Privacy Policy

1. Who we are

This Privacy Policy describes how INU Technologies Inc., a corporation incorporated under the laws of the Province of Ontario, with its official business address at 350 Bay St Suite 1300b, Toronto, ON M5H 2S6, Canada (“INU Technologies”, “we”, “us”, or “our”), handles personal information in connection with the operation of the CarFix website and Customer, Manager, and Admin mobile apps (together, the “Platform”). INU Technologies is the operator of the Platform and is the business that contracts with Customers and Shops. “CarFix” is the brand under which INU Technologies offers the Platform; the legal entity is INU Technologies Inc.

We handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5) (“PIPEDA”); the Act respecting the protection of personal information in the private sector (CQLR c P-39.1), as amended by An Act to modernize legislative provisions as regards the protection of personal information (S.Q. 2021, c. 25) (together, “Quebec Law 25”); Canada's Anti-Spam Legislation (S.C. 2010, c. 23) (“CASL”); and other applicable provincial privacy legislation (including Alberta's Personal Information Protection Act and British Columbia's Personal Information Protection Act).

2. Our approach to privacy and governance

INU Technologies' privacy-governance procedures set out how personal information is classified, collected, used, disclosed, retained, and destroyed; how subprocessors are reviewed; how privacy-impact assessments are carried out where required (including for transfers outside Quebec under Quebec Law 25); how we respond to access, correction, and complaint requests; and how we handle security incidents. The title and contact details of the person in charge of the protection of personal information are set out in Section 19.

We follow the ten fair-information principles established under Schedule 1 to PIPEDA: accountability, identifying purposes, consent, limiting collection, limiting use and disclosure, accuracy, safeguards, openness, individual access, and challenging compliance. This Policy is written in plain language so that you can understand what we do with your information before you provide it. More technical governance documentation is held internally and is available on request, to the extent permitted by law, from the Privacy Officer.

3. What information we collect

We collect different categories of information depending on how you use the Platform. Some information you provide to us directly; some is generated automatically by your device or our systems; and some is supplied by a Shop about its customers or team members. This includes people who do not have a CarFix account. We treat the categories marked “private” and “sensitive” below with a higher level of access control than public content.

3.1 Account and contact information (identifying)

Your name, email address, phone number, a salted password hash when you register with a password (we never store passwords in plain text), your account role (customer, shop owner, team member, or administrator), and your notification preferences, saved locations, and favourite Shops. For shop owners, we also collect a Know-Your-Customer (KYC) phone number used for verification.

3.2 Vehicle information (sensitive)

Your vehicle year, make, model, and trim; odometer readings; and, if you choose to provide it, your Vehicle Identification Number (VIN), licence plate, and powertrain code. Optional coverage and purchase records can include a coverage provider or dealer, contract or reference number, coverage dates, deductible, purchase date and mileage, and notes you enter. Vehicle service history in your garage is populated from (a) entries you make manually, and (b) appointments completed through the Platform that you chose to associate with a vehicle. Vehicle information is visible to a Shop only when you expressly attach a vehicle to a quote request or a booking with that Shop. Vehicle information is not displayed publicly or shared with other users. VIN data, combined with mileage and service history, can be identifying in combination; we therefore restrict internal access to these fields to the circumstances described in Section 9.

3.3 Private service-coordination content (private)

The description of the problem you submit in a quote request; the list of services you select in a quote request and any flag indicating that you will supply your own parts for a service (a “BYOP” flag); photos and inspection videos associated with a quote or an appointment; text and voice messages you exchange with a Shop through the in-app messaging feature (voice messages are stored as short audio recordings alongside message text, duration, and related metadata); digital vehicle inspection (DVI) findings recorded by a Shop for a job you authorized, your inspection approvals or declines and their timestamps; and any warranty record created by a Shop for parts or labor delivered to your vehicle. This content is visible to the Shop you selected and to authorized CarFix staff under the conditions in Section 9. It is not displayed publicly.

3.4 Shop business information

For Shops: business legal name, trade name, business address, opening hours, services offered, pricing, amenities, certifications, specialties, public photos, insurance or licensing details uploaded during onboarding, team member records, and public business contact details. A Shop's public profile page is visible to anyone who visits the Platform; uploaded licensing or insurance documents are not public and are used only for verification and compliance. KYC phone numbers are used for verification and are not displayed as public business contact numbers. Shops can provide separate public business contact channels for profile visitors.

Shop-managed operational records. Shops on paid plans may use, depending on their subscription tier, additional internal record-keeping features that store business data about jobs done for Customers: inventory and parts(the Shop's own SKU list, stock counts, parts metadata, and per- appointment deductions); warranty tracking (warranty records the Shop creates for parts and labour delivered to a Customer's vehicle, including coverage period and Customer reference); and internal noteswritten by Shop staff about a Customer or appointment. Inventory data and internal notes are shown to authorized Shop staff rather than in the Customer interface. A request to access personal information within a note is assessed under Section 14, including any necessary third-party redaction. Warranty records created for a Customer's vehicle are visible to that Customer through their CarFix account so the Customer can see the coverage attached to their work.

Shop invoices and receipts. Shops may use CarFix to create, store, and send invoices and receipts. These records can include your name and contact details, vehicle information, service date, itemized charges, discounts, taxes, payment terms, and the payment date and method recorded by the Shop. Issued documents preserve a snapshot of these details and the Shop's identity and tax registrations. A recipient without an account may receive a time-limited invoice link; anyone holding that link can access the document while it remains valid.

Walk-in customers and customer property. A Shop may enter a non-account customer's name, phone number, email address, vehicle details, and service notes to arrange work. Shops may also record property left in their care, its condition, storage or related fees, and pickup details. The Shop is responsible for explaining its own collection and obtaining any required consent. You can contact the Shop or our Privacy Officer about personal information held in these records.

Team membership and wage records. Shops may record a member's role, permissions, active or inactive membership, and hourly wage history, including rate, currency, and effective date. These records support scheduling and estimated labour-cost calculations. CarFix does not use this feature to pay wages or make payroll deductions.

Team member attendance records. A Shop on a qualifying plan may use CarFix to record when its team members start and end a work session. This information is about the team member, not about a Customer. Each record holds the start and end times taken from our servers' clock, any scheduled shift it matched, and, for each of the two moments described in Section 3.9, how far the member's device was from the Shop, the reported accuracy of that reading, and whether the result was verified or flagged. For the check-in reading it also records which of the Shop's locations the comparison used. A member's coordinates are never stored. Where a session was flagged, the record also holds the reviewing manager's decision and any note they wrote. These records are visible to the team member, to the Shop owner, and to team members the owner has granted the team-management permission. A team member can export their own attendance records through the data-export tool described in Section 14. CarFix provides these records to the Shop as a record-keeping tool; the Shop decides whether to use attendance features and is responsible for its own obligations to its staff, including any workplace electronic-monitoring policy its jurisdiction requires.

Shop-owner identity verification (Stripe Identity). As part of Shop-owner onboarding, we use Stripe Identity to verify the identity of the individual creating the Shop account. The Shop owner uploads a government-issued identity document (such as a driver's licence or passport) and a real-time selfie directly to Stripe through Stripe's hosted verification flow. The document image and the selfie are sent to Stripe; CarFix does not see, receive, or store the image of the document or the selfie. Stripe returns to us only the verification outcome (verified, requires action, or failed), the document type, and limited non-image metadata necessary to record that we performed verification. Stripe's handling of the underlying biometric and document data is governed by Stripe's own privacy notice. We retain the verification result for as long as the Shop account exists and for the period set out in Section 12.

3.5 Reviews and ratings (public)

Ratings and written reviews that you publish about a Shop after a completed service. Reviews are displayed publicly on the Shop's profile, and the name or handle you have chosen on your account is displayed with each review.

3.6 Support communications

The content of support tickets, emails, and chat messages you send to our support team, together with any attachments you upload.

3.7 Subscription billing information (Shops only)

New Shop subscription purchases use Stripe Managed Payments. CarFix creates or reuses a Stripe customer record and sends the Shop owner's email address, account or Shop name, and an opaque internal Shop identifier. Checkout and subscription metadata can also contain opaque checkout-attempt and Early Partner offer-grant identifiers so that CarFix can bind the correct Shop, prevent cross-tenant billing errors, apply the correct offer, and reconcile provider events. Stripe and Sold through Link, LLC (“Link SMP”) directly collect the payment method, billing address, and any business or tax information entered at Checkout.

Stripe's APIs and verified webhooks provide CarFix with customer, Checkout Session, subscription, subscription-schedule, price, invoice, payment, refund, and tax information. CarFix retains the provider identifiers, billing periods, currency, line items, subtotal, tax, total, payment and refund status, and card brand and last four digits where available. For a new Managed Payments transaction, CarFix does not retain the full payment-card number, CVV value, or Checkout billing address as part of its subscription invoice record. Link SMP may retain transaction and buyer records as required to act as merchant of record and provide transaction support.

Existing subscriptions created through standard Stripe Payments processing may continue until cancellation or an assisted migration. Their historical CarFix invoice records can retain Stripe customer, subscription, invoice, and hosted-invoice identifiers together with an immutable buyer and seller billing snapshot, including the Shop billing name and address, and the payment summary described above. Online payments of Shop invoices, which are separate from subscription billing, are described in Section 3.7A.

3.7A Online service payment information (Customers and Shops)

Where a Shop has enabled online payment, a Customer can pay an invoice issued by that Shop through the Platform. The payment is processed by Stripe on the Shop's own Stripe account, and the Shop is the merchant of record. Card and other payment-method details are entered into Stripe's secure payment form and go directly to Stripe; CarFix does not receive the full card number or security code. To create the payment, CarFix sends Stripe the invoice amount and currency, the Customer's name as shown on the invoice, the Shop's country, which Stripe uses to offer only the payment methods available there, and opaque CarFix identifiers. Stripe's APIs and verified webhooks provide CarFix with the payment's status, amount, and currency, the payment-method type (for example, card, Klarna, or Affirm), the card brand and last four digits where available, any decline or failure code, refund and dispute status and amounts, the dispute evidence deadline, and Stripe payment, charge, refund, and dispute identifiers. CarFix keeps this information with the Shop's invoice record to show the invoice's paid status to the Customer and the Shop, prevent duplicate charges, reconcile refunds and disputes, and provide support. The billing details a Customer enters in the payment form, such as name, email address, address, and postal code, are collected by Stripe on the Shop's Stripe account. Some of Stripe's messages to CarFix about a payment, such as a refund notification, can contain these details. CarFix uses only the information listed above and does not store the billing details. Stripe retains them on the Shop's Stripe account, where the Shop, as merchant of record, can use them, including to respond to disputes.

If a Customer chooses a pay-over-time method, the financing provider, such as Klarna or Affirm, collects the information it needs to assess, approve, and administer the financing directly from the Customer or through Stripe, and processes it under its own privacy notice. CarFix does not receive the Customer's credit information or the reasons for the provider's decision. Besides the payment information listed above, including the payment-method type, which shows that the Customer chose to pay over time, CarFix learns only whether the payment completed and, if it did not, the failure code Stripe reports, which may show that the provider declined the payment. CarFix keeps that code with the Shop's invoice record as described above.

To accept online payments, a Shop owner completes Stripe-hosted onboarding for each Shop location. Identity, beneficial-ownership, business-registration, tax, and bank-account details entered there go directly to Stripe, and Stripe may obtain information from credit agencies to verify the owner's identity. To prefill the Stripe account, CarFix sends Stripe the Shop's business name, country, and currency, the owner's email address, the address of the Shop's public CarFix page, its business category, and its support contact details. CarFix receives and keeps the Stripe account identifier, whether charges and payouts are enabled, outstanding verification requirements, enabled payment-method capabilities, the account's country and currency, whether the account's statement descriptor identifies the Shop, when Stripe rejected, suspended or terminated the account or placed it under review, and when and how the account's connection to CarFix ended (removed from CarFix, or closed). CarFix uses that Stripe status only to keep online payment disabled while it applies, to decide whether the Shop may connect a new Stripe account, and to show the Shop and CarFix support why online payment is unavailable. To determine it, CarFix reads the reason Stripe gives for disabling the account, which can indicate suspected fraud, a breach of Stripe's terms or a possible match against a list of prohibited persons or companies, and does not keep that reason. CarFix reads the statement descriptor, which can include the owner's name, only to determine whether it identifies the Shop, because CarFix may leave online payment disabled, or disable it, while the descriptor does not identify the Shop, as described in our Terms of Service. CarFix does not keep the descriptor. The account information Stripe sends CarFix can also include details of the Shop's payout accounts. For a bank account, these are the holder's name, the bank, the routing number (in Canada, the branch transit and institution numbers) and the last four digits. For a debit card, they are the cardholder's name, billing address, card brand, expiry date and last four digits. The information can also include some of the owner's or business's details. CarFix does not use or store any of them. CarFix does not receive the owner's identity documents, full bank-account numbers or full card numbers through this flow.

3.8 Technical and security information

• Usage data. Pages and screens visited, features used, click and tap events, and session timestamps.
• Device and connection data. IP address, user-agent string, browser type, operating system, device type, and coarse language and time-zone settings.
• Security and abuse-prevention signals. Login attempts, rate-limit triggers, suspicious-pattern flags, and CAPTCHA results.
• Cookies. Session and preference cookies used to keep you signed in and to remember settings. We do not use third-party advertising cookies.
• Performance and product analytics. With your analytics preference enabled, browser-side Vercel Analytics and Speed Insights collect page-view and navigation events, page-load timings, and Core Web Vitals. Separately, our servers record operational events, such as completion or failure of a service action, and aggregate search measurements. Optional browser analytics can be turned off as described below; necessary server security and operational records continue. These measurements are not used for targeted advertising.
• Push notification subscriptions. If you enable browser or device push notifications, we store an Expo push token for a native app, or the push subscription endpoint and associated authentication keys for a browser push service (such as Apple Push Notification service, Google Firebase Cloud Messaging, or Mozilla's autopush). This subscription information is technical infrastructure used only to deliver notifications you have asked to receive. Mobile sign-out removes the account's device-push subscriptions while preserving independent browser subscriptions. If per-device cleanup is interrupted, the installed app keeps that device token in a separate local pending-cleanup marker and retries removal when the app next launches or returns to the foreground. The marker is removed after either CarFix's server registration or native device delivery is successfully removed.

3.9 Location information

We use location information for two purposes: showing you Shops near a place that matters to you, and providing optional location context for Shop team members who use attendance features. Depending on how you use the Platform, that information can come from five sources:

• A place you type. A city or postal code you enter into the shop-search form. It is used to run that search.
• Your device's location, with your permission. If you grant location access through your browser or your device's operating system, we use your device's coordinates to find Shops near you and to sort results by distance. Coordinates used for a shop search are processed transiently to answer that search and are not saved to your account. You can decline or revoke this permission at any time in your browser or device settings, and every location feature has a manual alternative (typing a place).
• A service location you attach to a quote request. When you provide a location for a quote request (a typed address, a saved location from your account, or, with your permission, your device's current location), that address and its coordinates are stored with the request so that the Shops you contact can assess distance and respond. Saved locations you add to your account are stored until you delete them and may be used as your default search area.
• An estimate from your IP address. If you search for Shops without granting location access and without typing a place, we may estimate your approximate city and province from your IP address (part of the connection data described in Section 3.8) so that your first results default to Shops near you rather than a generic list. This estimate is coarse (city-level), is computed only for the search in front of you, and is not stored on your account. You can override it at any time by typing a place or granting device location access.
• A team member's device location when they check in or check out. If you are a team member of a Shop that uses attendance features and you grant location access, the CarFix Manager app requests one location reading using balanced accuracy when you tap check in and one when you tap check out. Depending on your device settings and the operating system response, that reading may include precise coordinates. We use the reading as optional context by comparing it with the Shop's address, computing an approximate distance, and marking the session as verified or flagged for manager review. The coordinates are used for that comparison and are not stored; only the derived distance, reported accuracy, and result are kept. Location is read at those two taps only, never in the background and never while you are working. Location is not required to check in. If permission is declined, device location is off, or no reading is available, the app lets you retry or deliberately check in without location. A no-location check-in is recorded and flagged for manager review. Checking out also remains available without location and closes the session with a review flag. Section 3.4 describes the resulting record.

We do not track your movements, build location histories, or collect location in the background. The CarFix mobile apps request foreground (“while using the app”) location access only, and each reading described above is taken once, in response to something you tapped.

3.10 Cookies, device storage, and your choices

Necessary storage supports sign-in, security, your consent choice, and a language you explicitly select. Optional functional storage remembers display preferences, including language inferred from a public page you visit. Optional analytics controls browser measurement. You can accept, reject, or choose optional categories in the consent banner and reopen those controls using Privacy Preferences in the website footer. Saving a new choice changes future collection; it does not erase records already collected. You can also clear cookies and local storage in your browser.

Native apps keep session credentials in operating-system secure storage. They also keep settings, a cached profile, and, depending on the app and feature, local drafts or cached screen data in app storage on the device. Push, location, camera, microphone, and photo permissions are controlled separately by your device. Grant these only for features you choose to use, and revoke them in device settings.

Contract and communication records

We keep the versions and hashes of legal documents delivered to you, your selected contract language, the French-document delivery receipt, acceptance and amendment-notice dates, and any recorded refusal. Booking confirmations preserve the scope, price, policies, and legal versions accepted at that time. Review moderation records preserve the original review, the reason and notice, the appeal deadline, and the decision so an appeal can be reviewed and a review restored. We also retain a hashed email opt-out record to respect unsubscribe choices for account and guest messages. These records support contract administration, rights requests, disputes, and communication preferences. Account deletion does not erase records that must still be retained under the retention and legal-obligation rules described in this Policy.

4. Required versus optional information

Some information is required for the Platform to work; other information is discretionary. If you choose not to provide the required information, we may not be able to provide the corresponding feature.

• Required to create an account: name, email address, and phone verification, with a password or a supported sign-in provider.
• Required to submit a quote request: vehicle make, model, year, and a description of the issue.
• Required to book an appointment: a confirmed account, the accepted quote, and the time slot you select.
• Required for a Shop to go live: business name, address, services, opening hours, owner contact details, and owner identity verification.
• Optional everywhere: VIN and licence plate, mileage logs, photos attached to a quote, avatar image, social-media links, secondary contacts on your account, and marketing communications.
• Optional per search: city or postal code; you can browse without entering either.

We rely on your consent to collect, use, and disclose personal information. Consent may be express (for example, ticking an opt-in box) or implied from the circumstances (for example, submitting a quote request implies that the information in the request may be sent to the Shops you selected). You may withdraw consent at any time, subject to reasonable notice and to legal or contractual restrictions, by contacting our Privacy Officer using the details in Section 19. Withdrawing consent may limit our ability to provide some or all of the Platform's features.

Marketing communications require separate, express opt-in consent. Creating an account, submitting a quote request, or booking an appointment does not, by itself, constitute consent to receive marketing (see Section 13).

5. How we use your information

We use the information described in Section 3 for the purposes below, and only to the extent necessary for each purpose:

• To create and maintain your account and to authenticate your sessions.
• To operate the marketplace, match Customers with Shops, and deliver quote requests, quote responses, bookings, and appointment confirmations.
• To share a Customer's phone number with the selected service provider only after the Customer accepts a quote or books an appointment, so the provider can coordinate the authorized service.
• To provide informational features, including maintenance reminders, mileage prompts, warranty tracking, and recall notifications relayed from the U.S. National Highway Traffic Safety Administration (NHTSA).
• To administer subscribed Shops' CarFix plans and to handle entitlement, accounting, provider reconciliation, invoices, refunds, disputes, transaction support, and tax records related to subscription billing.
• Where a Shop chooses to accept online payment, to help it open and keep its own Stripe account through Stripe-hosted onboarding; and, once the Shop has enabled online payment, to let a Customer pay the Shop's invoice through Stripe, show whether the invoice is paid, prevent duplicate charges, reconcile refunds and disputes, and provide payment support.
• To send service-related communications (booking confirmations, reminders, policy updates, security alerts). These are transactional and are not marketing. Shops may use CarFix to generate, store, and send their invoices and receipts. The Shop issues these documents and receives the Customer's payment, either directly or, where the Shop has enabled online payment, into its own Stripe account.
• To support Shop operations, including walk-in service coordination, customer-property records, inspections and approvals, team scheduling, attendance, and wage-based cost estimates.
• To send marketing communications, only where you have given separate express consent.
• To provide customer support and to investigate issues reported by you or by another user.
• To detect, investigate, and prevent fraud, abuse, spam, credential compromise, security incidents, and breaches of our Terms of Service.
• To comply with legal obligations, respond to lawful requests from regulators, law-enforcement authorities, or courts, and to establish, exercise, or defend legal claims.
• To measure how features are used and to improve the Platform, using aggregated or de-identified information that does not identify you individually.

We do not sell your personal information, and we do not rent or trade it. We do not use your personal information to target third-party advertising to you on other platforms.

6. What CarFix does not do

To avoid any ambiguity about how your data flows, the following activities are outside the scope of the Platform:

• CarFix does not hold or route funds between a Customer and a Shop for repair, maintenance, diagnostic, or any other motor-vehicle service. Where a Shop has enabled online payment, the Customer's payment of the Shop's invoice is processed by Stripe directly into the Shop's own Stripe account (Section 3.7A); otherwise, service payment happens directly between the Customer and the Shop.
• CarFix does not store full payment card numbers or CVV values. A historical standard Stripe subscription invoice may retain the Shop billing address in an immutable buyer and seller snapshot for the purposes described in Section 3.7.
• CarFix does not collect customer deposits and does not operate a payout system to Shops; Stripe pays out a Shop's online payments to the Shop. Refunds of an online payment are issued by the Shop through Stripe, except that CarFix may instruct Stripe to refund a duplicate payment, or a payment completed after the Shop voided the invoice, from the Shop's Stripe account, as described in our Terms.
• CarFix does not sell, rent, or trade your personal information to advertisers or data brokers.
• CarFix does not share your personal information with third-party generative artificial intelligence providers for the purpose of training their models.
• CarFix does not collect precise device GPS coordinates without your permission.
• CarFix does not knowingly collect personal information from minors without appropriate parent or guardian involvement (see Section 18).

7. Service providers and what data they receive

We rely on the third-party service providers (subprocessors) listed below to operate the Platform under their service and applicable data-processing terms. We require appropriate safeguards for processing on our behalf. Some providers, including payment and identity providers, also process certain information for their own legal, security, or account-administration purposes under their privacy notices. The description against each provider is the category of personal information that reaches it in the normal course of operations.

• Supabase (Supabase Pte. Ltd.). Primary database and file storage, Canadian region. Receives and stores all structured Platform data, including account records, vehicle data, quote and appointment records, private messages, review content, and uploaded files.
• Vercel (Vercel Inc.). Application hosting and global edge network. Processes inbound HTTPS requests, request logs (including IP address and user-agent), performance telemetry, and build artifacts. Processes application requests and responses, with caching and logs subject to the service configuration and provider retention settings. Also provides Vercel Analytics and Vercel Speed Insights, which collect pseudonymous page-view, navigation, and Core Web Vitals metrics used to monitor Platform performance; these analytics signals are not linked to your account identifier and are not used for advertising.
• Stripe (including Stripe Payments Canada, Ltd., Sold through Link, LLC, and their affiliates). Used for the four functions below; the first three are Shop-only. (i) Stripe Managed Payments. Link SMP acts as merchant of record for new Shop subscription purchases. Stripe and Link receive the information described in Section 3.7, calculate and handle applicable indirect tax, send receipts and invoices, support subscription management, and provide transaction-level support. (ii) Legacy standard Stripe subscription billing. Existing subscriptions and their invoice history may remain available until cancellation or assisted migration. (iii) Stripe Identity verification. The Shop owner uploads a government-issued identity document (such as a driver's licence or passport) and a real-time selfie directly through Stripe's hosted flow; CarFix does not see or store the document image or selfie. Stripe returns only the verification outcome, document type, and limited non-image metadata required to record the result. (iv) Stripe Connect online payments. Stripe hosts the onboarding and identity verification of a Shop that chooses to accept online payment. Once the Shop has enabled online payment, Stripe also processes a Customer's payment of that Shop's invoice on the Shop's own Stripe account and pays the proceeds out to the Shop. Stripe receives the information described in Section 3.7A, including the payment details the Customer enters in Stripe's payment form and the onboarding details the Shop owner provides. When you provide personal data in connection with online payments or Stripe onboarding, Stripe receives that personal data and processes it in accordance with Stripe's Privacy Policy. Link SMP is not involved in online payments of Shop invoices. If a Customer chooses a pay-over-time method, the financing provider, such as Klarna or Affirm, receives the information it needs for the financing, as described in Section 3.7A.
• Resend (Plus Five Five, Inc.). Transactional email delivery. Receives the recipient's email address, subject, body, and attachments, including Shop-issued invoice and receipt PDFs, for emails sent through the Platform.
• Twilio (Twilio Inc.). SMS delivery for appointment reminders, status updates, and security codes. Receives the recipient's phone number and the text of each message. Twilio does not receive account identifiers or contact directories.
• Upstash (Upstash, Inc.). Provides distinct Redis, QStash, and Workflow services. Upstash Redis is hosted in the AWS Central Canada region and is used for rate limiting, single-use security-token markers, bounded mobile session-recovery metadata, aggregate zero-result search analytics, and real-time event delivery. Redis receives trusted IP addresses or internal user or Shop identifiers with rate-limit counters; SHA-256 hashes of phone-verification tokens, mobile refresh-token identifiers, and mobile refresh-attempt identifiers; bounded mobile token-expiry timestamps, account role, and successor-token identifiers; normalized user-entered search terms with aggregate counts; and short-lived real-time metadata such as internal user, Shop, appointment, quote-request, notification, and message identifiers, status changes, and typing display names. Raw mobile tokens and raw refresh-attempt identifiers are not stored in Redis. Real-time event history does not include chat message bodies. Upstash QStash and Workflow are hosted in the AWS US East region and are used for delayed notifications and quote-lifecycle workflows. The general notification queue receives only an opaque job identifier, version, and notification kind; the recipient's contact details and rendered email, SMS, or push content stay in our primary database under a claim-check design. Appointment-reminder jobs contain an internal appointment identifier and scheduling metadata. Quote-workflow jobs contain an internal quote-request identifier and timing, step, and status metadata. Upstash does not receive passwords, payment-card details, or identity documents through these services.
• Sentry (Functional Software, Inc., d.b.a. Sentry). Technical error monitoring used for security and reliability. Receives stack traces, exception messages, request paths, HTTP status codes, and a limited set of request metadata. Events may include an internal account identifier to associate faults with an affected account. Our configuration filters selected sensitive fields and request metadata, but diagnostic text can contain personal information, so it is treated as restricted data. We use Sentry because it is necessary to detect and fix faults in the Platform; it is not used for analytics or advertising.
• Google (Google LLC). Two integrations: Sign in with Google for optional account creation, and Google Maps Platform (Places Autocomplete, Maps JavaScript, Geocoding) for address entry and Shop-location mapping. See Section 8 for the full description of what each Google integration accesses, how we use it, and how to disconnect.
• Apple (Apple Inc.). Sign in with Apple for optional account creation and authentication, plus Apple's account and private-relay status notifications. Apple provides a stable account identifier, signed authentication credentials, and, when you choose to share them, your name and email address or an Apple private-relay address. See Section 8A for how CarFix uses, retains, and disconnects this information.
• Expo (650 Industries, Inc.). Native app push delivery and app updates. Receives the Expo push token, notification title and body, and routing data such as an appointment identifier or app link. Notification previews may appear on your lock screen, depending on device settings. Update requests include technical app, platform, runtime, and connection information. Expo uses Apple and Google push services to reach devices.
• Cloudflare (Cloudflare, Inc.). Website delivery and edge security in front of our hosting platform. Processes network and request information, including IP address, requested URL, headers, and traffic needed to deliver and protect the website.
• NHTSA (U.S. National Highway Traffic Safety Administration). VIN decoding and recall-lookup APIs. Receives a VIN when you request decoding or a VIN-based recall check, or vehicle make, model, and year for a vehicle-based recall lookup. We do not send your CarFix account identifier.

Team shift reminder jobs sent to QStash contain only an internal shift identifier, its schedule version, and the scheduling trigger. They do not contain a team member's name, email address, or private shift note.

We may also disclose personal information to professional advisers (such as lawyers and auditors), and to regulators, law-enforcement authorities, or courts, where required by law, pursuant to valid legal process, or to establish, exercise, or defend legal claims.

8. Google API Services and the Limited Use requirements

CarFix integrates with several services operated by Google LLC (“Google”) to provide core Platform functionality. This Section describes what information from those services we access, how we use it, how we store and protect it, and how you can disconnect or request deletion. CarFix's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can review the Google API Services User Data Policy at developers.google.com/terms/api-services-user-data-policy.

8.1 Sign in with Google (optional account creation)

Both Customers and Shops may choose to create or sign in to a CarFix account using “Sign in with Google” instead of an email-and-password registration. When you sign in with Google we receive your name, your Google account email address, and the URL of your Google profile picture (which becomes your initial CarFix avatar). We do not request any additional Google scopes during this flow beyond the standard OpenID Connect basics (openid, email, profile).

We use this information solely to create or authenticate your CarFix account and to populate your basic profile. Provider credentials returned during sign-in may be stored with the linked account in our primary database, which is encrypted at rest. CarFix maintains its own web and mobile sessions; it does not use a Google refresh token to refresh your CarFix session. You can revoke CarFix's access at any time by signing in to your Google Account at myaccount.google.com/permissions and removing CarFix from the list of connected apps, or by deleting your CarFix account from your account settings, in which case your stored tokens are deleted on the schedule set out in Section 12.

8.2 Google Maps Platform (Maps, Places, Geocoding, Time Zone)

CarFix uses Google's Maps Platform APIs to support address entry during quote requests and Shop onboarding (Places Autocomplete), to display the location of Shops on a map (Maps JavaScript API), and to resolve postal addresses to and from geographic coordinates (Geocoding API), and to determine a Shop's time zone from its coordinates (Time Zone API). These integrations are used by both Customers and Shops and do not require Google sign-in.

When you type an address into a CarFix input field, the text fragments you type are sent to Google's Places Autocomplete API through our server-side proxy so that Google can return matching suggestions. Autocomplete requests may also include a temporary session identifier, language and country settings, and supplied proximity coordinates to rank nearby suggestions. We do not include your CarFix account identifier or unrelated form fields. When a Shop location is displayed on a map, the latitude and longitude of the Shop are sent to Google to render the map tiles. Geocoding requests send a postal address to Google to retrieve matching coordinates, or a coordinate to Google to retrieve the corresponding address.

We do not retain Google Maps Platform responses beyond what is needed to fulfill your immediate request. Coordinates we receive for a Shop location are stored on the Shop record so that we do not have to call Google again to display the same map; coordinates derived from Customer-entered addresses are kept with the related quote request or saved account location. Saved locations remain until you delete them; quote-location retention follows Section 12.

8.3 Limited Use commitment

Our use of information accessed through Google APIs is subject to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google API data only to provide and improve the user-facing features described in this Section (account sign-in, address entry, mapping, and time-zone lookup).
• We do not sell, rent, or licence Google API data to any third party for advertising, marketing, lead generation, or analytics.
• We do not use Google API data for advertising or to retarget you on or off the Platform.
• We do not use Google API data to train, fine-tune, or otherwise contribute to any artificial-intelligence or machine-learning model, whether operated by us or by a third party.
• We do not allow human read access to Google API data except (i) where you provide affirmative agreement for a specific session, (ii) where necessary for security purposes (such as investigating an integrity issue or a suspected breach), (iii) where required to comply with applicable law or valid legal process, or (iv) for internal operations on de-identified data that cannot reasonably be re-associated with you.

8.4 Disconnecting and requesting deletion

• Sign in with Google: sign in to your Google Account at myaccount.google.com/permissions and remove CarFix from the list of connected apps, or delete your CarFix account from your account settings.
• All Google-sourced data: contact our Privacy Officer using the details in Section 19, identifying the integration the request concerns.

8A. Sign in with Apple

Customers using the CarFix iOS app may choose Sign in with Apple instead of email-and-password registration. Apple provides CarFix with a stable Apple account identifier, a signed identity token and authorization code, and, when you choose to share them, your name and email address. If you use Hide My Email, the address is an Apple private-relay address rather than your underlying Apple Account address. Apple normally supplies a person's name only on the first authorization.

CarFix verifies the signed identity token and exchanges the authorization code on our server. We retain the resulting Apple identity, refresh, and access tokens with the linked CarFix account so we can authenticate the account, maintain the provider link, and ask Apple to revoke the authorization when the CarFix account is deleted. These credentials are not used for advertising, marketing, contact discovery, or access to unrelated Apple services.

Apple may send CarFix signed server notifications when an authorization is revoked, an Apple account is deleted, or Hide My Email forwarding is enabled or disabled. We verify the notification before acting. A revocation or account-deletion event removes the matching Apple provider link, ends active CarFix sessions, and removes mobile push subscriptions. A relay-disabled event places the normalized relay address on our email suppression list so we do not continue sending to an unavailable destination. A later relay-enabled event removes only that Apple-owned suppression. Provider event identifiers are used to reject duplicate deliveries. A separate hashed relay-state record prevents delayed older events from replacing newer forwarding state.

You can disconnect CarFix in the Sign in with Apple area of your Apple Account settings. You can also delete your CarFix account from CarFix account settings. When we receive Apple's verified revocation notice, or when CarFix account deletion is requested, we attempt to revoke and clear the linked Apple authorization credentials. If automated revocation cannot be confirmed, CarFix directs you to remove CarFix in your Apple Account settings. Apple's own handling of your Apple Account data is governed by Apple's privacy policy.

9. When CarFix staff can access your data

Access to personal information by INU Technologies personnel is limited to what is reasonably necessary for an authorized business purpose. Access is role-based, with the audit coverage described below. Staff may access the categories of information in Section 3, including private service-coordination content (quote descriptions, photos, and in-app messages) and vehicle information, only in the following situations:

• When responding to a support ticket or enquiry you have submitted, and only to the extent necessary to answer it.
• When resolving a Customer being charged more than once through the Platform for the same invoice, or an online payment completed after the Shop voided the invoice, including when the refund of that payment fails or has not completed, as described in Section 3.7A and our Terms of Service, and only to the extent necessary to resolve it.
• When investigating a report of abuse, harassment, fraud, safety risk, or a breach of our Terms of Service, and only to the extent necessary for that investigation.
• When reviewing a Shop application or an audit flag related to Shop verification.
• When operating, debugging, or repairing the Platform, in which case personal identifiers are minimized or pseudonymized where possible.
• When responding to a lawful request from a regulator, law-enforcement authority, or court, after a reasonableness check.
• When establishing, exercising, or defending a legal claim that involves your use of the Platform.

Staff access to these categories is subject to access controls. We log privileged actions and designated private-data views, including administrator quote-detail reads and controlled IP-address reveals. These logs do not represent a recording of every screen or database read. We do not allow staff to browse private messages, vehicle information, or quote content for curiosity, marketing, or any purpose outside the situations listed above.

10. Storage location and cross-border processing

Our primary application database and Customer file storage are hosted in Canada. Some service providers listed in Section 7 are based outside Canada or operate global infrastructure, and may process limited personal information outside Canada in the course of providing their service. In particular:

• Vercel's and Cloudflare's edge networks may process requests outside Canada. A Canadian application-server region does not confine all network, log, or support processing to Canada.
• Stripe, Sold through Link, LLC, and their affiliates may process subscription-billing data, online service-payment data, and Shop Stripe onboarding, identity-verification, and bank-account data in the United States and in other jurisdictions where their infrastructure operates. A financing provider a Customer chooses at checkout, such as Klarna or Affirm, may process that Customer's financing information in the United States or elsewhere under its own privacy notice.
• Resend (Plus Five Five, Inc.), our transactional email provider, processes outgoing email in the United States, using its delivery infrastructure and applicable subprocessors. The personal information involved is limited to the recipient's email address, message contents, and attachments, which may include your name, quote, booking, or vehicle details and Shop-issued invoice or receipt PDFs. Resend processes it solely to deliver email on our behalf, under a written data-processing agreement requiring comparable safeguards, and INU Technologies Inc. remains accountable for it.
• Upstash Redis is hosted in AWS Central Canada. The separate Upstash QStash and Workflow project is hosted in AWS US East and processes the limited opaque identifiers and scheduling or workflow metadata described in Section 7.
• Twilio, Sentry, Google, Apple, and Expo may process information in the United States or other jurisdictions.
• NHTSA VIN-decoding and recall queries are sent to servers operated by the United States government.

Where personal information is transferred outside Canada, it may become subject to the laws of the foreign jurisdiction, including laws permitting access by foreign courts, law-enforcement authorities, and national-security agencies. We require our service providers to protect personal information at a comparable standard through contract, and we conduct a privacy-impact assessment before a covered communication or entrusting of personal information outside Quebec, including outsourced collection, use, or storage. Where Quebec Law 25 section 17 applies, the assessment considers sensitivity, purpose, safeguards, and the receiving jurisdiction, and the transfer must meet its protection and written-agreement requirements. You may contact our Privacy Officer for more details about a particular transfer.

11. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against loss, theft, and unauthorized access, disclosure, copying, use, or modification. These include: encryption in transit (TLS); encryption at rest for our primary database; salted-hash password storage; role-based access controls; controlled access to infrastructure and production data; security logging and monitoring; rate limiting; application-layer input validation; and periodic review of access rights, dependencies, and security configurations. No method of electronic storage or transmission is perfectly secure, and while we use commercially reasonable means, we cannot guarantee absolute security.

12. Retention

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, for legal or regulatory obligations, or for the establishment, exercise, or defence of legal claims. Our retention schedule below describes the ordinary retention limits. Deletion is performed through scheduled cleanup and Privacy Officer review; not every category has an automatic age-based deletion job. Expiry of a quote or an account session does not itself erase the underlying record.

• Account records. While your account is open. For an eligible account, ordinary deletion is scheduled thirty (30) days after your request and processed by daily cleanup, unless you reactivate the account or an unresolved dispute delays erasure. Some records, such as billing evidence, consent or delivery-suppression records, and records needed for a lawful hold, may remain for their separate purposes. Shop ownership or records that require assisted resolution may prevent self-service deletion. Some surviving business records or free text can still identify you even after an account link is removed; contact the Privacy Officer for a record-specific search and any applicable exception.
• Sign in with Apple credentials and relay state. Apple identity, refresh, and access tokens are retained while the Apple provider link is active. CarFix attempts to revoke and clear them when the link is revoked, Apple reports account deletion, or CarFix account deletion is requested. If automated revocation cannot be confirmed, the deletion flow directs you to Apple Account settings; any remaining provider credentials are removed with final account erasure. An Apple-owned relay suppression remains only while forwarding is disabled. A Resend permanent-bounce or complaint suppression may remain independently under the email-delivery rules. Apple event receipts and the current hashed relay-state receipt are removed after approximately thirteen (13) months, and relay state linked to an erased account is removed during erasure.
• Unverified accounts. If you create an account using email and password and do not verify your email address, the account becomes eligible for once-daily cleanup thirty (30) days after creation only when it also has no verified phone, linked Google or Apple identity, vehicle, quote, appointment, shop, or team membership, and no sign-in activity within the previous ninety-one (91) days. If another person attempts to register with the same email after more than seventy-two (72) hours, the same ownership and activity protections apply before a never-used record may be replaced. These safeguards prevent email squatting without deleting an account that shows evidence of use or ownership.
• Vehicle and garage data (including VIN). While the vehicle is in your garage. If you remove a vehicle, we retain it for up to twelve (12) months for fraud prevention and dispute support, unless a longer period is required by law. On account deletion, vehicle data is handled on the same schedule as account records.
• Quote requests and appointments. Twenty-four (24) months from the date of the quote or the appointment, for service continuity, warranty support, and dispute resolution.
• In-app messages and chat transcripts. Twenty-four (24) months from the last message in a thread.
• Photos and other service attachments. Follow the related record's lifecycle. Erasure requests removal of associated files, and a separate sweep removes unreferenced files after its safety window. There is no additional twelve-month photo archive.
• Reviews. While the reviewing account exists and the Shop remains on the Platform. Removed reviews are retained in an internal archive for up to twelve (12) months in case of appeal.
• Shop invoice and receipt records. These are retained separately for the Shop's accounting, tax, dispute, and legal needs. Deleting a Customer account removes its account link but does not erase the identifying snapshots in issued documents. Draft invoice records can also remain and require a separate retention review. The applicable period depends on the record and jurisdiction; contact the Privacy Officer for a record-specific review. Online payment records linked to an invoice (payment status, amounts, payment-method summary, refund and dispute status, and Stripe identifiers) follow the retention of the invoice record they belong to, and records of an open payment dispute are kept until the dispute and any related claim are resolved. The Shop's Stripe account and Stripe's own transaction records are retained by Stripe under its legal obligations.
• Subscription-billing records (Shops). CarFix's schedule is seven (7) years after the end of the relevant fiscal year for current Stripe Managed Payments records and legacy standard Stripe invoice history, subject to longer legal requirements. This is CarFix's retention period; the Canada Revenue Agency's general minimum is six (6) years from the end of the last tax year to which the records relate. Stripe and Link apply their own legally required retention periods.
• Security, audit, and abuse-prevention logs. Ordinarily twelve (12) months, subject to preservation arranged separately for a documented investigation or legal hold. Daily cleanup removes expired or revoked account-session history once its last activity is more than twelve months old, and removes expired verification tokens. Active sessions are retained while needed for sign-in. Provider log retention depends on the relevant service settings.
• Auxiliary Upstash Redis records. Rate-limit records use library-managed expiry tied to the configured window, currently ranging from seconds to twenty-four (24) hours. Hashed phone-token markers expire after eleven (11) minutes, mobile refresh-token reuse and bounded recovery records after ninety-one (91) days, and real-time event history after three (3) days with a cap of 500 events per channel. Aggregate zero-result search terms and counts are not linked to an account, but the current application code does not set an automatic expiry for them, so they remain until administratively deleted.
• Queued notification claim-check payloads. Recipient contact details and rendered notification content awaiting QStash delivery remain in our primary database until delivery or terminal failure. A daily lifecycle process removes any orphaned payload older than twenty-four (24) hours.
• Team member attendance records. These expire in two parts. The location-verification evidence (how far the member's device was from the Shop, the reported accuracy of that reading, and which Shop location the check-in was compared against) is erased three (3) years after the shift, and the session itself is kept. A session still waiting on a manager's review decision is an exception: its evidence is held until that review is resolved, so a record under dispute is not erased while the dispute is open. The timekeeping record (the start and end times, any linked shift, whether each reading was verified or flagged, and a manager's review decision and note) is retained while both the team member's CarFix account and the Shop exist, so that the Shop can meet its own employment record-keeping obligations, and is deleted when the team member's account is erased or the Shop is deleted. Deactivating a team member ends their access but does not delete their past attendance records, because those records belong to the Shop's employment history.
• Marketing-consent records. For the period you are opted in, and for three (3) years after withdrawal of consent, to demonstrate compliance with CASL.
• Privacy-incident and breach register. PIPEDA breach records are retained for at least twenty-four (24) months after we determine that the breach occurred. Where Quebec law applies, incident-register information is retained for at least five (5) years after we become aware of the incident. We apply the longer applicable period.

Support correspondence, Shop operational records, wage history, and optional coverage records are reviewed for continuing service, employment, warranty, dispute, and legal needs. Their retention can depend on the record and the applicable jurisdiction. Contact the Privacy Officer for the retention basis for a specific record or an earlier deletion request. Backups are separate recovery copies governed by the provider's retention and rotation settings; deleting a live record does not immediately remove it from an existing backup. Restored data must be checked against prior deletion requests before normal use resumes.

After the applicable retention period, we delete personal information or irreversibly anonymize it. In some cases, such as legal holds or active investigations, a longer retention period may apply.

13. Marketing communications and CASL

CASL requires consent before most commercial electronic messages may be sent to a Canadian recipient. We treat marketing email, marketing SMS, and marketing push notifications as subject to CASL. We request your consent separately from acceptance of the Terms of Service, through an unchecked opt-in box or equivalent affirmative action. We keep a record of the date, method, and scope of your consent.

You may withdraw marketing consent at any time by: using the unsubscribe link in an email; replying STOP to an SMS; turning off push notifications in your device or account settings; or emailing privacy@carfix.to. Withdrawal takes effect without delay and no later than ten (10) business days. A service message may qualify for a CASL consent exception only where its content meets the applicable statutory conditions, for example when it solely facilitates an agreed transaction or provides qualifying warranty or safety information. Calling a message transactional does not exempt promotional content. Identification and unsubscribe requirements continue to apply wherever required by law.

Marketing suppression for unverified accounts. As an additional safeguard, we do not send marketing communications to an email address whose ownership has not been verified, even where a consent flag was captured. Email ownership may be verified through an activation link or a supported sign-in provider. Once verified, marketing communications may be sent in accordance with your separate consent and delivery settings. This safeguard exists so that a commercial message cannot reach an inbox whose owner has not affirmatively confirmed receipt.

14. Your rights

Under PIPEDA, Quebec Law 25, and other applicable provincial privacy legislation, you have the rights set out below. Each right is subject to the conditions, exceptions, and limits imposed by the applicable legislation.

• Access. You may ask us for a copy of the personal information we hold about you, together with a description of how it is used and to whom it has been disclosed, subject to limits under PIPEDA section 9 (for example, information subject to legal privilege or that would reveal personal information about another individual).
• Correction. You may ask us to correct information that is inaccurate, incomplete, or out of date.
• Withdrawal of consent. You may withdraw consent to the collection, use, or disclosure of personal information, subject to reasonable notice and to legal or contractual restrictions. Withdrawing consent may prevent us from providing some or all of the Platform to you.
• Deletion. You may ask us to delete personal information, subject to the retention periods in Section 12, legal obligations that require us to keep it, and interests that legitimately outweigh the request (such as active dispute resolution or a legal hold).
• Portability (Quebec Law 25). Where technically feasible and legally required, you may ask us to provide, in a structured and commonly used technological format, the computerized personal information you have given us.
• De-indexing and cessation of dissemination (Quebec Law 25, section 28.1). Where the conditions set out in that section are met, you may ask us to stop disseminating your personal information or to de-index a hyperlink that is causing serious injury to your reputation or privacy.
• Automated decision-making (Quebec Law 25, section 12.1). Where we make a decision based exclusively on automated processing of your personal information and section 12.1 applies, we will tell you no later than when we inform you of the decision. On request, we will explain the information used, the reasons and principal factors or parameters, and your right to correct the information. You may submit observations to a staff member able to review the decision. Contact the Privacy Officer to request that review.
• Objection to marketing. You may object to the use of your personal information for marketing at any time, using the channels described in Section 13.

To exercise any of these rights, contact our Privacy Officer using the details in Section 19. We will acknowledge your request promptly and will respond within thirty (30) days, or within a shorter period where required by law. We may ask only for information reasonably necessary to confirm your identity. We assist with preparing access requests. Any extension must be permitted by applicable law; we will explain its basis, revised deadline, and your complaint rights within the required period. Access is generally free or at minimal cost. We will explain any legally permitted charge in advance and obtain your confirmation before proceeding. A refusal or redaction must have an applicable legal basis, which we will explain in writing along with available recourse. We preserve information subject to an access request for as long as required to allow that recourse.

The data-export tool in account settings provides selected account data, including saved locations, favourites, authored reviews and messages, session history, and your own team membership, wage, and attendance records where present. The archive lists its included categories and any omitted attachments. It is a self-service starting point for access, not a substitute for a full request to the Privacy Officer. Information in other records, including correspondence written by others or internal notes about you, may require a separate search and third-party redaction.

15. Use of automated tools

CarFix does not integrate third-party generative artificial intelligence to generate your repair estimates or other user-facing Platform content. Price Intelligence displays aggregated parts and labour prices recorded for completed Platform appointments and Shop-entered walk-in jobs, matched to selected services, vehicle makes and models, and regions. It displays comparisons only when sufficient matching records are available and does not supply a static price fallback. These are recorded service prices, not independently verified amounts paid. The feature does not send your input to a third-party generative artificial intelligence service. Its outputs are informational only, are not a quote, do not bind any Shop, and are not used to make significant-effect automated decisions about you.

We do not sell, licence, or otherwise make your personal information available to third-party providers of generative AI for the purpose of training their models. We may use aggregated or de-identified information derived from Platform activity (which does not identify you individually) to improve the Platform's own features, such as search relevance, fraud detection, and service-quality measurement.

16. Breach notification

Where a breach of security safeguards creates a real risk of significant harm to an individual, we will notify the Office of the Privacy Commissioner of Canada and the affected individuals as soon as feasible, as required by PIPEDA and the Breach of Security Safeguards Regulations (SOR/2018-64). Where Quebec law applies and an incident presents a risk of serious injury, we will diligently notify the Commission d'accès à l'information du Québec (“CAI”) and affected individuals, subject to applicable statutory exceptions. Where a provincial privacy statute imposes additional or different notification obligations (for example, in Alberta under the Personal Information Protection Act), we will comply with those obligations as well. We maintain an internal register of confidentiality incidents and breaches of security safeguards for the applicable periods in Section 12, including Quebec's minimum five-year period. The register covers incidents even when notification is not required and is available to the relevant regulator as required.

17. Complaints process

If you have a concern about how your personal information has been handled, please raise it with our Privacy Officer first so that we have an opportunity to investigate and respond. The process is as follows:

• How to submit. Email privacy@carfix.to or write to the address in Section 19. Please describe the concern as specifically as you can, including the account email or other identifier we can use to find the relevant records, the dates or time period in question, and what outcome you would like.
• Acknowledgement. We will acknowledge receipt within five (5) business days.
• Investigation and response. We will investigate the concern and provide a written response within thirty (30) days of the initial complaint, or within a shorter period where required by law. If the matter is complex and we need longer, we will tell you the reason and give you a revised timeline.
• Outcome. Our written response will state the outcome, the reasons for our decision, any remedial action we are taking, and your right to escalate to a regulator.
• Escalation. If you are not satisfied with our response, you may file a complaint with:
  • the Office of the Privacy Commissioner of Canada (priv.gc.ca);
  • where Quebec privacy law applies, the Commission d'accès à l'information du Québec (cai.gouv.qc.ca);
  • the Office of the Information and Privacy Commissioner in Alberta or British Columbia, where applicable to your circumstances; or
  • the Canadian Radio-television and Telecommunications Commission (crtc.gc.ca) for complaints relating to CASL.

18. Children, minors, and parent or guardian involvement

The Platform is not directed to children, and we do not market the Platform to minors. We do not collect date of birth from ordinary customer accounts, because date of birth is not required for the basic use of the Platform.

By creating an account, submitting a quote request, or booking an appointment, you confirm that you are legally able to enter into the governing agreement in your province or territory, or that you are using the Platform with the involvement and consent of a parent or legal guardian who accepts responsibility for that use. Where a person below the age of majority uses the Platform with parent or guardian involvement, the parent or guardian is the responsible party for the account and for the information submitted through it.

We do not knowingly collect personal information from a person we know to be a minor without appropriate parent or guardian involvement. If we learn that we have, we may delete the information, restrict the account, or take other appropriate steps. Shop-owner and business accounts may be created only by individuals who are legally able to bind the business they represent.

If you believe we hold information about a minor without appropriate parent or guardian involvement, please contact our Privacy Officer using the details in Section 19 and we will take appropriate steps.

19. Contact and changes to this Policy

If you have a question about this Policy, wish to exercise a right described in Section 14, or wish to file a complaint, please contact:

We may update this Policy from time to time. If we make a material change, we will notify you by email, in-app notice, or a prominent notice on the Platform at least thirty (30) days before the change takes effect, unless a shorter period is required to address a legal or security risk. If a change requires new consent, including a new purpose where consent is required, we will obtain it before that processing begins. Notice alone is not consent. The effective date at the top of this Policy indicates when it was last updated. Earlier versions of this Policy are available from the Privacy Officer on request.