Loading...
Loading...
Effective: April 18, 2026
This Privacy Policy describes how INU Technologies Inc., a corporation incorporated under the laws of the Province of Ontario, with its registered office at 33 Alyssum Court, Richmond Hill, Ontario L4E 4M7, Canada (“INU Technologies”, “we”, “us”, or “our”), handles personal information in connection with the operation of the CarFix online marketplace (the “Platform”). INU Technologies is the operator of the Platform and is the business that contracts with Customers and Shops. “CarFix” is the brand under which INU Technologies offers the Platform; the legal entity is INU Technologies Inc.
We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5) (“PIPEDA”); the Act respecting the protection of personal information in the private sector (CQLR c P-39.1), as amended by An Act to modernize legislative provisions as regards the protection of personal information (S.Q. 2021, c. 25) (together, “Quebec Law 25”); Canada's Anti-Spam Legislation (S.C. 2010, c. 23) (“CASL”); and other applicable provincial privacy legislation (including Alberta's Personal Information Protection Act and British Columbia's Personal Information Protection Act).
INU Technologies maintains an internal privacy-governance framework that sets out how personal information is classified, collected, used, disclosed, retained, and destroyed; how subprocessors are reviewed; how privacy-impact assessments are carried out where required (including for transfers outside Quebec under Quebec Law 25); how we respond to access, correction, and complaint requests; and how we handle security incidents. The title and contact details of the person in charge of the protection of personal information are set out in Section 18.
We follow the ten fair-information principles established under Schedule 1 to PIPEDA: accountability, identifying purposes, consent, limiting collection, limiting use and disclosure, accuracy, safeguards, openness, individual access, and challenging compliance. This Policy is written in plain language so that you can understand what we do with your information before you provide it. More technical governance documentation is held internally and is available on request, to the extent permitted by law, from the Privacy Officer.
We collect different categories of information depending on how you use the Platform. Some information you provide to us directly; some is generated automatically by your device or our systems. We treat the categories marked “private” and “sensitive” below with a higher level of access control than public content.
Your name, email address, phone number, a salted password hash (we never store passwords in plain text), your account role (customer, shop owner, team member, or administrator), and your notification preferences. For shop owners, we also collect a Know-Your-Customer (KYC) phone number used for verification.
Your vehicle year, make, model, and trim; odometer readings; and, if you choose to provide it, your Vehicle Identification Number (VIN), licence plate, and powertrain code. Vehicle service history in your garage is populated from (a) entries you make manually, and (b) appointments completed through the Platform that you chose to associate with a vehicle. Vehicle information is visible to a Shop only when you expressly attach a vehicle to a quote request or a booking with that Shop. Vehicle information is not displayed publicly or shared with other users. VIN data, combined with mileage and service history, can be identifying in combination; we therefore restrict internal access to these fields to the circumstances described in Section 8.
The description of the problem you submit in a quote request; photos you attach to a quote or an appointment; messages you exchange with a Shop through the in-app messaging feature; and digital vehicle inspection findings recorded by a Shop for a job you authorized. This content is visible to the Shop you selected and to authorized CarFix staff under the conditions in Section 8. It is not displayed publicly.
For Shops: business legal name, trade name, business address, opening hours, services offered, pricing, amenities, certifications, specialties, public photos, insurance or licensing details uploaded during onboarding, team member records, and public business contact details. A Shop's public profile page is visible to anyone who visits the Platform; uploaded licensing or insurance documents are not public and are used only for verification and compliance.
Ratings and written reviews that you publish about a Shop after a completed service. Reviews are displayed publicly on the Shop's profile, and the name or handle you have chosen on your account is displayed with each review.
The content of support tickets, emails, and chat messages you send to our support team, together with any attachments you upload.
CarFix bills subscribed Shops for the cost of their monthly or annual plan. For this purpose only, our Subscription Payment Processor, Stripe Payments Canada, Ltd. and its affiliates, provides us with a transaction identifier, the card brand, the last four digits of the card, the billing postal code, and the outcome of each charge. We do not receive or store full card numbers, CVV values, or full billing addresses. CarFix does not process, receive, or route any payment between a Customer and a Shop for repair services.
A city or postal code you type into the shop-search form so that we can show you nearby Shops. We do not collect precise device GPS coordinates. If a future feature requires GPS, we will ask for your permission separately through your browser or device before enabling it.
Some information is required for the Platform to work; other information is discretionary. If you choose not to provide the required information, we may not be able to provide the corresponding feature.
We rely on your consent to collect, use, and disclose personal information. Consent may be express (for example, ticking an opt-in box) or implied from the circumstances (for example, submitting a quote request implies that the information in the request may be sent to the Shops you selected). You may withdraw consent at any time, subject to reasonable notice and to legal or contractual restrictions, by contacting our Privacy Officer using the details in Section 18. Withdrawing consent may limit our ability to provide some or all of the Platform's features.
Marketing communications require separate, express opt-in consent. Creating an account, submitting a quote request, or booking an appointment does not, by itself, constitute consent to receive marketing (see Section 12).
We use the information described in Section 3 for the purposes below, and only to the extent necessary for each purpose:
We do not sell your personal information, and we do not rent or trade it. We do not use your personal information to target third-party advertising to you on other platforms.
To avoid any ambiguity about how your data flows, the following activities are outside the scope of the Platform:
We rely on the third-party service providers (subprocessors) listed below to operate the Platform. Each provider is engaged under a written agreement that restricts its use of personal information to the services we engage it to perform and requires appropriate safeguards. The description against each provider is the category of personal information that reaches it in the normal course of operations.
We may also disclose personal information to professional advisers (such as lawyers and auditors), and to regulators, law-enforcement authorities, or courts, where required by law, pursuant to valid legal process, or to establish, exercise, or defend legal claims.
Access to personal information by INU Technologies personnel is limited to what is reasonably necessary for an authorized business purpose. Access is role-based and logged. Staff may access the categories of information in Section 3, including private service-coordination content (quote descriptions, photos, and in-app messages) and vehicle information, only in the following situations:
Staff access to these categories is subject to access controls and is recorded in an internal audit log. We do not allow staff to browse private messages, vehicle information, or quote content for curiosity, marketing, or any purpose outside the situations listed above.
Our primary application database and Customer file storage are hosted in Canada. Some service providers listed in Section 7 are based outside Canada or operate global infrastructure, and may process limited personal information outside Canada in the course of providing their service. In particular:
Where personal information is transferred outside Canada, it may become subject to the laws of the foreign jurisdiction, including laws permitting access by foreign courts, law-enforcement authorities, and national-security agencies. We require our service providers to protect personal information at a comparable standard through contract, and we conduct a privacy-impact assessment before engaging a new provider that will handle personal information outside Quebec, as required under Quebec Law 25 (section 17). You may contact our Privacy Officer for more details about a particular transfer.
We maintain administrative, technical, and physical safeguards designed to protect personal information against loss, theft, and unauthorized access, disclosure, copying, use, or modification. These include: encryption in transit (TLS); encryption at rest for our primary database; salted-hash password storage; role-based access controls; separate environments for development, staging, and production; security logging and monitoring; rate limiting; application-layer input validation; and periodic review of access rights, dependencies, and security configurations. No method of electronic storage or transmission is perfectly secure, and while we use commercially reasonable means, we cannot guarantee absolute security.
We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, for legal or regulatory obligations, or for the establishment, exercise, or defence of legal claims. Our retention periods by category are, at the date of this Policy, approximately:
After the applicable retention period, we delete personal information or irreversibly anonymize it. In some cases, such as legal holds or active investigations, a longer retention period may apply.
CASL requires consent before most commercial electronic messages may be sent to a Canadian recipient. We treat marketing email, marketing SMS, and marketing push notifications as subject to CASL. We request your consent separately from acceptance of the Terms of Service, through an unchecked opt-in box or equivalent affirmative action. We keep a record of the date, method, and scope of your consent.
You may withdraw marketing consent at any time by: using the unsubscribe link in an email; replying STOP to an SMS; turning off push notifications in your device or account settings; or emailing privacy@carfix.to. Withdrawal takes effect within ten (10) business days, which is the maximum period permitted by CASL. Service-related communications (receipts, reminders, security alerts, policy updates, and warranty or recall notifications for vehicles you have added to your garage) are not marketing and are not subject to CASL consent.
Under PIPEDA, Quebec Law 25, and other applicable provincial privacy legislation, you have the rights set out below. Each right is subject to the conditions, exceptions, and limits imposed by the applicable legislation.
To exercise any of these rights, contact our Privacy Officer using the details in Section 18. We will acknowledge your request promptly and will respond within thirty (30) days, or within a shorter period where required by law. We may ask for information necessary to confirm your identity before processing your request. Exercising any of these rights is free of charge unless the request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act, and we will tell you the reason.
The Platform uses artificial intelligence in two user-facing features: a Claude-powered support assistant, and an optional tool that rewrites a Customer's description of a repair issue for clarity before it is sent to a Shop. For these features, only the text you enter into the feature, together with a short system prompt, is sent to Anthropic PBC's Claude API under a commercial agreement that prohibits use of the content for training Anthropic's models and that, where eligible, enrols our API traffic in zero-retention handling. Outputs from these features are informational only and do not replace professional advice; they are not used to make significant-effect automated decisions about you.
We do not sell, licence, or otherwise make your personal information available to third-party providers of generative AI for the purpose of training their models. We may use aggregated or de-identified information derived from Platform activity (which does not identify you individually) to improve the Platform's own features, such as search relevance, fraud detection, and service-quality measurement.
Where a breach of security safeguards creates a real risk of significant harm to an individual, we will notify the Office of the Privacy Commissioner of Canada and the affected individuals as soon as feasible, as required by PIPEDA and the Breach of Security Safeguards Regulations (SOR/2018-64). Where Quebec Law 25 applies to the incident, we will also notify the Commission d'accès à l'information du Québec (“CAI”). Where a provincial privacy statute imposes additional or different notification obligations (for example, in Alberta under the Personal Information Protection Act), we will comply with those obligations as well. We maintain an internal register of confidentiality incidents and breaches of security safeguards for at least twenty-four (24) months, and we will provide a copy of that register to the OPC or CAI on request.
If you have a concern about how your personal information has been handled, please raise it with our Privacy Officer first so that we have an opportunity to investigate and respond. The process is as follows:
The Platform is not directed to, and is not intended for use by, individuals under the age of 18, or the age of majority in the user's province or territory if higher. We do not knowingly collect personal information from a person we know to be a minor. If you believe we hold information about a minor, please contact our Privacy Officer and we will take appropriate steps to remove it.
If you have a question about this Policy, wish to exercise a right described in Section 13, or wish to file a complaint, please contact:
Privacy Officer
INU Technologies Inc. (operating as CarFix)
33 Alyssum Court
Richmond Hill, Ontario L4E 4M7
Canada
Email: privacy@carfix.to
We may update this Policy from time to time. If we make a material change, we will notify you by email, in-app notice, or a prominent notice on the Platform at least thirty (30) days before the change takes effect, unless a shorter period is required to address a legal or security risk. The effective date at the top of this Policy indicates when it was last updated. Earlier versions of this Policy are available from the Privacy Officer on request.