Privacy Policy

This policy applies to shopowl.io, to the application at my.shopowl.io, and to any personal information ShopOwl handles in connection with them.

There are two distinct roles to keep in mind. For information about the businesses that subscribe to ShopOwl and the staff who use it, we act as the controller. For the end-customer records a repair shop stores in the Service — its customers, their vehicles, their documents and messages — we act as a processor on that shop’s instructions. If you are a customer of a repair shop and want your record corrected or deleted, contact that shop directly; we will support them in responding.

Account and staff information. Business name, locations, contact details, user names and email addresses, roles and location scope, and authentication data.

Customer Data entered by subscribing shops. Customer names and contact details, vehicles, appointments, repair orders, loaner reservations and signed contracts, message history, consent state, notes, and payment references.

Integration data. Records synchronized from systems a shop authorizes, such as its shop management system, payment processor, messaging provider, accounting package, or analytics tools.

Usage and technical information. Log records, IP address, browser and device type, timestamps, pages accessed, and audit records of sensitive actions taken in the Service.

Communications with us. Messages you send to our support or sales addresses, and the content of those exchanges.

• To provide, operate, secure, and support the Service.
• To authenticate users and enforce role and location-based access.
• To send transactional messages about your account, billing, and security.
• To deliver messages a shop sends to its customers, subject to the consent that shop has recorded.
• To generate the reporting and analytics features within a shop's own account.
• To detect, investigate, and prevent fraud, abuse, and security incidents.
• To meet legal, tax, and accounting obligations.
• To improve the Service, using aggregated or de-identified information that does not identify any individual.

We do not sell personal information, and we do not use Customer Data to train general-purpose machine learning models.

Where a shop enables the assistant features, queries and the sources that shop has designated are processed by our AI provider to generate a response. Sources are limited to the material that shop supplies and can review. Responses are generated for that account only and are not used to answer questions for any other account.

We share personal information only in the following circumstances:

• With service providers that host, secure, or operate the Service on our behalf, under contracts that limit their use of the information — including our cloud hosting and database provider, payment processor, messaging provider, and AI provider.
• With systems a shop has explicitly connected to its account, at that shop's direction.
• Where required by law, legal process, or a lawful government request, and where we are permitted to do so we will inform the affected customer first.
• To protect the rights, property, or safety of our customers, the public, or us.
• In connection with a merger, acquisition, or sale of assets, with notice before personal information becomes subject to a different privacy policy.

Payment card details are handled by our payment processor and are never stored on our systems.

The Service records communication consent per customer and per channel, and checks it before a message is sent. Opt-out requests are honored across conversations and campaigns. Subscribing shops are responsible for obtaining consent lawfully and for the content of the messages they send.

• Each account's data is isolated by row-level security enforced in the database, beneath the application layer.
• Access is scoped by role and by location, and staff access can be reviewed and revoked by account owners and admins.
• Sensitive actions are recorded in an audit trail.
• Data is encrypted in transit, and at rest by our hosting provider.
• Access to production systems is limited to personnel who need it to operate and support the Service.

No system is perfectly secure. If a breach affects your personal information, we will notify affected customers and any regulator as required by applicable law and without undue delay.

We keep account information for as long as an account is active. Customer Data is kept according to the retention settings a shop configures — including for signed documents, payment evidence, and assistant sources — and is deleted or anonymized after those periods expire.

After an account is terminated, Customer Data is retained for a limited wind-down window described in the Cancellation & Refunds policy so it can be exported, then deleted. Backups age out on their own schedule. We may keep records we are required to keep for tax, legal, or accounting purposes.

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. To exercise a right, contact privacy@shopowl.io. We will verify your request before acting on it, and we will not discriminate against you for making one.

If your information is held in a repair shop’s account, we will route your request to that shop, which decides how it is handled.

The marketing site uses only what is necessary to serve the pages. The application uses strictly necessary cookies to keep you signed in and to protect your session. We do not use advertising cookies on our own properties.

Where a shop connects analytics tools to its own account, those tools operate under that shop’s configuration and its own privacy notice.

The Service is a business tool and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child’s information has been provided to us, contact privacy@shopowl.io and we will delete it.

The Service is operated from the United States, and information may be processed there and in other countries where our service providers operate. Where required, we use appropriate safeguards for transfers of personal information out of your jurisdiction.

We may update this policy. Material changes will be notified by email or in the Service before they take effect, and the “Last updated” date above always reflects the current version.

Privacy questions and requests go to privacy@shopowl.io.