Privacy Policy

Effective / last updated: September 16, 2026

ShopDesk ("ShopDesk", "we", "us") provides shop-management software to independent auto repair shops ("Shops"). This policy explains what personal data we collect, why, and how it's handled — both for the Shop staff who log in directly, and for the Shop's own customers whose information a Shop stores in ShopDesk.

1. Who this applies to

There are two kinds of people whose data passes through ShopDesk:

• Shop users — the owners and staff who create an account and log in.
• Shop customers — the vehicle owners a Shop serves, whose contact and vehicle information a Shop enters into ShopDesk. We process this data on the Shop's behalf, as a service provider — the Shop, not ShopDesk, is responsible for having a lawful basis to collect and share it with us. If you're a vehicle owner with a question about your data, please contact the shop you worked with directly; they control that data and can request changes on your behalf.

2. What we collect

About Shop users (accounts):

• Name, email address, and a securely hashed password (we never store your password in plain text)
• Shop profile info: shop name, address, phone, business email, logo, labor rate, tax rate

About Shop customers (entered by a Shop):

• Name, phone, email, preferred contact method, and free-text notes
• Vehicle details: year/make/model/trim, VIN, license plate and state, mileage, color
• Photos attached to a vehicle or a job (e.g. intake condition, damage, completed work)
• Work order and invoice history: services performed, parts, labor, pricing, payment status

Payment information:

ShopDesk uses Stripe to process subscription payments. We never see or store your full card number — Stripe collects that directly. We do store your subscription status and Stripe customer/subscription IDs so we can keep your account in sync with your billing.

Automatically collected:

• Standard web server logs (IP address, timestamps, requested pages) for security and abuse prevention
• An internal audit log recording account actions (e.g. who updated a record and when), used for accountability and dispute resolution — not shared outside your Shop

3. Why we collect it

• To provide the core service — customer records, vehicle history, work orders, invoices
• To process your subscription payment and manage billing
• To send account-related email: password resets, invoices you generate, service notices
• To secure accounts (rate limiting, lockouts) and maintain an audit trail

4. Who we share it with

We share data only with the service providers ("sub-processors") that run ShopDesk:

• Stripe — payment processing and subscription billing
• Microsoft Azure — hosting, database, file/photo storage, and secrets management (all data resides in Azure's US regions)
• Azure Communication Services — sending transactional email (password resets, invoice delivery)

We do not sell, rent, or share your data with anyone else, and we don't share it across Shops — each Shop's data is isolated from every other Shop's.

5. How we protect it

• Passwords are hashed (never stored in plain text) and never logged
• All traffic is encrypted in transit (HTTPS/TLS)
• Application secrets and API keys are stored in a managed secrets vault, not in source code or the frontend
• Photos are served through time-limited, single-use links rather than being publicly accessible
• Login attempts are rate-limited and lockable to resist brute-force attacks

6. How long we keep it

Records in ShopDesk use "soft delete" — when you delete a customer, vehicle, or job, it's hidden from your account immediately but retained in the database for a period (to protect against accidental deletion and to preserve records needed for invoicing/tax history) before being permanently purged. If you close your Shop's account, we retain your data for a limited period in case you wish to reactivate, then delete it.

7. Your rights and choices

You can request a copy of your data or ask us to delete it by emailing support@shopdesk.cloud. We'll verify your identity and respond within a reasonable time. If you're in a state with a comprehensive privacy law (e.g. California, Colorado, Virginia), we'll honor access and deletion requests consistent with that law regardless of whether ShopDesk is otherwise required to comply with it.

8. Children's privacy

ShopDesk is a business tool and isn't directed at, or knowingly used by, children under 13.

9. Changes to this policy

If we make material changes, we'll update the date above and, for significant changes, notify Shop owners by email.

10. Contact us

ShopDesk LLC — support@shopdesk.cloud
This policy is governed by the laws of the State of Massachusetts.