Privacy Policy

1. Information We Collect

1.1 Information You Provide

• Account information: first name, last name, email address, password (hashed — never stored in plaintext), phone number, date of birth, and mailing address.
• Business information (shop operators): business name, business address, tax identification number, years in operation, specialties, and Stripe Connect onboarding data.
• Vehicle information: year, make, model, trim, VIN, license plate, color, and mileage.
• Service information: descriptions of vehicle issues, repair orders, repair items, and service history.
• Communications: messages sent between customers and shops through the in-platform messaging system.
• Reviews and ratings: shop reviews and customer trust scores submitted through the platform.
• Photos: repair photos (before/after) and shop gallery images uploaded by shop operators.

1.2 Information Collected Automatically

• Usage data: pages visited, features used, timestamps, and interaction patterns — used to improve the platform.
• Device information: browser type, operating system, and IP address — used for security and analytics.
• Session tokens: a JSON Web Token (JWT) stored in your browser's localStorage to maintain your session.

1.3 Information from Third Parties

• Stripe: when you connect a Stripe account or pay through the platform, Stripe shares limited payment confirmation data with us (payment status, last 4 digits of card). We never see or store your full payment card details.
• NHTSA: when you add a vehicle by VIN, we query the National Highway Traffic Safety Administration API to decode vehicle information. No personal data is sent to NHTSA.

2. How We Use Your Information

We use the information we collect to:

• Create and manage your account and provide access to the platform
• Connect customers with mechanic shops and facilitate service requests
• Process payments and remit funds to shop operators via Stripe Connect
• Send transactional emails including service status updates, appointment reminders (24 hours and 1 hour before), and invoice notifications
• Send password reset links when requested
• Display your vehicle history and service records to you and, where relevant, to the shop servicing your vehicle
• Calculate and display shop ratings, customer trust scores, and “Top Shop” badges
• Detect and prevent fraudulent activity, unauthorized access, and violations of our Terms of Service
• Improve the platform through analytics and user feedback
• Comply with legal obligations

We do not use your personal information for automated decision-making that produces legal or similarly significant effects without human review.

3. Information Sharing

We share your information only in the following circumstances:

3.1 With Mechanic Shops

When you submit a service request to a shop, we share your name, contact information, vehicle details, and service description with that shop so they can fulfill your request. Shop operators and their approved employees can view this information.

3.2 Service Providers

3.3 Legal Requirements

We may disclose your information if required to do so by law, court order, or governmental authority, or if we believe in good faith that such disclosure is necessary to protect our rights, your safety, or the safety of others.

3.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you by email before your information is transferred and becomes subject to a different privacy policy.

4. Data Retention

We retain your personal information for as long as your account is active and for a reasonable period afterward. Specifically:

• Active accounts: retained indefinitely while the account is active.
• Deleted accounts: personal identifiers are anonymized or deleted within 90 days of an account deletion request. Service records (repair orders, invoices) may be retained in anonymized form for up to 3 years for fraud prevention and legal compliance.
• Payment records: retained for 7 years as required by U.S. tax law.
• Server logs: retained for 30 days and then automatically purged.

5. Your Rights

Depending on your location, you may have the following rights regarding your personal information. California residents should also see Section 6 for CCPA/CPRA-specific rights and how to exercise them.

• Access: request a copy of the personal information we hold about you.
• Correction: request that we correct inaccurate or incomplete information.
• Deletion: request that we delete your personal information (subject to our retention obligations and legal requirements).
• Portability: request your data in a structured, machine-readable format.
• Opt-out of marketing: you may unsubscribe from marketing emails at any time using the unsubscribe link in the email. Transactional emails (service status, invoices, appointment reminders) cannot be disabled while your account is active.

To exercise any of these rights, email us at privacy@usmechanicservices.com with the subject line “Privacy Request”. We will respond within 45 days.

6. California Privacy Rights

California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA)

This section applies to residents of California. If you are a California resident, the CCPA (as amended by CPRA, effective January 1, 2023) gives you specific rights regarding your personal information. This section describes those rights and how to exercise them.

6.1 Categories of Personal Information We Collect

In the preceding 12 months, we have collected the following categories of personal information as defined under CCPA:

6.2 Sensitive Personal Information

Under CPRA, certain categories of personal information are designated as “sensitive.” We collect the following sensitive personal information:

• Date of birth — collected at registration to verify that users meet the minimum age requirement (18+). Stored on your account.
• Financial account information — payment card details and bank account information are collected and processed directly by Stripe on our behalf. We receive only limited payment confirmation data (status, last 4 digits). We do not store full card or bank account numbers.

We use sensitive personal information only for the purposes disclosed in this Privacy Policy. We do not use sensitive personal information to infer characteristics about you beyond what is necessary to provide the platform. You have the right to limit our use and disclosure of sensitive personal information for certain secondary purposes — contact us to exercise this right.

6.3 No Sale or Sharing of Personal Information

This applies to all categories of personal information, including sensitive personal information. USMS earns revenue through shop subscriptions, transaction fees, and advertising sold directly to partners — not through the sale of user data.

6.4 Your CCPA / CPRA Rights

As a California resident, you have the right to:

• Know — request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business purposes for collecting it, and the categories of third parties with whom it is shared.
• Delete — request deletion of personal information we have collected from you, subject to certain exceptions (e.g., information needed to complete a transaction, detect fraud, or comply with a legal obligation).
• Correct — request correction of inaccurate personal information we maintain about you.
• Portability — receive a copy of your personal information in a portable, machine-readable format.
• Limit use of sensitive personal information — request that we restrict our use of your sensitive personal information to what is necessary to provide the services you requested.
• Non-discrimination — we will not deny you services, charge you different prices, or provide a different level of service because you exercised any of your CCPA/CPRA rights.

6.5 How to Submit a Verifiable Consumer Request

To exercise any of the rights described above, submit a Verifiable Consumer Request by emailing:

Identity verification

To protect your privacy and security, we must verify your identity before processing a deletion or access request. We will verify your identity by confirming details that match the information associated with your account (such as your registered email address). We may ask for additional verification if the request involves sensitive information or if we cannot verify your identity from the information provided.

Authorized agents

You may designate an authorized agent to submit a request on your behalf. The agent must provide written authorization signed by you, and we may verify your identity directly to confirm the agent's authority. Contact us at the email above to initiate an agent-submitted request.

Response timeline

We will acknowledge receipt of your request within 10 business days and respond substantively within 45 days. If we require additional time (up to another 45 days), we will notify you in writing before the initial 45-day period expires, along with the reason for the extension.

6.6 Shine the Light (Cal. Civ. Code § 1798.83)

California residents may request, once per calendar year, information about personal information we have shared with third parties for their own direct marketing purposes during the preceding calendar year. USMS does not share personal information with third parties for direct marketing purposes. Therefore, no disclosure under § 1798.83 is required.

7. Security

We implement industry-standard technical and organizational measures to protect your personal information, including:

• Passwords are hashed using bcrypt before storage — we never store plaintext passwords
• All data in transit is encrypted via TLS/SSL (HTTPS)
• JWT session tokens are signed and expire after a set period
• Database access is restricted to the application server

No security system is impenetrable. If you believe your account has been compromised, please contact us immediately at support@usmechanicservices.com.

8. Children's Privacy

The USMS platform is not directed at individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal information from a minor, we will delete it promptly. If you believe we may have information about a minor, please contact us at privacy@usmechanicservices.com.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by email at least 14 days before the new policy takes effect. The “Last updated” date at the top of this page indicates when the policy was last revised.

10. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy, contact us at: