Privacy Policy

1. Information We Collect

We collect the following types of information:

• Account Information: When you register, we collect your email address, full name, and password. Your password is never stored in plaintext — it is salted and hashed by our authentication provider (Supabase Auth) using industry-standard methods (bcrypt).
• Vehicle and Shop Data You Provide: Vehicle Identification Numbers (VINs), diagnostic trouble codes (DTCs), symptom descriptions, technician notes, and diagnostic scan-tool reports (PDFs or photos) that you upload or paste into the Service.
• Shop Software Page Content: When you open a work order in a supported shop management system, the extension reads publicly visible vehicle fields from that page (VIN, repair order number, mileage, license plate, and engine information) so it can auto-populate the assistant context. Levels of support vary by platform and may behave inconsistently on platforms we have not yet fully tested. We deliberately do not auto-read customer-identifying fields such as customer name, address, or phone number, even where those fields appear in page titles or headers. The Photo Markup feature, where supported, reads work-order photos that you choose to annotate and replaces the original photo with the annotated version through the shop management system's own photo upload mechanism.
• License Plate as Personal Information: A license plate number is a vehicle-specific identifier that, in California, Virginia, and several other US jurisdictions, can constitute 'personal information' when it is reasonably linkable to a vehicle owner. We therefore treat license-plate data we read from your shop management system as personal information for all purposes of this Privacy Policy, including retention, security, sub-processor handling, your privacy rights, and breach notification. We use license-plate data only for vehicle identification within the Service; we do not use it for advertising, profiling, or any purpose unrelated to operating the Service, and we do not sell or share license-plate data with third parties for their own purposes.
• Service History and Repair-Order Analytics: To generate maintenance recommendations and give your shop analytics on due and declined work, the Service reads and stores the vehicle service history shown in your shop management system (service dates, mileage, and the services performed and their prices) and a snapshot of each repair order you analyze. A snapshot may include the vehicle identifiers, the services recommended or declined on that order, and aggregate customer-value metrics drawn from the shop record (such as visit count, lifetime spend, average repair-order value, and days since last visit), keyed to your shop's internal customer identifier. We do not store customer names, addresses, phone numbers, or email addresses in this data. It is visible only to authorized users of your shop and your enterprise administrators, is used only to identify due and declined work and to measure the Service's value to your shop, and is never sold, shared with advertisers, or used to train AI models. Retention periods are described in Section 5.
• Feature Usage Data: We log which features you use (e.g., diagnostic queries, note polishing, scan report processing) along with a short context preview, for the purpose of enforcing fair-use limits, surfacing usage analytics to shop administrators, and improving the Service.
• Training Tip Engagement: When we deliver a training tip to you (either as a Chrome notification at 9 AM or as a card in the side panel), we record a per-user event noting which tip you saw, which surface delivered it, and whether you clicked the tip's video. We use these events to (a) avoid showing you the same tip twice in a row, (b) measure which tips are useful, and (c) decide which tip to serve you next from the rotation pool. Tip engagement data is visible only to MECH Inspect administrators and is never used for advertising or sold to third parties. You can turn off daily tips entirely via the 'Daily tips: ON/OFF' toggle in the extension footer menu.
• Gamification and Leaderboard Data: Where your shop has enabled Gamification Features (activity-weighted points, virtual badges, cycle-based leaderboards, and related engagement mechanics), we record per-user activity counts, applied point weights, badge attainment events, cycle standings, and — where supplied by your shop or enterprise administrator — the free-text description of any shop-defined reward associated with a cycle or badge. We use this data to compute leaderboard rank, render the in-Service leaderboard and trophy drawer, and produce cycle-end summaries. Gamification and leaderboard data is visible to other users within your shop or enterprise (including administrators) by design, is retained for the duration of the cycle plus 24 months for historical comparison and dispute review, and is never sold, shared with advertisers, or used to train AI models. We do not record or transmit any cash value, payroll amount, or tax information associated with a shop-defined reward; that is administered solely by your employer outside the Service.
• Technical Data: We may automatically collect information such as your computer's Internet Protocol (IP) address, browser type, browser version, and the time and date of your visit.
• Customer Video Page Visitors: When a vehicle owner opens a video page we sent on a shop's behalf, we record the link token, the event (such as play or complete), the playback position and the device type (phone, tablet or desktop). We do not store the visitor's IP address or browser details. The video player is provided by a third party that receives the visitor's IP address and browser information to deliver the video; see Section 4.

2. How We Use Your Information

We use the collected data for the following purposes:

• To provide and maintain the Service.
• To query AI models (such as Google Gemini) to generate diagnostic suggestions.
• To process payments via our third-party payment processor.
• To monitor the usage of the Service to detect, prevent, and address technical issues.
• To improve the accuracy and performance of our AI prompts (this means refining the prompt templates we send to AI providers, not training models on your data).
• AI Training: We do not train any artificial intelligence or machine-learning model on your personal data, vehicle data, technician notes, scan reports, or photos. We use Google's paid Gemini API to process your queries; under Google's data policy for paid Gemini API customers, your data is not used to train or fine-tune Google's foundation models. We do not share your data with any third party for the purpose of training machine-learning models.

3. Cookies, Consent, and Tracking Technologies

We use minimal cookies and similar technologies. We implement Google Consent Mode v2 to respect your choices:

• Essential Cookies: Required for authentication and session management. These cannot be disabled.
• Google Analytics 4: We use Google Analytics 4 (GA4) to understand how visitors interact with our website, including page views, session duration, and feature usage. GA4 uses first-party cookies (e.g., _ga, _ga_*) to distinguish unique users. These cookies are only set when you grant analytics consent.
• Google Consent Mode v2: We implement Google Consent Mode v2, which defaults to denying all analytics and advertising cookie storage until you make a consent choice. If you decline analytics cookies, GA4 will operate in cookieless mode and will not store any cookies on your device. Google may still collect anonymous, aggregated pings for basic measurement.
• Consent Banner: When you first visit our site, a consent banner gives you the choice to accept or reject analytics cookies, or to manage preferences individually. Your choice is saved locally in your browser and restored on future visits. You can change your preferences at any time by clearing your browser's local storage for this site.
• No Advertising or Marketing Cookies: We do not use cookies for targeted advertising, remarketing, or ad personalization. Ad storage, ad user data, and ad personalization signals are permanently denied in our Consent Mode configuration.
• No Data Sold: We do not sell your personal data or cookie data to any third party.
• Third-Party Video Player Analytics: Where a customer video page, or the demonstration video on our homepage, plays content from AutoNetTV Media, Inc., the page loads AutoNetTV's video player, which records a view and uses AutoNetTV's own analytics tools (currently Matomo and Metricalp) to measure playback. These tools are operated by AutoNetTV and its providers, not by us; we cannot disable them, and they may set cookies or similar identifiers under AutoNetTV's own privacy policy. They load only on customer video pages that play AutoNetTV content, and on our homepage when its demonstration reaches the video step or a visitor presses play, never inside the Chrome Extension or the signed-in dashboard.

4. Third-Party Service Providers

We may employ third-party companies and individuals to facilitate our Service ("Service Providers"). These third parties have access to your data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

Supabase: Used for secure database hosting and user authentication.

Google Gemini API: Used for generating AI diagnostic responses. Vehicle data (VINs, codes, technician notes, and any diagnostic scan-tool reports you upload to the Scan Report feature) is sent to Google for processing. We use the paid Gemini API; under Google's data policy for paid Gemini API customers, your data is not used to train Google's foundation models.

Stripe: Used for payment processing. We do not store or collect your payment card details. That information is provided directly to Stripe.

Resend: Used for transactional email delivery.

CARFAX, Inc.: Provides vehicle history reports, only for shops in the CARFAX Shop Loyalty Program. CARFAX receives the vehicle identification number (VIN) and the shop's location identifier to look up a report.

Google Analytics 4 (website only): Used to measure marketing-site traffic and feature engagement on mechinspect.ai. Loaded only after you grant analytics consent via the cookie banner; operates in cookieless mode otherwise. Not used inside the Chrome Extension or signed-in dashboard areas that handle vehicle or account data.

Shop-Ware (Photo Markup only): The Photo Markup feature replaces a repair order photo with its annotated version by uploading the new image through Shop-Ware's own photo upload API. Only photos you explicitly annotate and save are transmitted. We do not store or access these images outside of that upload flow.

AutoNetTV Media, Inc. (customer video pages and the homepage demonstration video): Provides the Car Care explainer videos some shops send to customers. When a shop activates the video add-on, AutoNetTV also receives the shop's business name, address and telephone number to set up its account. When a vehicle owner plays a video, AutoNetTV's servers and content delivery network receive the visitor's IP address and browser information, the video identifier and the shop location identifier. AutoNetTV's player also loads its own analytics tools, described in Section 3. The viewing events we record ourselves stay with us.

Matomo and Metricalp (loaded by the AutoNetTV player): Analytics services used by AutoNetTV's video player on customer video pages that play AutoNetTV content and on our homepage demonstration video. Operated by AutoNetTV and those providers, not by us.

5. Data Retention

We retain your data according to the following schedule:

• Account Information: Retained until account deletion, plus 30 days after deletion request.
• Vehicle Diagnostic Queries: Cached for 48 hours within your organization, then automatically deleted.
• Third-Party Vehicle History Data: Vehicle history data obtained from third-party providers is cached for no more than 24 hours, then automatically deleted.
• Vehicle Service History: Retained for up to 36 months to power maintenance recommendations and shop analytics, then automatically deleted.
• Repair-Order Snapshots: Retained for up to 24 months (recommended and declined services and aggregate customer-value metrics, with no customer contact information), then automatically deleted.
• Payment Records: Retained for 7 years (legal requirement).
• Audit & Security Logs: Retained for 90 days for security monitoring purposes.
• Terms Acceptance Records: Retained for Duration of account plus 3 years.

6. Data Security

The security of your data is important to us, but remember that no method of transmission over the Internet is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security. For details on our security practices, please see our Security Policy.

7. Your Privacy Rights

Depending on your location, you have specific rights regarding your personal information under applicable privacy laws. We honor these rights for all users where they apply.

All Users

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your account and personal data.
• Portability: Receive your data in a structured, commonly used, machine-readable format.
• Object: Object to certain processing of your personal data.
• Non-Discrimination: We will not discriminate against you for exercising any of these rights.

California Residents (CCPA / CPRA)

• Right to Know: Request disclosure of the categories and specific pieces of personal information we collect, the sources, the business purpose, and the categories of third parties with whom we share it.
• Right to Delete: Request deletion of personal information we have collected from you, subject to legal exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Limit Use of Sensitive Personal Information: Direct us to limit our use and disclosure of your sensitive personal information to that necessary to provide the Service.
• Right to Opt Out of Sale or Sharing: We do not sell or share personal information for cross-context behavioral advertising. No opt-out action is necessary.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA / CPRA rights.

Other US State Residents

Residents of US states with comprehensive consumer privacy laws have the rights listed below. Where state-specific terminology differs, we apply the most protective interpretation. We currently provide these rights to residents of the following states:

• California (CCPA / CPRA)
• Colorado (CPA)
• Connecticut (CTDPA)
• Delaware (DPDPA)
• Florida (FDBR)
• Indiana (Indiana CDPA)
• Iowa (Iowa CDPA)
• Kentucky (KCDPA)
• Maryland (MODPA)
• Minnesota (Minnesota CDPA)
• Montana (Montana CDPA)
• Nebraska (NDPA)
• New Hampshire (SB 255)
• New Jersey (NJDPA)
• Oregon (OCPA)
• Rhode Island Data Transparency and Privacy Protection Act
• Tennessee (TIPA)
• Texas (TDPSA)
• Utah (UCPA)
• Virginia (VCDPA)

• Right to Confirm Processing and Access: Confirm whether we are processing your personal data and obtain a copy of that data.
• Right to Correct: Correct inaccuracies in your personal data, taking into account the nature of the data and our processing purposes.
• Right to Delete: Delete personal data we hold about you, subject to legal exceptions.
• Right to Data Portability: Obtain your personal data in a portable, readily usable, machine-readable format.
• Right to Opt Out of Sale: Opt out of any 'sale' of your personal data. We do not sell personal data.
• Right to Opt Out of Targeted Advertising: Opt out of processing of your personal data for targeted advertising. We do not engage in targeted advertising.
• Right to Opt Out of Profiling: Opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. We do not engage in such profiling.
• Right to Appeal: Appeal our decision regarding a privacy request. See Section 9, 'Right to Appeal a Privacy Decision.'

European Users (GDPR)

• Restrict Processing: Request restriction of processing in certain circumstances.
• Data Portability: Receive your data in a structured, commonly used, machine-readable format.
• Withdraw Consent: Withdraw consent at any time where processing is based on consent.
• Lodge Complaint: Lodge a complaint with your local supervisory authority (e.g., your country's Data Protection Authority).

See Section 8 below for how to exercise these rights and Section 9 for your right to appeal a denial.

8. How to Exercise Your Privacy Rights

To exercise any of the rights described in Section 7, you may contact us as described below. We do not charge a fee for honoring privacy-rights requests, and we will not discriminate against you for exercising any right.

• Submit a Request: Email privacy@mechinspect.ai with the subject line 'Privacy Request' and a description of the right you want to exercise. You may also submit a request through the contact form linked at the bottom of this policy.
• Identity Verification: To protect your privacy, we will verify your identity before fulfilling any request that involves disclosure or deletion of personal information. Verification typically consists of matching the request to your account email and sending a confirmation link to that email. For sensitive or large-volume requests, we may request additional information sufficient to confirm your identity.
• Authorized Agents: You may designate an authorized agent to submit a request on your behalf. The agent must provide written authorization signed by you and their own contact information. We may still verify your identity directly or confirm the agent's authorization with you.
• Response Timeline: We will acknowledge your request within 10 business days and respond substantively within 45 days of receipt. If your request is complex or requires additional time, we may extend the response period by up to an additional 45 days, with notice to you within the original 45-day window explaining the reason.
• Manifestly Unfounded Requests: If a request is manifestly unfounded, excessive, or repetitive, we may charge a reasonable administrative fee or refuse to act. In either case, we will explain the basis for our decision and inform you of your right to appeal (see Section 9).

9. Right to Appeal a Privacy Decision

If we decline to act on your privacy request, you have the right to appeal our decision. To appeal, email privacy@mechinspect.ai with the subject line 'Privacy Request Appeal' within 60 days of our decision, briefly describing why you believe the decision should be reconsidered. We will respond to your appeal in writing within 60 days of receipt. If we again decline to act, our response will explain the basis for that decision and inform you of any further options available to you, which may include contacting your state Attorney General. This right of appeal is required by privacy laws in Colorado, Connecticut, Delaware, Indiana, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, and Virginia, and we honor it for all users.

10. Additional State Disclosures

The following additional disclosures are provided to satisfy specific state-law requirements:

• California 'Shine the Light' (Cal. Civ. Code §1798.83): We do not share your personal information with third parties for those third parties' direct marketing purposes.
• California Civil Code §1789.3: The Service is provided by 404 Innovationz LLC, 9230 Old Keene Mill Rd #1004, Burke, VA 22015-4201, USA. California residents may report consumer-protection complaints as set forth in Section 15 of our Terms of Service.
• Washington 'My Health My Data' Act (RCW 19.373): The Service is intended for automotive diagnostics and does not collect 'Consumer Health Data' within the meaning of the Washington My Health My Data Act. We do not engage in geofencing of any health-care facility.
• Nevada SB 370 (NRS Chapter 603A): We do not collect 'Consumer Health Data' within the meaning of Nevada SB 370.
• Florida Digital Bill of Rights: We do not voice-record consumers, sell sensitive personal data, or sell the personal data of any known minor under 18.
• Texas Data Privacy and Security Act: We do not knowingly process the personal data of any consumer under 13 years of age, and the Service is not directed to children under 13.
• New York SHIELD Act (N.Y. Gen. Bus. Law §899-bb): We maintain reasonable administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of New York residents' private information.

11. International Data Transfers

Our database and file storage are hosted in the United Kingdom (London) by our infrastructure provider. Our third-party service providers (Section 4) process information in the United States and other countries. Your information may therefore be transferred to and processed in the United Kingdom, the United States and other countries, which may have data protection laws that differ from those of your home jurisdiction.

• Where required by applicable law for transfers from the EEA, UK, or Switzerland to the United States, we and our service providers rely on appropriate transfer mechanisms, such as Standard Contractual Clauses approved by the European Commission, the UK International Data Transfer Addendum, or the EU-US / UK-US / Swiss-US Data Privacy Framework where the recipient is certified.
• By using our Service, you consent to the transfer of your information to the United Kingdom and the United States as described above.
• We ensure that all data transfers comply with applicable data protection laws.

12. Children's Privacy

The Service is intended for adult automotive professionals and is not directed to children under the age of 13. We do not knowingly collect personal information from anyone under the age of 13. If you believe we may have inadvertently collected information from a child under 13, please contact privacy@mechinspect.ai and we will promptly delete it. Users between the ages of 13 and 18 may use the Service only with the consent of a parent or guardian and only in connection with bona fide professional training or apprenticeship in the automotive industry.

13. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and, where the changes are material and you have an account with us, by email and/or an in-app notice. Material changes will take effect no sooner than 30 days after notice, except where a shorter timeline is required by law.

14. Contact Us

If you have any questions about this Privacy Policy, please contact us:

Privacy Inquiries: Contact Privacy Team

General Support: Contact Support