Information we collect
Clerk manages sign-in and provides an account identifier, verified email address and, when available, name. If you choose Google or Apple sign-in when offered, that provider supplies identity information to Clerk. We associate your verified account with your vehicles and service records.
You may provide your name, email, mobile number, SMS preference, vehicle year, make, model, trim and VIN; service requests, appointment preferences, notes, photos and support messages; and an address, city and ZIP code for requested delivery.
We keep job details, estimate versions and responses, authorization and status history, invoices, and payment records. Customer terms signing records include your typed name, account identity, signing time, consent choices, the terms version and text, and the job and estimate context. Shop staff may add updates and progress photos. Payment records include transaction and order identifiers, amounts, currency, payment status, refund totals and timestamps.
You may submit a guest service inquiry without creating an account. We store the contact, vehicle, selected services and request details you submit so authorized shop staff can review them. An inquiry reference does not provide access to account or payment records. Unsubmitted guest drafts stay in page memory and are lost when the page is refreshed. Short-lived request counters help limit abuse.
Hosting, sign-in and checkout providers may process technical information such as IP addresses, browser or device information, logs and cookies in operating their services. Their notices explain their practices.
How information is used
We use this information to sign you in, manage vehicles and service requests, prepare estimates and invoices, coordinate services and requested delivery, provide support and progress updates, and reconcile payments. Account and activity records also support access controls and troubleshooting.
The portal provides in-app updates. Transactional email through Resend and consented SMS through Twilio are sent only when the shop enables and configures those services. These providers process the recipient address or number, notification content and delivery events. Saving a number or preference does not mean a message was sent or delivered. SMS consent is optional and does not authorize marketing.
Who handles portal information
Authorized shop staff use information needed for service and support. Cloudflare provides website hosting through Workers, database storage through D1, and uploaded-photo storage through R2. Clerk processes account and session information for authentication. Google and Apple process information when you choose their available sign-in options; their notices and applicable permissions also apply.
Square-hosted checkout is offered only when the shop has connected its account, verified the destination payment configuration and explicitly enabled collection. When available and you choose to pay, we send a job reference and the deposit or balance amount to Square and receive transaction information for our records. Enter card details only on the Square checkout page. Our portal has no full-card entry form and does not store full card numbers or card security codes in its payment records.
If you choose the optional AI-assistance checkbox for a support message, up to six recent customer messages in that thread are sent to OpenAI to select relevant service information. Messages may contain information you type; avoid sensitive personal information, passwords or payment details. Staff-only replies, photos and complete job records are not included. Automated email/phone redaction is limited and cannot guarantee removal of all personal information. Without consent or available configuration, your message stays in the portal for staff support. AI cannot authorize repairs, change a quote or verify a payment.
Square payment processing is separate from optional Buyer Features such as Square Pay. If you choose those features, their separate notice applies.
Google and Apple sign-in
The sign-in page shows the methods configured for this portal. Google and Apple are available only after their setup is complete; a provider named in this policy is not a guarantee that its sign-in option is currently enabled.
Google sign-in uses basic profile and email information through Clerk to authenticate you and associate your account with service records. It does not include access to Gmail, Google Drive or Google Contacts. Apple sign-in uses the identifier, email address and name Apple makes available; if you use Hide My Email, the address may be an Apple relay address. We do not receive your Google or Apple password.
Cookies and privacy signals
Clerk uses cookies and session information needed for authentication. The portal application has no first-party analytics or advertising-pixel integration. Hosting, sign-in and checkout providers may use their own cookies and similar technologies, including practices described in their notices. This statement concerns the portal application, not all activities of the business or those providers.
The portal application does not currently change its behavior in response to Do Not Track (DNT) or Global Privacy Control (GPC) signals. Provider-level choices and signal handling are governed by each provider. You can review their notices and manage available browser or provider privacy controls; blocking some technologies may affect sign-in or checkout.
Retention and access controls
Portal records are retained until deletion is reviewed and carried out manually. There is no automatic deletion schedule. A deletion or account request does not automatically erase service, payment or other records that must be retained under applicable law.
The portal uses account-based access controls, staff permissions and private storage for uploaded photos. Please avoid including unrelated personal information in notes, messages or photos.
Privacy requests and changes
Email mikeli@spiritac.co to ask about your information or request access, correction or deletion. Requests are reviewed manually. We may need to verify your identity before disclosing or changing records, and applicable legal record-retention requirements may limit deletion. You may also contact us about privacy rights available to you under applicable law.
Updates to this policy will be posted here with a revised date. Review this page for the current description of the portal and its providers.