Privacy Policy

This policy explains how GarageActive handles personal data, who is responsible for it, and what your rights are. It is in two parts, because GarageActive holds two kinds of personal data.

• If you have a GarageActive account, contact us, or visit our website, we are the controller of your personal data, and the first part of this policy is about you.
• If you are a customer of a garage that uses GarageActive, the garage is the controller of your personal data and we process it on the garage's behalf. The second part, "If you are a garage's customer", explains what that means and where to take a request.

Who we are

GarageActive is provided by Hypertonic Games Ltd, trading as Hypertonic Studios, a private limited company registered in England and Wales under company number 13066392. Our registered office is Unit 3a Narberth Bridge Business Park, Narberth, Wales, SA67 8RA. We are registered with the Information Commissioner's Office as a data controller, under registration number ZC257531.

You can reach us about anything in this policy at support@garageactive.com. Our full company details are on our Legal page, and the contract that governs the service is our Terms and Conditions.

The data we hold about you

Your account. Your first name and surname, your email address, your password (stored as a one-way hash we cannot reverse), your two-factor authentication secret if you turn two-factor on, your profile photo if you add one, the version of the terms you accepted and when, and whether you chose to receive product news.

Your garage. If you create or manage a garage: its name, web address, postal address, phone number, VAT number, logo, number of bays, labour rate, opening hours and settings. If you are a sole trader, some of these are personal data about you.

Your team memberships. For each garage you belong to: your name, email address, role, status, and your photo, whether you uploaded it or a manager did. If you were invited, the invitation and its expiry.

Your work inside a garage. GarageActive keeps an activity history of what is done in each garage and who did it: jobs booked and changed, invoices issued, customers added or edited, photos uploaded, reminders sent, and so on. Every active member of the garage can see it. The garage is the controller of that history, and we hold it on the garage's behalf as the second part of this policy describes.

Billing. If your garage pays for a plan: the plan, the dates it runs, and the identifiers of the garage's customer and subscription records at Stripe, our payment provider. Stripe collects the card details and billing email address at checkout and holds them itself. We never see or store card numbers.

Support and enquiries. The emails you send to support@garageactive.com and our replies. If you use the "Request a call" form on our Enterprise page: your garage's name, your email address, your website and phone number if you give them, and what you tell us you need. Enquiries are emailed to us and kept in our mailbox. They are not stored in the app.

Technical data. When you use GarageActive, our hosting providers record the IP address, browser and time of each request in server logs, which are kept for a short period. If something goes wrong, an error report is sent to our error-reporting service with the page, the error, your account's internal identifier and the garage's identifier. It never includes your name, your email address or your IP address. Our website analytics are cookieless and are described under "Cookies and similar technologies".

Emails we send you. A confirmation when you sign up, password reset links, team invitations, a security notice whenever your password or two-factor settings change or your account is deleted, a notice each time an export of your garage's records is downloaded, and a notice when your garage is closed. These are part of running the service and you cannot opt out of them. Our email provider keeps a delivery log for a short period. If you ticked the box for product news, we may also email you about GarageActive. You can change that choice at any time by emailing support@garageactive.com.

Why we use it, and the legal basis

• To provide GarageActive to you and your garage, including signing you in, running your garage, and sending the emails the service needs to send: performance of our contract with you.
• To take payment and keep accounting records: performance of the contract, and our legal obligation to keep business records.
• To keep the service secure, to detect and stop abuse, and to investigate problems and incidents: our legitimate interest in running a secure service, and our legal obligations under data protection law.
• To answer your support requests and enquiries: our legitimate interest in responding to you, and, for an enquiry, taking steps at your request before a contract.
• To understand how GarageActive is used and improve it, through cookieless analytics and error reports: our legitimate interest in improving the service.
• To produce anonymised statistics, as the next section describes: our legitimate interest, and the anonymised results are no longer personal data.
• To send you product news, if you asked for it: your consent, which you can withdraw at any time.
• To comply with the law, respond to lawful requests from authorities, and establish, exercise or defend legal claims: our legal obligations and our legitimate interests.

Where we rely on legitimate interests we have considered the effect on you and concluded that it is limited. You can object to any processing based on legitimate interests, as "Your rights" explains.

Anonymised statistics

We may create anonymised, aggregated statistics from the use of GarageActive and from the data held in it, about how garages and workshops run and how the service is used. Your use of features may contribute to those statistics. They never identify you, your garage, any customer or any vehicle, and no name, email address, phone number, address, registration number, invoice, note, photo or video is ever included. We combine data across many garages and never publish or share a figure about a single garage. We own the resulting statistics and may use them for any purpose, including publishing industry benchmarks and licensing or selling them to third parties. Section 7 of the Terms and Conditions sets this out in full.

Who we share it with

We use the following providers to run GarageActive. Each processes personal data on our instructions under a data processing agreement, and each is bound to the same obligations we give you.

• Supabase provides our database, sign-in service and file storage. Data is hosted in London, in the United Kingdom. Supabase is a US company.
• Vercel hosts the application, runs our scheduled jobs, and provides our cookieless web analytics and page-speed measurements. Our application runs in London. Vercel delivers the site's static files through a worldwide network. Vercel is a US company.
• Cloudflare stores inspection photos in its European Union jurisdiction and provides cookieless web analytics and network services. Cloudflare is a US company.
• Bunny.net hosts and streams inspection videos, in the European Union. Bunny.net is a Slovenian company.
• Resend sends every email we send, including the emails garages send through us, from its European Union region. Resend is a US company.
• PureSMS sends the text messages garages send through us, including the garage's sender name, processes them only in the European Union, and keeps each message for three months. PureSMS is run by Divergent UK Operations Ltd, a UK company.
• Sentry receives our error reports, in its European Union region, and keeps them for 30 days. Sentry is a US company.
• Stripe processes payments and subscriptions. Stripe is a controller in its own right for the payment itself, including fraud prevention and its own legal obligations, and its privacy policy applies to what it holds. Stripe processes data in the United States as well as in Europe.
• Microsoft hosts our email through Microsoft 365, including the support@garageactive.com mailbox where your support emails and enquiries are kept. The mailbox is held in the United Kingdom. Microsoft is a US company.

We also share data with:

• The DVLA and the DVSA. When a garage looks a vehicle up, we send the vehicle's registration number to the DVSA's MOT history service, and where enabled the DVLA's vehicle enquiry service, both in the United Kingdom. We receive vehicle details back.
• Mobile networks. When a garage sends a text, the recipient's phone number and the message pass to the mobile networks that carry it. Each network acts as a controller in its own right under the law on electronic communications, as it does for any text message, and routes the message under its own rules.
• Professional advisers, insurers and auditors, where needed to run the business, obtain advice or deal with a claim.
• Regulators, law enforcement and courts, where the law requires it or allows it, including the Information Commissioner's Office.
• A buyer or successor of the business, if GarageActive is sold or transferred. We would tell you before your data was transferred.

We will email the owner of every garage at least 30 days before we add or replace a provider that processes garage data.

Where your data is stored, and transfers

Your data is stored and processed in the United Kingdom and the European Economic Area. Transfers to the European Economic Area rely on the UK's adequacy regulations. A text message is the exception in one respect: once it leaves our text message provider, the mobile networks route it under their own rules, as they do for every text.

Several of our providers are US companies, and their staff may access data from outside the United Kingdom to support their services. Stripe processes payment data in the United States. Each of those transfers relies on the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, or otherwise on the Information Commissioner's International Data Transfer Addendum to the EU standard contractual clauses. You can ask us for more information about the safeguards for any transfer.

How long we keep it

• Your account: for as long as it exists. What happens when you delete it is described under "Deleting your account".
• Your name and actions in a garage's records: for as long as the garage is open, then on the schedule the garage has instructed us to follow: contact details are removed 30 days after the garage closes, and names, jobs and invoices are kept for seven years after closing and then deleted. The second part of this policy and section 12 of the Terms and Conditions describe that schedule.
• Billing records: seven years after the transaction, which covers our own duty to keep accounting records.
• Support emails and enquiries: while we deal with them, and for up to two years after our last message, so we can pick up the conversation if you come back.
• Server logs: up to 30 days at our hosting provider, and up to seven days for sign-in logs at our database provider.
• Error reports: 30 days.
• Analytics: we only ever see aggregated figures, and nothing about you individually is kept.
• Records of consent: the record of the terms you accepted and your product news choice are kept after your account is deleted, linked only to the account's internal identifier, for as long as we may need to show what you agreed to.
• Backups: our database is backed up daily and each backup is kept for seven days, so data you delete can remain in a backup for up to seven days afterwards.

Deleting your account

You can delete your account from Settings at any time. You will be asked to type your sign-in email address exactly and enter your password. If you own a garage that is open, you must close it first, because an open garage with no owner could never be closed, exported or reopened.

Deleting your account removes your email address, password, two-factor settings, sessions and the name held by our sign-in service, your photo and email address from every garage you belong to, your notifications, and your active memberships, which are deactivated. We email you to confirm it, so that you would know if someone else did it.

Some things are kept, for the reasons given:

• Your name in each garage's records. The jobs you booked, the invoices you issued and the notes you wrote belong to the garage, and the garage needs to know who did the work. Your name stays on them for as long as the garage keeps those records, which is seven years after the garage closes.
• Your account's internal identifier. The sign-in record is retained with your email address and phone number replaced by an irreversible hash, so that the garage's records keep their attribution. Nobody can sign in with it, and your email address is free to be used for a new account.
• Your consent records, as described under "How long we keep it".
• Copies held by our providers for a short period: sign-in logs, the email delivery log, and, if your garage paid for a plan, the billing details Stripe holds under its own policy.

If every garage you belong to is closed and passes its 30-day reopen window, your account is deleted automatically when the last of them is cleared, and we email you to say so.

Your rights

You have the right to ask for a copy of the personal data we hold about you, to have it corrected, to have it deleted, to restrict or object to how we use it, to receive the data you gave us in a portable form, and to withdraw consent where we rely on it. You will not be subject to a decision based solely on automated processing.

Much of this you can do yourself: you can edit your name and photo in Settings, delete your account as described above, and, if you own a garage, download an export of its records. For anything else, email support@garageactive.com. We will reply within one month, and we may ask you to confirm your identity first. There is no charge unless a request is clearly unfounded or excessive.

Where a garage is the controller of your data, we will pass your request to the garage, because the decision is theirs. The second part of this policy explains this.

If you are unhappy with how we have handled your personal data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would welcome the chance to deal with your concern first.

Cookies and similar technologies

We set no advertising cookies and no cross-site tracking cookies, and we do not show a cookie banner, because everything we set is needed to provide something you have asked for.

• The sign-in cookie, named garage-active-auth with a security prefix, keeps you signed in. It is set when you sign in and is sent only to the web address that set it, so the main site and each garage's web address hold their own copies. Each copy lasts 30 days from the last time you used GarageActive at that address, and after that you are asked to sign in again. Signing out removes it from that device.
• A sidebar preference cookie, named sidebar_state, remembers whether you collapsed the sidebar. It is set only when you change it and lasts seven days.
• An unsubscribe result cookie, named mot_unsubscribe_result, is set on the MOT reminder unsubscribe page for five minutes so that the page can show you the result.
• Browser storage. Your light or dark mode and colour theme choices are kept in your browser's local storage on the device where you set them. They are never sent to us.
• Stripe. During checkout, Stripe's own scripts may set Stripe's cookies for fraud prevention and to make the payment work. Stripe's cookie policy describes them.

Our website analytics do not use cookies or any other identifier stored on your device. Vercel Web Analytics and Vercel Speed Insights receive the address of the page you viewed, with every identifier such as a job number or link token replaced by a placeholder, and technical details of your browser, device and connection. Vercel derives a visitor count from your IP address and browser in a form that changes every day and does not store your IP address. Cloudflare Web Analytics receives the same scrubbed page address and technical details and does not build a profile of you. We only ever see aggregated figures from either.

Security

Data is encrypted in transit. Database records, inspection photos and backups are encrypted at rest. Each garage's data is isolated from every other garage's by access rules enforced inside the database itself, and a person can reach a garage's data only through an active membership of that garage. Passwords are stored as one-way hashes, two-factor authentication is available to every account, and unusual sign-in activity triggers alerts to us and a notice to you. Profile photos and garage logos are stored at addresses that can be opened without signing in, so that they can be shown on pages and in emails; the addresses are not listed or published anywhere.

If a personal data breach affects your data, we will report it to the Information Commissioner's Office within 72 hours where the law requires, tell you without undue delay where the breach is likely to put you at high risk, and tell the owner of any affected garage within 48 hours of becoming aware of it.

Children

GarageActive is a business service for people aged 18 and over. We do not knowingly hold data about anyone under 18, other than as a garage's customer records may contain it.

Changes to this policy

The date at the top of this page is when it was last updated. If we make a material change we will email every account holder before it takes effect. Adding a provider that processes garage data is notified to garage owners 30 days in advance, as described above.

If you are a garage's customer

If you have your vehicle serviced, repaired or inspected by a garage that uses GarageActive, the garage is the controller of your personal data. GarageActive is the software the garage uses to keep its records, and we process your data only on the garage's instructions, under a written contract. Please contact the garage with any question or request about your data. We will help the garage answer it, and if you contact us directly we will pass your request to the garage, because the decision is theirs.

What the garage keeps about you in GarageActive. Your name, email address, phone number and postal address; any notes the garage writes on your customer record, such as when you prefer to drop your car off; your vehicle's registration number and the details we obtain about it from the DVSA, such as its make, model and MOT dates; your bookings, the work done, and any job notes; your invoices; photos and videos of your vehicle taken during an inspection; whether you have agreed to receive MOT reminders by email and by text; and a record of the emails and texts sent to you.

Emails you receive. GarageActive sends some emails on the garage's behalf, in the garage's name, from our sending domain: a booking confirmation when a job is booked, an invoice, a link to an inspection report, and MOT reminders. MOT reminders are sent only if the garage has recorded that you agreed to them. Every reminder carries an unsubscribe link, and your email program may also offer a one-click unsubscribe. Either one sets your choice for that garage to declined and stops further reminders from it. The unsubscribe page sets a cookie for five minutes to show you the result.

Texts you receive. A garage can also send MOT reminders by text, under its own sender name, but only if it has recorded that you agreed to receive them by text, which is a separate choice from email. Every text carries an opt-out link, which sets your text choice for that garage to declined and stops further texts from it, without changing your email choice. Texts are sent through PureSMS, which keeps each message for three months, and are carried by the mobile networks. If a text cannot be delivered, the garage is told, so that it can check your number.

Inspection links. A link to an inspection report works for 30 days from when it was sent, and anyone who has the link can open it, so treat it like any other private link. The page shows the photos and videos of your vehicle, and nothing else about you.

Vehicle lookups. When a garage looks up your vehicle, we send its registration number to the DVSA's MOT history service and store what comes back. Vehicle details are stored once per vehicle and reused when any garage looks up the same vehicle, so that we do not ask the DVSA repeatedly. No garage can see another garage's customers, bookings, invoices or notes.

When a garage closes. Thirty days after a garage closes, your email address, phone number, postal address and any notes about you are removed from its customer record, along with your MOT reminder choices, and its photos and videos are deleted. Your name, your vehicle's registration number, the jobs the garage did and the invoices it issued, including the name and address printed on each one, are kept for seven years after closing on the garage's instruction, so that the garage can meet its own record-keeping duties, and are then deleted. The garage remains responsible for your data throughout. If you cannot reach a closed garage, email us at support@garageactive.com and we will do what we can within our role.

What we do not do. We never use your data for our own purposes, other than to keep the service secure, to comply with the law, and to produce anonymised statistics as described above, which the garage has instructed us to produce and which never identify you. We never contact you about the garage or its closure, and we never send you marketing.

Your rights. Your rights of access, correction, deletion, restriction, portability and objection are exercised against the garage. You can also complain to the Information Commissioner's Office at ico.org.uk.

Contact

Email support@garageactive.com about anything in this policy. Our postal address is Unit 3a Narberth Bridge Business Park, Narberth, Wales, SA67 8RA.