Privacy Notice — ServiceHistory
DRAFT — NOT LEGAL ADVICE. Have counsel review before publishing. This is the notice ServiceHistory publishes about its own processing, where it is the controller: shop employees, platform operators, sales prospects, and website visitors.
It deliberately does not cover repair-shop clients. For those, ServiceHistory is a processor and the shop publishes its own notice — see
privacy-notice-office-template.md.Placeholders in
{{ }}must be filled before publication. Last updated: {{DATE}}
Who we are
{{LEGAL ENTITY NAME}} ("ServiceHistory", "we") provides repair-shop management software. We are the controller of the personal data described below.
- Address: {{REGISTERED ADDRESS}}
- Privacy contact: {{privacy@yourdomain}}
- EU/UK representative (Art. 27): {{required once you serve EU customers without an EU establishment — appoint one before EU launch}}
We have not appointed a Data Protection Officer. {{Reassess if you begin large-scale monitoring or process special-category data at scale — Art. 37.}}
What we collect, why, and on what basis
If you work at a shop that uses ServiceHistory
| What | Why | Legal basis |
|---|---|---|
| Name, email, role and office assignments | To create your account and control what you can access | Contract with your employer (Art. 6(1)(b)) and our legitimate interest in operating the service (Art. 6(1)(f)) |
| Password and multi-factor enrolment, held in AWS Cognito | To authenticate you and protect the account | Legitimate interest in security; legal obligation under Art. 32 |
| Sign-in times, and a record of actions you take in the product | To secure the platform and investigate incidents | Legitimate interest in security |
| Support tickets you send us — your email and name, and whatever you write | To answer you | Legitimate interest in supporting our customers |
Your employer decides whether you have an account. If you object to this processing, that is a conversation with your employer as much as with us.
If you are a platform operator
The same as above, plus a full audit record of every administrative action, retained so that cross-tenant access can be reviewed. Multi-factor authentication is mandatory.
If we contacted you about buying ServiceHistory
We hold business contact details — company name, address, phone, email, website, and where a named person is our contact, their name and role — together with notes on our conversations.
- Legal basis: our legitimate interest in marketing our product to businesses (Art. 6(1)(f)).
- Where we got it: public business directories, company websites, publicly available listings, or you told us directly. We record the source of every record.
- Your absolute right to object: if you tell us to stop contacting you, we stop. No balancing test applies to direct marketing (Art. 21(2)). Email {{privacy@yourdomain}} and we will suppress your details from all future outreach.
If you visit our website
Our pages load fonts from Google Fonts and scripts from jsDelivr, and our client portal uses Cloudflare Turnstile to tell humans from bots. Each of those receives your IP address directly from your browser. Our CDN records IP addresses in access logs. {{State your cookie position here once confirmed, and add a consent banner if you set any non-essential cookie or continue loading third-party fonts in the EU.}}
Who we share it with
We do not sell personal data. We share it with the service providers listed in our subprocessors list — principally Amazon Web Services (hosting, identity, email), Zoho (support ticketing), Meta (WhatsApp messaging), and Cloudflare. Each is bound by a data processing agreement. We also disclose data where the law requires it.
Where your data is held
On Amazon Web Services in US East (N. Virginia).
{{If you are in the EEA or the UK, this is a transfer outside your region. Describe the mechanism — Standard Contractual Clauses or the EU-US Data Privacy Framework — once it is executed. This is not yet in place and must be resolved before serving EU customers.}}
How long we keep it
| Data | Period |
|---|---|
| Your account, while you work at a customer shop | For as long as your employer keeps the account open |
| Account records after you leave | {{DEFINE — currently retained indefinitely}} |
| Security and audit logs | {{DEFINE — 2 years is typical}} |
| Support tickets | {{DEFINE}} |
| Prospect records | {{DEFINE}}, and immediately suppressed on objection |
| Session tokens | 7 days after they expire |
Data erased from the live system remains in backups until they rotate out, protected by the same controls throughout.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider in a machine-readable form. Where we rely on consent, you can withdraw it at any time without affecting what we did beforehand.
Write to {{privacy@yourdomain}}. We will answer within one month, and sooner where your local law is stricter. We may need to verify who you are first — we will not release data on an unverified request, because that would itself be a breach.
If you are unhappy with our answer you can complain to your data protection authority. In Portugal
that is the CNPD (cnpd.pt); in Brazil the ANPD; in Mexico the INAI; in Puerto Rico
the DACO. You can complain without going through us first.
Automated decision-making
We do not make decisions about you by automated means that produce legal or similarly significant effects.
Security
We encrypt data in transit and at rest, hash all credentials, enforce role-based access control and tenant isolation on every request, and require multi-factor authentication for platform operators. No system is perfectly secure; if a breach affects you and the risk is high, we will tell you without undue delay.
Repair-shop clients: not us
If you are a customer of a repair shop that uses our software, the shop — not ServiceHistory — decides what to collect about you and why. Contact the shop directly. If you write to us we will forward you to them rather than act on your request, because acting on it would mean processing outside their instructions.
Changes
We will post material changes here and, where the change is significant, notify our customers directly.