Skip to content
ServiceHistory

Draft — not yet in force

This document is still under review and is published here for reference only. It is not a binding agreement, and sections still carrying placeholders are incomplete.

Privacy Notice — ServiceHistory

DRAFT — NOT LEGAL ADVICE. Have counsel review before publishing. This is the notice ServiceHistory publishes about its own processing, where it is the controller: shop employees, platform operators, sales prospects, and website visitors.

It deliberately does not cover repair-shop clients. For those, ServiceHistory is a processor and the shop publishes its own notice — see privacy-notice-office-template.md.

Placeholders in {{ }} must be filled before publication. Last updated: {{DATE}}

Who we are

{{LEGAL ENTITY NAME}} ("ServiceHistory", "we") provides repair-shop management software. We are the controller of the personal data described below.

  • Address: {{REGISTERED ADDRESS}}
  • Privacy contact: {{privacy@yourdomain}}
  • EU/UK representative (Art. 27): {{required once you serve EU customers without an EU establishment — appoint one before EU launch}}

We have not appointed a Data Protection Officer. {{Reassess if you begin large-scale monitoring or process special-category data at scale — Art. 37.}}

What we collect, why, and on what basis

If you work at a shop that uses ServiceHistory

What Why Legal basis
Name, email, role and office assignments To create your account and control what you can access Contract with your employer (Art. 6(1)(b)) and our legitimate interest in operating the service (Art. 6(1)(f))
Password and multi-factor enrolment, held in AWS Cognito To authenticate you and protect the account Legitimate interest in security; legal obligation under Art. 32
Sign-in times, and a record of actions you take in the product To secure the platform and investigate incidents Legitimate interest in security
Support tickets you send us — your email and name, and whatever you write To answer you Legitimate interest in supporting our customers

Your employer decides whether you have an account. If you object to this processing, that is a conversation with your employer as much as with us.

If you are a platform operator

The same as above, plus a full audit record of every administrative action, retained so that cross-tenant access can be reviewed. Multi-factor authentication is mandatory.

If we contacted you about buying ServiceHistory

We hold business contact details — company name, address, phone, email, website, and where a named person is our contact, their name and role — together with notes on our conversations.

  • Legal basis: our legitimate interest in marketing our product to businesses (Art. 6(1)(f)).
  • Where we got it: public business directories, company websites, publicly available listings, or you told us directly. We record the source of every record.
  • Your absolute right to object: if you tell us to stop contacting you, we stop. No balancing test applies to direct marketing (Art. 21(2)). Email {{privacy@yourdomain}} and we will suppress your details from all future outreach.

If you visit our website

Our pages load fonts from Google Fonts and scripts from jsDelivr, and our client portal uses Cloudflare Turnstile to tell humans from bots. Each of those receives your IP address directly from your browser. Our CDN records IP addresses in access logs. {{State your cookie position here once confirmed, and add a consent banner if you set any non-essential cookie or continue loading third-party fonts in the EU.}}

Who we share it with

We do not sell personal data. We share it with the service providers listed in our subprocessors list — principally Amazon Web Services (hosting, identity, email), Zoho (support ticketing), Meta (WhatsApp messaging), and Cloudflare. Each is bound by a data processing agreement. We also disclose data where the law requires it.

Where your data is held

On Amazon Web Services in US East (N. Virginia).

{{If you are in the EEA or the UK, this is a transfer outside your region. Describe the mechanism — Standard Contractual Clauses or the EU-US Data Privacy Framework — once it is executed. This is not yet in place and must be resolved before serving EU customers.}}

How long we keep it

Data Period
Your account, while you work at a customer shop For as long as your employer keeps the account open
Account records after you leave {{DEFINE — currently retained indefinitely}}
Security and audit logs {{DEFINE — 2 years is typical}}
Support tickets {{DEFINE}}
Prospect records {{DEFINE}}, and immediately suppressed on objection
Session tokens 7 days after they expire

Data erased from the live system remains in backups until they rotate out, protected by the same controls throughout.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider in a machine-readable form. Where we rely on consent, you can withdraw it at any time without affecting what we did beforehand.

Write to {{privacy@yourdomain}}. We will answer within one month, and sooner where your local law is stricter. We may need to verify who you are first — we will not release data on an unverified request, because that would itself be a breach.

If you are unhappy with our answer you can complain to your data protection authority. In Portugal that is the CNPD (cnpd.pt); in Brazil the ANPD; in Mexico the INAI; in Puerto Rico the DACO. You can complain without going through us first.

Automated decision-making

We do not make decisions about you by automated means that produce legal or similarly significant effects.

Security

We encrypt data in transit and at rest, hash all credentials, enforce role-based access control and tenant isolation on every request, and require multi-factor authentication for platform operators. No system is perfectly secure; if a breach affects you and the risk is high, we will tell you without undue delay.

Repair-shop clients: not us

If you are a customer of a repair shop that uses our software, the shop — not ServiceHistory — decides what to collect about you and why. Contact the shop directly. If you write to us we will forward you to them rather than act on your request, because acting on it would mean processing outside their instructions.

Changes

We will post material changes here and, where the change is significant, notify our customers directly.