Privacy Policy

Who we are

Pit Box is developed and operated by Mykhailo Dudar, an individual developer based in Ukraine (“we”). For the data described in this policy we are the data controller, except for your clients' data, explained below. Contact: hello@pit-box.app.

What we collect

• Account: your email and name, and the Apple or Google account identifier if you sign in with Apple or Google. With Apple's “Hide My Email” we only get the relay address.
• Garage data you enter: garage name and logo, clients (names, phone numbers, notes), cars (make, model, plate, VIN, mileage), orders, works, parts, payments and debts, service book records and maintenance reminders.
• Photos you attach to orders, and VIN photos you scan.
• Team: who belongs to which garage and with what role, and the invitations you send.
• Push notification token of your device, so the app can notify you about orders and team changes.
• Technical data: IP address, device model and operating system, app version, and server logs of requests and errors. We use it to keep the service working and secure.

What we don't collect

No advertising, no tracking across apps or websites, no analytics SDKs, no selling or sharing of data for marketing. The website sets no cookies.

How we use it

Only to run the app: to sync your garage between devices and team members, show reminders and send notifications, recognise a VIN, look up a car by VIN, and keep your account secure. We don't look at your garage data except when you ask us for help or when we must investigate abuse.

Legal bases

If you are in the EU or the UK, we process your data on these grounds:

• To provide the service you signed up for (performance of a contract): your account, garage data, photos, team and sync.
• Our legitimate interest in keeping Pit Box secure and working: technical data, logs, preventing abuse.
• Your consent: push notifications and syncing clients to Contacts. You can withdraw it at any time in the app or in your device settings.

Contacts on your phone

If you turn on syncing clients to Contacts, Pit Box writes your clients into your phone's address book and reads it only to avoid duplicates. Your personal contacts are not uploaded anywhere.

Services we rely on

• Supabase (database, sign-in, file storage, server functions). Data is stored in the EU (Ireland).
• Apple and Google, for Sign in with Apple and Sign in with Google.
• Google Cloud Vision, which receives a VIN photo to read its text. The photo is not stored after recognition.
• NHTSA vPIC (U.S. Department of Transportation), which receives a VIN directly from your device to decode the car's make, model and year.
• AUTO.RIA, from which the app loads the list of car makes and models. No personal data is sent to it.
• Expo, Apple Push Notification service (iPhone and iPad) and Firebase Cloud Messaging by Google (Android), which deliver notifications to your device.
• Resend, which sends sign-in and confirmation emails.

Transfers outside the EU

Your garage data is stored in the EU (Ireland). Some of the services above are based in the United States: Google Cloud Vision, Firebase Cloud Messaging, NHTSA, Expo, Apple and Resend. When data goes to them, it is protected by the EU-US Data Privacy Framework where the provider is certified, or by the European Commission's Standard Contractual Clauses.

Who sees your garage data

The garage owner and the members they invited, according to their roles. Nobody else. Access is enforced on the server, not only in the app.

Your clients' data

When a garage stores its clients' names, phone numbers and cars in Pit Box, the garage is the controller of that data and decides what to keep and why. Pit Box processes it only on the garage's behalf, as described in our Data Processing Agreement (pit-box.app/dpa). If you are a client of a garage and want to access or delete your data, please contact that garage. We will help them handle your request.

How long we keep it

As long as your account exists. When you delete your account, your personal data is deleted. A garage you own is deleted with all its data, unless you hand it over to a team member first. If you are a member of someone else's garage, the clients and orders you created stay with that garage.

Deleted data is removed from our backups within 30 days. Server logs are kept for up to 30 days.

Deleting your account

In the app: Account tab → Delete account. If you signed in with Apple, we also revoke Pit Box's access to your Apple ID. You can also write to hello@pit-box.app and we'll delete it for you. Step by step: pit-box.app/delete-account.

Your rights

You can ask us for a copy of your data, to correct it, delete it, restrict or object to its processing, or to receive it in a portable format. Most garage data can also be exported from the app as CSV or XLSX. Where we rely on your consent, you can withdraw it at any time. Write to hello@pit-box.app and we will answer within one month. If you are in the EU, you can also complain to your local data protection authority.

Children

Pit Box is a tool for auto service businesses and is not meant for children under 16.

Changes

If this policy changes, we'll update the date above, and for significant changes let you know in the app.