Privacy Policy
How GarageEX collects, uses, shares and protects personal information: about the people who use GarageEX to run their shop, about visitors to our website, and about the customers of the shops that use GarageEX, which we handle on those shops’ behalf.
1. Who we are
GarageEX is software for auto repair shops, provided by Naddaf Ventures Inc., operating as GarageEX ("GarageEX", "we", "us"), 70 Beech Street, Ottawa, Ontario K1S 3J6.
We are accountable for the personal information under our control and have named a Privacy Officer, who can be reached at [email protected]. We follow the Personal Information Protection and Electronic Documents Act (PIPEDA), the provincial privacy laws that apply to us, and Canada’s Anti-Spam Legislation (CASL).
2. Our two roles
When we decide why and how information is used. For the owners and staff of shops that use GarageEX, for people who contact us through our website, and for visitors to garageex.com, we are responsible for the information and this policy tells you how we handle it.
When we handle information for a shop. A shop that uses GarageEX keeps records about its own customers and their vehicles: appointments, estimates, invoices, payments, inspections, messages and calls. The shop is the business the customer deals with and decides what it collects and how it uses it. We process that information only to provide GarageEX to the shop, under our agreement with the shop. If you are a customer of a shop, please contact the shop first about your information; we will help the shop answer you.
3. Information we collect
Shop accounts and users. The shop’s name, phone, email, address, business hours and settings; for each user, their name, email address, role, a one-way (bcrypt) hash of their password (never the password itself), when they last signed in, time-clock entries and a record of changes they make to orders.
Security and audit records. When our support staff sign in to a shop account to help, the time, the staff member and every change they make are logged. We also record the IP address and browser (user agent) for these support sessions, when an account owner accepts our Terms of Service and this policy, and for administrative actions on our platform. When a password-reset or email-confirmation link is requested, or a "This wasn’t me" link is sent after a new sign-in, we keep the IP address of that request or sign-in with the (hashed) link.
Shop users’ mobile numbers and notifications. A user may confirm a mobile number (Canadian and US numbers only): we text it a six-digit code from GarageEX’s own Twilio number. We keep only a one-way hash of the code, together with the number and the IP address the request came from, and delete them a day after the code is used or expires. Once the code is entered we store the number with the user’s account. We use it to text that user the notifications they choose and the security notices about their account, and, if they turn on two-step sign-in, their sign-in codes. Texts about the shop’s work come from the shop’s own phone line (its RingCentral or Twilio number); security notices and codes come from GarageEX’s Twilio number. A user can remove the number at any time, which also deletes the codes sent to it. Each user chooses which notifications reach them in the app, by email or by text, and we keep those choices with their account. For each notification we deliver to a user we keep a delivery record: which notification, the channel, the time, and whether it was sent or why it was not. The user sees it as "Last sent" on their Notifications page, which looks back 90 days, and delivery records are deleted after 90 days.
Two-step sign-in. A user can turn on two-step sign-in, and a shop’s owner can require it for the shop’s users. The user then signs in with their password and a six-digit code from an authenticator app, an email or a text. For an authenticator app we store the secret the app shares with GarageEX, encrypted in our database. Codes sent by email or text are kept only as a one-way hash, with the address or number they went to and the IP address the request came from, and are deleted a day after they are used or expire. Recovery codes, which the user can use when no other code reaches them, are kept only as one-way hashes. At sign-in a user can choose to trust the browser, so that it is not asked for a code again for the number of days the shop’s owner sets: the browser keeps a random token in a cookie and we keep only a one-way hash of it, with the name of the browser (for example "Chrome on Windows"), the IP address it was trusted from, when it was trusted and last used, and when the trust ends. The user sees their trusted devices in My profile and can forget any of them; a trusted-device record is deleted 30 days after it is forgotten or the date its trust was set to end. For each sign-in we keep a session record: the browser, the IP address and when it was last active, which the user sees as their open sessions in My profile. When someone signs in with a code on a browser that was not trusted, we tell the user, with the browser, the IP address and the time, and the email carries a "This wasn’t me" link that signs them out everywhere. When the owner changes the shop’s two-step sign-in rules, we log who changed them, when, and the rules before and after.
Approval records (handled for the shop). When a customer approves or declines work on a shop’s approval page, the shop keeps a record of what was shown, the decision, the time, the IP address and browser (user agent) and, if the customer types it, their name; a decision staff record by phone or in person is kept the same way with the staff member’s name.
Inspection report reads (handled for the shop). When a customer opens the inspection report a shop sent them (by its own link or from the shop’s approval page), we record when it was opened, how long it was actively read (only while the page is on screen and has been used in the last 30 seconds) and which items the customer opened or looked at, and for how long. We do not keep the IP address with these records, and reads by the shop’s own signed-in staff are not counted. The shop sees them on the order, for example when the report was opened and for how long it was read, and the report page tells the customer that the shop sees when they open it.
Billing for GarageEX. The shop’s plan and subscription history. Card payments for a GarageEX subscription are taken by Stripe; we receive a Stripe customer reference, never the full card number. To work out the sales tax (GST/HST) on a subscription, Stripe collects the shop’s billing address and, if the shop gives one, its tax number at checkout.
Website enquiries and demos. When you contact us through our website, we keep what you send: your name, shop name, email, phone, city, province or state, and your message. When you book a demo, the booking (your name, email, the time you choose and anything you add) is made with Calendly and shared with us.
Information shops keep about their customers (handled for the shop). Names, email addresses, phone numbers and addresses; vehicles (year, make, model, VIN, licence plate, colour, mileage); appointment requests and booking details; estimates, work orders, invoices, payments, refunds and store credit (for card payments: card brand, last four digits and expiry, never the full card number); inspection findings with photos, video and audio; notes; text messages; call logs, voicemail details, transcriptions and links to call recordings when the shop connects its phone system; reviews; and each customer’s marketing consent and opt-outs.
Email delivery records. When an email sent through GarageEX cannot be delivered because the address does not exist or no longer accepts mail (a "hard bounce"), or when the person who received it reports it as spam, our email provider tells us. We keep the email address, which of these happened and when, the reason given by the receiving mail server, and which shop the email came from. We use this record to stop sending email to that address. An address that cannot receive email cannot receive it from any shop, so the record applies to every shop that uses GarageEX: a shop that tries to email that address is told only that the address bounced or that email to it is blocked, and only the shop whose email was reported as spam is told it was reported.
Technical information. Our servers and our error-monitoring provider receive the technical details of requests (IP address, browser, pages and errors). See "Cookies and similar technologies" below.
4. How we use information
- to provide GarageEX: sign-in, the features a shop uses, the messages a shop asks us to send to its customers (confirmations, estimates and approvals, invoices, receipts, reminders), the notifications each user chooses to receive, and security notices about their account;
- to bill shops for GarageEX and to manage plans, limits and suspensions;
- to keep the service secure: authentication, rate limiting, audit logs of support access, fraud and abuse prevention;
- to stop sending email to addresses that bounce or whose owner reported an email as spam, so that email from GarageEX keeps reaching the people who want it;
- to find and fix errors and improve reliability;
- to answer enquiries and support requests, and to tell account owners about important changes to the service or to these documents;
- to comply with the law and enforce our agreements.
We do not sell personal information, we do not use a shop’s customer records for our own marketing, and we do not use advertising or cross-site tracking tools.
Marketing messages to a shop’s customers are sent by the shop through GarageEX, and only to customers for whom the shop has recorded express consent on that channel. Every marketing message carries an unsubscribe link (email) or opt-out instructions (text), and replying STOP to a text stops marketing texts. If a customer reports a shop’s email as spam, we record that as the customer’s opt-out from that shop’s marketing email.
Text messages. Texts about a customer’s own visits (appointments, estimates and approvals, vehicle updates, invoices and receipts, replies) are described, with how a customer agrees to them and stops them, in our SMS Terms. No mobile information is shared with third parties or affiliates for marketing or promotional purposes. Text-message opt-in data and consent are never sold, rented or shared with anyone; they are used only to send those texts, through the shop’s phone provider.
5. Service providers we use
We share information with the following providers only as needed for them to perform their service for us, under contracts that require them to protect it:
- Railway (United States): hosting of the GarageEX application and its databases.
- Resend (United States): delivery of email — the messages the app sends about an account, an order or an appointment, the marketing email shops send to customers who agreed to it, and the notifications users choose. Resend tells us when an email bounces or is reported as spam (see "Email delivery records" above).
- Twilio (United States): text-message delivery, when used — including the marketing texts shops send, and the codes that confirm a user’s mobile number and the security notices to users, which GarageEX sends from its own Twilio number.
- Stripe (United States and Ireland): GarageEX subscription billing, and card payments that shops take from their customers.
- Sentry (United States): error monitoring and session replay (see below).
- Cloudinary (United States): storage of inspection photos, video and audio.
- CARFAX (Canada and United States): vehicle look-ups by VIN or licence plate, service-history checks and, only for shops that opt in, the repair-order information CARFAX needs to add a service record to a vehicle’s history (VIN, licence plate and province or state, dates, mileage, the work performed and the shop’s location).
- U.S. National Highway Traffic Safety Administration (vPIC service): decoding a VIN (only the VIN is sent).
- WHI Solutions (Nexpart) (United States): parts quoting and ordering, when a shop uses it (VIN, mileage and the order number).
- Calendly (United States): scheduling the demos booked from our website.
- Google (United States): address search and address checking on the forms where an address is entered (what is typed in the address field, and the address when it is checked), finding a shop’s own listing on Google at sign-up and in Settings, the map of the shop on customer pages (the customer’s browser loads it from Google), our own email accounts, and the typeface of the emails about a GarageEX account, which the recipient’s email program downloads from Google Fonts.
- Cloudflare (United States): domain name, network and security services; traffic to garageex.com passes through Cloudflare.
Integrations a shop connects with its own account (for example Stripe payments for its customers, QuickBooks Online, RingCentral, or its own Twilio number) exchange the information the shop chooses to sync with that provider. Those providers’ own terms and privacy policies apply to what they receive.
We may also disclose information if the law requires it, to protect the rights and safety of our users or the public, or as part of a sale or reorganisation of our business, in which case the information stays protected by this policy.
6. Information stored or processed outside Canada
GarageEX is operated from Canada, but our hosting and most of our service providers are in the United States, and some are in the European Union. Information stored or processed there is subject to the laws of those countries and may be accessible to their courts, law enforcement and national security authorities. We choose providers that commit to protecting the information and use it only to provide their service to us.
7. Error monitoring and session replay
To find and fix problems, GarageEX sends error reports and performance data to Sentry. On our website, Sentry receives error reports and performance data only; it does not record the screen. In the shop app (the signed-in admin), Sentry also records a replay of the screen for a sample of sessions (about one in ten) and for sessions where an error happens. Replays mask the text on the page, everything typed into forms and the addresses of links, and no replay is recorded on our website or on the pages customers open from an emailed or texted link. Links that carry an access token are shortened before they are sent.
9. How long we keep information
We keep a shop’s records for as long as the shop has an account with us. When an account ends or its owner asks us to delete it, we delete the shop’s records within 90 days (after giving the owner the chance to download them), except what the law requires us to keep, such as our own billing records. Copies in our backups are overwritten on the backup schedule of our hosting provider.
A sign-up that is not finished (the email address is not confirmed, so no shop is created) is deleted automatically after 24 hours. A shop whose email address is confirmed but which never pays for a plan is kept until its owner asks us to delete it.
Website enquiries are kept for as long as we need them to follow up, and no longer than two years.
Email delivery records are kept for as long as we send email, so that we never send again to an address that bounced or reported our email as spam. They are not part of any one shop’s records, so they are not deleted with a shop’s account; we remove an address when its owner asks us to.
A shop decides how long to keep its customers’ records while its account is active, and can export them at any time.
10. How we protect information
Information travels over encrypted (HTTPS) connections. Passwords are stored only as bcrypt hashes. Authenticator-app secrets for two-step sign-in are encrypted in our database, and sign-in codes, recovery codes and trusted-device tokens are stored only as one-way hashes. Access tokens and passwords for the integrations a shop connects are encrypted in our database. Each shop only sees its own records, users have roles that limit what they can do, and our support staff’s access to a shop is time-limited and logged. No system is perfectly secure; if a breach creates a real risk of significant harm, we will notify the people affected and the Privacy Commissioner as the law requires.
11. Your choices and rights
You may ask to see the personal information we hold about you, ask us to correct it, and withdraw your consent to uses that are not required to provide the service (withdrawing may mean we can no longer provide it). A shop owner can download all of the shop’s records from Settings at any time, and can ask for the account to be deleted.
If you are a customer of a shop that uses GarageEX, please contact that shop: it holds your records and decides how they are used. You can unsubscribe from a shop’s marketing emails with the link in every message, and stop its marketing texts by replying STOP. If email to your address is blocked after a bounce or a spam report and you want to receive it again, ask the shop or our Privacy Officer.
To make a request or a complaint, write to our Privacy Officer at [email protected]. We will answer within 30 days. If you are not satisfied, you can contact the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, where it applies, your provincial privacy commissioner (for example the Commission d’accès à l’information du Québec).
12. Children
GarageEX is a business service and is not directed at children.
13. Changes to this policy
We will post any change on this page with a new effective date. If a change is significant, we will tell account owners before it takes effect, and owners will be asked to review it when they next sign in.
14. Contact
Naddaf Ventures Inc., operating as GarageEX, 70 Beech Street, Ottawa, Ontario K1S 3J6. Privacy Officer: [email protected].
Privacy Policy · version 2026-11-13