OneGarage Privacy Policy

01. Information We Collect

To provide automated vehicle logging, pedigree verification, and maintenance forecasting, OneGarage collects the following categories of information:

• Account Information: Name, email address, hashed passwords (managed securely via Supabase Auth), and billing state (managed via Stripe).
• Vehicle Specifications: Make, model, year, odometer readings, engine specifications, permanent chassis identifiers (VIN / Chassis Number), and engine serial numbers.
• Service & Maintenance Records: Workshop and dealership names, service dates, itemized parts, fluid replacements, invoice amounts, labor descriptions, and maintenance notes.
• Document & Image Uploads: Photos and PDF scans of mechanic invoices, workshop receipts, dyno sheets, inspection certificates, and vehicle profile photographs uploaded voluntarily by you.
• Technical & Usage Telemetry: Anonymized log data, device browser type, IP address, and platform performance diagnostics.

02. AI Document Processing & Sub-Processors

When you upload an invoice or receipt to OneGarage for automated record extraction, the document is processed using our automated optical comprehension pipeline:

03. Data Retention & Document Storage

By default, OneGarage retains your vehicle service history and uploaded invoice images for as long as your account remains active, ensuring you maintain a permanent, cumulative provenance pedigree for your vehicles.

04. Your Rights & Right to Erasure ("Right to be Forgotten")

In compliance with the Australian Privacy Principles (APPs), the EU General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA), you maintain full sovereignty over your data:

• Right to Delete Individual Records: You can delete individual service logs, receipt attachments, or entire vehicles directly inside the OneGarage app at any time.
• Right to Permanent Account Deletion: You can permanently wipe your account and all associated vehicles, logs, and storage assets at any time via the in-app Account Settings modal. Deletion permanently erases your database records and storage blobs.
• Right of Access & Portability: You may export your vehicle logs and digital history or request a complete copy of all data associated with your profile by contacting our privacy team.

05. Public Resale Passports & Shared Links

OneGarage allows vehicle owners to generate public Resale Passports (accessible via unique URLs such as /onegarage/passport/[id]) to showcase documented history to prospective buyers or automotive enthusiasts.

When you choose to generate or share a public Resale Passport link, you acknowledge and consent that the vehicle specifications, verified service items, mileage logs, and public maintenance badges for that specific vehicle will be viewable by anyone possessing the URL. You can disable or delete the vehicle to revoke public access at any time.

06. Security Safeguards & Encryption

We implement industry-standard physical, electronic, and procedural safeguards to protect your personal information:

• All web traffic is transmitted strictly over TLS 1.3 with HSTS enforcement.
• Database and blob storage volumes are protected by AES-256 encryption at rest.
• Database access is enforced via strict PostgreSQL Row-Level Security (RLS).
• Access tokens and session keys are signed using cryptographic JWT standards.