preserve event order for 35 days from that event. The hash remains personal information. Expiry of ordering evidence does not itself remove a suppression, audit evidence, delivery record or provider copy. Apple relay and other event records have separate retention purposes and replay periods.

13. Marketing communications and CASL

CASL requires consent before most commercial electronic messages may be sent to a Canadian recipient. We treat marketing email, marketing SMS, and marketing push notifications as subject to CASL. We request your consent separately from acceptance of the Terms of Service, through an unchecked opt in box or equivalent affirmative action. We keep a record of the date, method, and scope of your consent. CarFix does not currently send marketing email or marketing text messages. The only message we currently send under this consent is an app notification inviting you to review a completed service.

You may withdraw marketing consent at any time by: using the unsubscribe link in an email, replying STOP to an SMS, turning off push notifications in your device or account settings, or emailing privacy@carfix.to. Withdrawal takes effect without delay and no later than ten (10) business days. A service message may qualify for a CASL consent exception only where its content meets the applicable statutory conditions, for example when it solely facilitates an agreed transaction or provides qualifying warranty or safety information. Calling a message transactional does not exempt promotional content. Identification and unsubscribe requirements continue to apply wherever required by law.

Marketing suppression for unverified accounts. As an additional safeguard, we do not send marketing communications to an email address whose ownership has not been verified, even where a consent flag was captured. Email ownership may be verified through an activation link or a supported sign in provider. Once verified, marketing communications may be sent in accordance with your separate consent and delivery settings. This safeguard exists so that a commercial message cannot reach an inbox whose owner has not affirmatively confirmed receipt.

14. Your rights

Under applicable privacy legislation, including PIPEDA and provincial privacy laws where they apply, you have the rights set out below. Each right is subject to the conditions, exceptions, and limits imposed by the applicable legislation.

• Access. You may ask us for a copy of the personal information we hold about you, together with a description of how it is used and to whom it has been disclosed, subject to limits under PIPEDA section 9 (for example, information subject to legal privilege or that would reveal personal information about another individual).
• Correction. You may ask us to correct information that is inaccurate, incomplete, or out of date.
• Withdrawal of consent. You may withdraw consent to the collection, use, or disclosure of personal information, subject to reasonable notice and to legal or contractual restrictions. Withdrawing consent may prevent us from providing some or all of the Platform to you.
• Deletion. You may ask us to delete personal information, subject to the retention periods in Section 12, legal obligations that require us to keep it, and interests that legitimately outweigh the request (such as active dispute resolution or a legal hold).
• Portability (Quebec Law 25). Where technically feasible and legally required, you may ask us to provide, in a structured and commonly used technological format, the computerized personal information you have given us.
• De indexing and cessation of dissemination (Quebec Law 25, section 28.1). Where the conditions set out in that section are met, you may ask us to stop disseminating your personal information or to de index a hyperlink that is causing serious injury to your reputation or privacy.
• Automated decision making (Quebec Law 25, section 12.1). Where we make a decision based exclusively on automated processing of your personal information and section 12.1 applies, we will tell you no later than when we inform you of the decision. On request, we will explain the information used, the reasons and principal factors or parameters, and your right to correct the information. You may submit observations to a staff member able to review the decision. Contact the Privacy Officer to request that review.
• Objection to marketing. You may object to the use of your personal information for marketing at any time, using the channels described in Section 13.

To exercise any of these rights, contact our Privacy Officer using the details in Section 19. We will acknowledge your request promptly and will respond within thirty (30) days, or within a shorter period where required by law. We may ask only for information reasonably necessary to confirm your identity. We assist with preparing access requests. Any extension must be permitted by applicable law, we will explain its basis, revised deadline, and your complaint rights within the required period. Access is generally free or at minimal cost. We will explain any legally permitted charge in advance and obtain your confirmation before proceeding. A refusal or redaction must have an applicable legal basis, which we will explain in writing along with available recourse. We preserve information subject to an access request for as long as required to allow that recourse.

The data export tool in account settings provides a copy of the data in your account, including your profile and preferences, linked sign in identities, vehicles and their history, quotes, appointments, booking confirmations, invoices and stored property, legal acceptances and notices, support requests, your account activity history, saved locations, favourites, reviews and messages you wrote, session history, your push registration identifiers, and your own team membership, wage and attendance records where present. A Shop owner’s export also includes the Shop’s records. You can request one export every seven (7) days after verifying your email address. The download works for seven (7) days and stops working if your account is deactivated or scheduled for deletion, or if your role, your Shops or your linked walk in records change. The archive lists its included categories and says when attachments were left out because of their size. It is a self service starting point for access, not a substitute for a full request to the Privacy Officer. Information in other records, including correspondence written by others or internal notes about you, may require a separate search and third party redaction.

15. Use of automated tools

CarFix does not integrate third party generative artificial intelligence to generate your repair estimates or other user facing Platform content. Where it is available, Price Intelligence displays aggregated parts and labour prices recorded for completed Platform appointments and Shop entered walk in jobs, matched to selected services, vehicle makes and models, and regions. It displays comparisons only when sufficient matching records are available and does not supply a static price fallback. These are recorded service prices, not independently verified amounts paid. The feature does not send your input to a third party generative artificial intelligence service. Its outputs are informational only, are not a quote, do not bind any Shop, and are not used to make significant effect automated decisions about you.

We do not sell, licence, or otherwise make your personal information available to third party providers of generative AI for the purpose of training their models. We may use aggregated or deidentified information derived from Platform activity (which does not identify you individually) to improve the Platform's own features, such as search relevance, fraud detection, and service quality measurement.

16. Breach notification

Where a breach of security safeguards creates a real risk of significant harm to an individual, we will notify the Office of the Privacy Commissioner of Canada and the affected individuals as soon as feasible, as required by PIPEDA and the Breach of Security Safeguards Regulations. Where Quebec law applies and an incident presents a risk of serious injury, we will diligently notify the Commission d'accès à l'information du Québec (“CAI”) and affected individuals, subject to applicable statutory exceptions. Where a provincial privacy statute imposes additional or different notification obligations (for example, in Alberta under the Personal Information Protection Act), we will comply with those obligations as well. We maintain an internal register of confidentiality incidents and breaches of security safeguards for the applicable periods in Section 12, including Quebec’s minimum five year period where that law applies. The register covers incidents even when notification is not required and is available to the relevant regulator as required.

17. Complaints process

If you have a concern about how your personal information has been handled, please raise it with our Privacy Officer first so that we have an opportunity to investigate and respond. The process is as follows:

• How to submit. Email privacy@carfix.to or write to the address in Section 19. Please describe the concern as specifically as you can, including the account email or other identifier we can use to find the relevant records, the dates or time period in question, and what outcome you would like.
• Acknowledgement. We will acknowledge receipt within five (5) business days.
• Investigation and response. We will investigate the concern and provide a written response within thirty (30) days of the initial complaint, or within a shorter period where required by law. If the matter is complex and we need longer, we will tell you the reason and give you a revised timeline.
• Outcome. Our written response will state the outcome, the reasons for our decision, any remedial action we are taking, and your right to escalate to a regulator.
• Escalation. If you are not satisfied with our response, you may file a complaint with:
  • the Office of the Privacy Commissioner of Canada (priv.gc.ca),
  • where Quebec privacy law applies, the Commission d'accès à l'information du Québec (cai.gouv.qc.ca),
  • the Office of the Information and Privacy Commissioner in Alberta or British Columbia, where applicable to your circumstances, or
  • the CRTC, Canada’s broadcasting and telecommunications regulator (crtc.gc.ca), for complaints relating to CASL.

18. Children, minors, and parent or guardian involvement

The Platform is not directed to children, and we do not market the Platform to minors. We do not collect date of birth from ordinary customer accounts, because date of birth is not required for the basic use of the Platform.

By creating an account, submitting a quote request, or booking an appointment, you confirm that you are legally able to enter into the governing agreement in your province or territory, or that you are using the Platform with the involvement and consent of a parent or legal guardian who accepts responsibility for that use. Where a person below the age of majority uses the Platform with parent or guardian involvement, the parent or guardian is the responsible party for the account and for the information submitted through it.

We do not knowingly collect personal information from a person we know to be a minor without appropriate parent or guardian involvement. If we learn that we have, we may delete the information, restrict the account, or take other appropriate steps. Shop owner and business accounts may be created only by individuals who are legally able to bind the business they represent.

If you believe we hold information about a minor without appropriate parent or guardian involvement, please contact our Privacy Officer using the details in Section 19 and we will take appropriate steps.

19. Contact and changes to this Policy

If you have a question about this Policy, wish to exercise a right described in Section 14, or wish to file a complaint, please contact:

We may update this Policy from time to time. If we make a material change, we will notify you by email, in app notice, or a prominent notice on the Platform at least thirty (30) days before the change takes effect, unless a shorter period is required to address a legal or security risk. If a change requires new consent, including a new purpose where consent is required, we will obtain it before that processing begins. Notice alone is not consent. The effective date at the top of this Policy indicates when it was last updated. Earlier versions of this Policy are available from the Privacy Officer on request.