Privacy policy

Two different roles

• For subscribing shops (their owners and staff), Jonathan Bachour is responsible for the information they give us.
• For the shops’ customers, your shop is responsible for your information: it collects it to serve you. Jonathan Bachour hosts and processes it only on the shop’s behalf and following its instructions. For any request, contact your shop first; we will help it respond.

Person in charge of personal information

Jonathan Bachour, Fondateur — rotor.app.jo@gmail.com

Information we collect

• Shops: shop name, address, phone and email, GST and QST numbers, owner name and email, password (hashed, never readable) and subscription history. Card numbers are handled by Stripe: we never see or keep them.
• Shops’ customers: name, cell phone, email (if you give it) and language; vehicles: make, model, year, plate, VIN and mileage; appointments, problem description and photos you send; work history, inspections, quotes, receipts and payments, loyalty points; your consent to promotions (date and how) and the texts exchanged with the shop.
• Technical: a login cookie and a language cookie, the IP address (to block abusive login attempts) and short-lived server logs.

Why we use it

• To provide the service: bookings, text confirmations and reminders, receipts, quotes, work reports, payments and the customer page.
• To send promotions only to customers who agreed (Canada’s anti-spam law). Replying STOP unsubscribes immediately.
• To bill the shops’ subscription and answer their questions.
• To protect accounts and the service (security, backups) and meet our legal obligations.

We sell no information. No targeted ads, no tracking or analytics cookies.

Providers with access

Only those needed for the service, bound by contract to confidentiality:

• hosting of the application and backups;
• Twilio (sending texts) and Resend (sending emails);
• Stripe (card payments);
• NHTSA, the US public VIN decoding service: only the vehicle serial number is sent to it.

Some of these providers are outside Quebec, notably in the United States. Before entrusting them with information, we assess whether they protect it adequately. We also disclose information when the law requires it.

Retention

• A customer’s file is kept until their shop deletes it (for example at the customer’s request). Nothing is erased automatically because a customer hasn’t come in for a long time.
• The shop can export all its data at any time. When a shop leaves, we delete its data and its customers’ data at its request. We keep only our subscription billing records (6 years, for taxes).
• Backup copies are deleted automatically after 30 days at most.

Security

• Encrypted connection (HTTPS) and hashed passwords.
• Each shop sees only its own data; each customer sees only their own (login by text code). Receipt and quote links cannot be guessed.
• Automatic daily backup, with an off-site copy.

Your rights

You may ask to access your information, have it corrected or deleted, receive a copy in a common format and withdraw your consent. Shop customers: download a copy of your information from your customer page (“My file”), and contact your shop for anything else (its details are on its page). You can also write to us at rotor.app.jo@gmail.com. We answer within 30 days.

Promotions: reply STOP to any text, or uncheck the box on your customer page.

You can file a complaint with the Commission d’accès à l’information du Québec (cai.gouv.qc.ca).

Privacy incidents

If an incident presents a risk of serious harm, we promptly notify the affected shops, the Commission d’accès à l’information and the people concerned, as the law requires. We keep a register of incidents.

Shops and customers in the United States

• The information of US shops and their customers is hosted in Canada (Quebec), with the same protections. Jonathan Bachour acts as the shop’s service provider: we process this information only to provide the service to the shop.
• We do not sell or “share” any personal information (as defined by state laws such as California’s) and do no targeted advertising.
• Texts: maintenance reminders and promotions are sent only if the customer checked the consent box; the exact text accepted and the date are kept. Reply STOP to opt out and HELP for help. Msg & data rates may apply.
• Depending on your state, you may have the right to know what information we have, have it corrected or deleted, and not be discriminated against for exercising these rights. Contact your shop or write to us at rotor.app.jo@gmail.com.
• In case of a security breach involving your information, we notify the shop, and the affected people as their state’s laws require.

Cookies

Only essential cookies: login (sid, csid), language (lang) and confirmation message (flash). No advertising or analytics cookies.

Changes

Any change is published on this page with its date. Shops are notified by email of important changes.