Privacy

Almost everything below depends on this distinction, so it comes first.

The shop is our customer. We decide how we handle a shop's own account information — who works there, what they are paid, what the shop pays us.

The shop's customers are the shop's. When a vehicle owner's name, phone number and repair history sit in this system, they are there because a shop put them there. That shop decides what is collected, what it is used for and how long it is kept. We hold it on the shop's behalf and act on the shop's instructions. If you are a vehicle owner with a question about your own record, the shop that served you is the right place to start, and we will help them answer it.

About the shop

Shop name, shop code, address and time zone. Each person's name, sign-in name and role. PINs, stored only as a one-way hash — we cannot read them and cannot tell you what yours is. Optionally an hourly wage, and an email address or phone number if that person wants the weekly report.

About the shop's customers

Whatever the shop enters to do the work, or the customer enters on the shop's booking page: name, phone, email, their vehicles and VINs, mileage, what they said was wrong, what was done, photographs, what they were charged and what they paid, and their typed name approving the work. We record when you open an estimate, invoice or receipt link, and when an email from the shop is opened, so the shop knows you've seen it.

What the system records by itself

Who moved a job, who took a payment, who sealed a record, and when. That trail is the point of the product — a repair record that cannot say who did the work is worth much less — so it is not optional and it is not editable.

The software records each time someone at the shop opens a job: who opened it, which job, and when. The shop's staff can see it on the job's history, and the owner in the Audit trail. It is kept with the job and removed with it.

When the card processor tells us about a payment, a refund or a change of plan, we keep its message exactly as the processor signed it, so that what was recorded can be checked against what was sent. A message can name a card's brand and last four digits, and the payer's name, email and billing address as the processor holds them; it never holds a full card number. We keep the message for 30 days and then erase it; the payment it led to stays on the job.

The shop's own activity log

Separately from the audit below, the software can keep a shop's record of what its own people changed: draft edits before a repair is sealed, a price set by hand over the shop's rates, what a part cost when it was entered, a deleted job, sign-ins, and a sign-in lock-out. Each line names the person who did it. It holds no customer name, phone, email, VIN or plate, no free text a customer or a technician typed, and no internet address or device. Lines are kept 400 days and then deleted. This is not switched on today, and nothing has ever been recorded to it. If that changes, this notice will say so, and shops will be told before it starts.

What the system records when you act

When you do something controlled by the shop's rules — taking a payment, approving a refund, sealing a repair, changing someone's hours, or adding or removing a person — the system writes a line saying who did it, the role they were signed in as, what they were allowed to do, which record the action concerned, and when it happened.

It does not keep what you typed. The details of the action are stored as a fingerprint: a short code calculated from those details. The original details are not stored in the audit record. The fingerprint is there so the same action can be recognized, not so the details can be read back.

That line identifies you and records what you did, and the shop's owner can read it. Nobody can edit or alter the line after it is written, including us. When its retention period ends, the line is deleted. This record is separate from the shop's activity log above.

We keep these lines for seven years, in line with the shop's applicable record-retention period for the records they support. This is longer than the activity log above because these lines provide an audit trail for actions involving records that may be retained longer. When the retention period ends, they are deleted.

Sign-in

One cookie, scarab_session. It is HTTP-only, secure, same-site, and expires after twelve hours. It exists to keep you signed in and does nothing else. There are no advertising cookies and nothing follows anybody between websites.

We do count page views, across the marketing pages and the application alike, using Vercel's analytics. It sets no cookie. It records the shape of a route — /workorders/[id] — and never the address actually visited, so no job, customer or vehicle identifier ever reaches it.

The complete list. Each one receives only what it needs to do its job. Two are always there; the rest are reached only when something specific happens or the shop switches them on.

Always

Vercel — hosting, photograph storage, and counting page views. The application runs here.

Neon — the database itself. Every customer, vehicle, repair and invoice above is stored on it.

When something specific happens

The NHTSA — a public source, sent only a vehicle's VIN, make, model and year and nothing else: when a vehicle is decoded, to read its year, make, model and engine, and when a vehicle's page or a job is opened, to read its specifications and to list the safety recalls and count the complaints NHTSA holds for its year, make and model. A United States government service. Nothing about the customer or the shop is sent with it.

Resend — an email address and the message sent to it, whenever the software sends email: a sign-in or setup link, an invitation, a PIN reset code, a notice that an email address changed, a weekly report to an owner, or what somebody types into the quote form, sent to our own inbox.

Stripe — when a shop buys or changes a plan: the owner's email address, the plan and a purchase reference. The card is typed on Stripe's own page and never reaches Scarab OS.

Google — only for a person who chooses Continue with Google: Google tells us that person's name and email address, and Google knows they signed in here. Nothing about the shop's customers or jobs goes to Google.

Only if the shop switches it on

Twilio — the phone number, the message and its content, as any text message needs to reach a carrier. Only once texting or call handling is switched on for the shop.

Intuit (QuickBooks) — the invoice: customer name, line items and totals, pushed one job at a time, by hand. Only if the shop connects QuickBooks.

CarKnown — the vehicle's permanent record, described below. Never prices, costs, vendors, or anything identifying the customer. Only once the shop is verified and has accepted the publishing terms.

OpenTimestamps — one fingerprint and nothing else: no names, no records, no numbers. Only when a shop publishes its chain's fingerprint.

PartsTech — only if someone at the shop opens the PartsTech panel and signs in there with the shop's own PartsTech account. That browser talks to PartsTech directly; Scarab OS sends PartsTech nothing.

Anthropic (the Claude model) — only for what a shop switches on, and only the words the answer needs. For the phone assistant: what a caller says during the call and what the assistant has already said back, with the shop's hours, address, services, published prices and how busy it is; once a caller has been told their own car's stage, that sentence and the plate characters they gave are part of the call it reads next. For Scarab Agent (Agent Assist): the job a person asks about (the vehicle's year, make and model, the concern, the technician's note, the job's lines, with prices only for a person allowed to see them, and its stage) and what they typed, and for the owner's week, the week's totals. For support reply drafts: the text of the shop's support ticket, with our help manual, drafted for a person at Scarab to edit before anything is sent. Never the caller's number, and never a card number or bank details. Anthropic's commercial terms say: "Anthropic may not train models on Customer Content from Services."

If the shop switches on its phone assistant, it can tell you the status of your own car when you call from the number on your record and give the last four characters of the car's plate (or of its VIN, when the shop has no plate for it). It says the stage in plain words and nothing else: no prices and nothing about anyone else.

Stripe, when a card is taken on a phone — only if the shop takes a card by Tap to Pay in the Scarab OS app: the phone's location at that moment goes to Stripe, which needs to know where a card is taken to prevent fraud. The app asks for the location only then, never in the background, and Scarab OS does not keep it.

We do not sell anything, to anyone, ever. There is no advertising business here and no data broker on that list. We are paid by shops for software.

We do measure how many people visit the public pages, using page patterns rather than addresses — we can see that /workorders/[id] was visited, never which job. Shop and customer identifiers do not leave the application.

When a repair is sealed and the shop is publishing, this is exactly what crosses to CarKnown, and it is checked by an automated test so it cannot drift:

What crosses

The VIN. The work that was done and the parts fitted. The date. The odometer reading, in miles, kilometres or engine hours as the vehicle counts them, and the unit it was read in. The shop's name. A score for how well documented the repair is.

What never crosses

Nothing about the customer — not their name, phone, email or address. And no money at all: not what was charged, not what the parts cost the shop, not which vendor supplied them.

Any customer can refuse. Tell the shop, or use the link to your own records, and nothing further about your vehicles is published. Ask before the repair is published and nothing about it is published at all.

A shop can text you only if you agree. You can agree by ticking the box on the shop's booking page, by saying yes when the shop asks you at the counter or on the phone, or by ticking the texting sentence on an estimate you approve. The shop records your answer with the date, the number and the words you were given; the device's internet address, when you agree on a web page; and, when a person asked you, who asked, whether it was in person or by phone, and what you said.

Texts come from the shop's own number and are only about your booking and your repair. Most are written by a person at the shop. Two are sent by the system if the shop has turned them on: a reminder about an estimate you have not answered, and a note that parts are running late. We never send marketing texts.

How often: it depends on your repair. Message frequency varies. Message and data rates may apply; that is whatever your mobile carrier charges. Reply STOP at any time and the shop cannot text that number again through this system until you reply START. Reply HELP to be told who the shop is and how to reach a person.

We do not share, sell or rent your mobile number, or the fact that you agreed to be texted, to any third party or affiliate for marketing or promotional purposes. The only outside companies that handle a text are the ones needed to deliver it, our messaging provider (Twilio) and the mobile carriers.

Most software promises to delete anything on request. We cannot, and it would be dishonest to say otherwise, so here is exactly where the limit is and why it exists.

Nobody can change a sealed repair without it showing

Not the shop's staff, not the shop's owner, and not us. That is the entire value of the record: a history that could be quietly edited later would prove nothing to a future owner, another garage, or a court. A change made to a sealed record by any means shows, because its fingerprint and signature stop matching. If something in it is wrong, a correction is sealed as its own record and the original stays.

That is a promise about alteration, and the record's existence is fixed with it. A shop can clear its own records, and the sealed repair records stay, and stay verifiable. No shop can remove one, and neither can we, except in response to a legal demand. Clearing leaves the ledger entry recording that it happened, and does not recall anything already published to a vehicle's record.

Photographs in a sealed repair go with it

Their fingerprints are locked inside the sealed record, which is what proves the pictures are the ones taken at the time. Deleting the file would break the proof, so sealed photographs stay, except in response to a legal demand. Photographs on a job that has not been sealed can still be removed.

A published timestamp cannot be withdrawn

When a shop timestamps its records, one fingerprint is written into a public blockchain. It is a hash and nothing else — no names, no numbers, nothing that can be turned back into a person. But it is permanent, and neither we nor the shop can remove it.

Everything else is the shop's to correct or remove

A shop can correct or remove what it holds about its customers and its jobs, and its own account with them. That right is real and nothing above narrows it.

The limits above come from sealing: a sealed record and its photographs can be removed only in response to a legal demand, and a published timestamp cannot be removed at all. Two more come from the shop's books. A ledger entry cannot be changed: we have built no way to do it, and the database itself refuses the change, whoever is connected. The ledger is removed only in response to a legal demand — it is what makes a shop's own figures checkable. A recorded payment is never edited either: a mistake is voided and entered again, the ledger keeps both, and a void cannot be undone. Everything else can be removed — some of it by the shop itself, and some of it only by asking us, which is a request we act on rather than a button you press. Which button clears what is a question about the product and not about your rights, so it is answered where it can be kept current rather than here.

See what is held

A shop can hand any customer a private link to their own records — their vehicles, the work done, warranties and what is coming up. No password and no account.

Correct it

From that same link a customer can fix their own name, phone, email and preferences, and what they enter is what the shop's counter sees.

Have it deleted

Ask the shop. Everything except sealed repairs and the shop's ledger can be removed, and a shop can clear its records itself. Where a sealed repair or a ledger entry has to stay, we will say so plainly rather than pretend it is gone.

Stop the publishing

Refuse at the counter or from your own link, and no further work on your vehicles goes onto the permanent record.

Depending on where you live you may also have the right to a copy of your data in a portable form, to object to certain processing, or to complain to a regulator. Ask the shop, or write to us and we will help them.

PINs are hashed, never stored in a form anybody can read. Sign-in is rate-limited and a name locks after repeated wrong guesses. A shop's data is reachable only by people signed in to that shop, and what each role can see is enforced on the server rather than hidden in the interface — technicians never see costs or margins, and customers never see either.

Links to a customer's own records are private, revocable, excluded from search engines, and stop working the moment a shop revokes them.

This is software for businesses. It is not directed at children and we do not knowingly collect anything from them.

If this policy changes in a way that affects what happens to your information, shops are told before it takes effect rather than after. The date at the top moves when the substance moves, not when the wording is tidied.

Scarab OS is operated by BellaMadison Co. LLC. Questions about this policy, or a request about your own information: privacy@scarab-os.tech.