Privacy Policy

Emraay Solutions ("Emraay", "we", "us" or "our") provides GarageOS. This policy explains personal information handling for our website, workshop application, public booking pages and customer portals. Personal information is information about an identifiable individual, including information connected to a customer, staff member or vehicle owner.

We are responsible for personal information used to operate our service, manage accounts and communicate with you. When a workshop enters customer, staff, vehicle or repair records, we process that information to provide the service on the workshop's behalf. The workshop decides why it collects those records, who may access them and how it uses them, and is responsible for its own privacy notices and lawful instructions.

This policy does not replace a workshop's privacy policy or cover unrelated third-party websites. Our Terms of Service govern use of GarageOS.

• Account and team information: name, email, optional phone, authentication identifiers, workshop memberships, invitations and assigned roles. Supabase handles sign-in credentials and session management.
• Workshop information: business name, contact details, address, logo, operational settings, services, staff and subscription plan details. Some of this may identify a sole proprietor.
• Customer and vehicle records: names, phone numbers, email and postal addresses, licence plates, vehicle identification numbers (VINs), make, model, year, mileage and service history, as supplied by you or a workshop.
• Appointments and repair records: booking requests, notes, diagnostics, estimates, approvals, work orders, photos, invoices, loyalty activity and communications.
• Payment records: amounts, dates, methods, references and invoice balances entered by the workshop. Recording a payment does not process funds. Do not enter full card numbers or card security codes.
• Technical and security information: IP addresses, browser and device information, request times, service errors, authentication activity and audit records generated when the service is used. Hosting and other service providers may also generate operational logs.
• Support information: messages, contact details and information you choose to provide when asking for help or making a privacy request.

Information comes from you, authorized workshop users, public booking forms, customer portal interactions and the service providers used to operate GarageOS. Please avoid placing unrelated sensitive information in notes or photos.

We use personal information to create and authenticate accounts; operate workshop features; process booking requests and customer approvals; show records to authorized users; send service communications; provide support; troubleshoot errors; prevent abuse; protect the service; manage agreed subscriptions; and meet legal obligations.

Workshops use the records they collect to manage repairs, appointments, invoices and customer relationships. They are responsible for any additional uses, including their marketing. Booking or receiving a service email does not by itself subscribe you to marketing.

We do not sell or rent personal information or use workshop customer records for targeted advertising. GarageOS does not use your workshop records to train general-purpose AI models. If we introduce a materially different purpose, we will explain it and obtain consent or another lawful basis where required before using information for that purpose.

We collect, use and disclose personal information with meaningful consent where required, or under another basis permitted by applicable law. The form of consent depends on the information's sensitivity and the purpose. Necessary account and service processing is distinct from optional features and promotional messages.

You may decline optional information, decline microphone access, stop dictation, or withdraw consent for optional uses by contacting us. Withdrawing consent may affect a feature that needs the information, but does not require deletion of records we or a workshop must lawfully keep.

A workshop must provide appropriate notices and obtain any required consent before entering another person's information or sending promotional communications through the service.

We share information only as needed for the purposes described in this policy:

• Your workshop and authorized users: information is available according to workshop membership and permissions. A customer portal displays the records made available through its private link; anyone with that link may be able to view them.
• Service providers: providers of hosting, databases, authentication, file storage, email delivery and operational support process information needed to deliver their services. GarageOS uses Supabase for authentication and uploaded-file storage. Where error reporting is enabled, Sentry receives error and diagnostic information. Email providers receive recipients and message content needed for delivery.
• At your direction: when you or an authorized workshop user shares a document, sends a message, authorizes access or requests support.
• Legal and safety purposes: where required or permitted by law to respond to valid legal process, protect rights and safety, investigate fraud or address security incidents.
• Business transfers: in a merger, acquisition or reorganization, subject to applicable law and safeguards restricting use to the relevant transaction and continuing service purposes.

Service providers acting on our behalf are expected to use information for the services they provide and to protect it under applicable contractual and legal obligations. Contact us for information about the providers relevant to your account. A third-party provider's direct relationship with you may be governed by its own privacy policy.

GarageOS and its service providers may store or process information in Canada and other countries, including the United States. Location depends on the hosting, authentication, storage and delivery services in use. We do not promise that all records remain in Canada.

Information processed outside your country may be subject to that country's laws and lawful access by courts, law enforcement or other authorities. We remain responsible for the safeguards required by applicable law for information processed on our behalf. Contact us if you need information about processing locations or specific contractual requirements.

GarageOS uses authentication cookies to keep you signed in and browser storage to remember interface preferences, such as sidebar width and collapsed sections. These support the service and are not advertising trackers. Blocking or deleting them may sign you out or reset preferences.

The GarageOS web application does not currently include advertising cookies, cross-site advertising tracking or session replay. Hosting providers may generate technical logs as described above. If we introduce optional tracking, we will explain it and obtain any required consent before enabling it.

Optional voice dictation uses your browser's speech recognition feature after microphone permission. Depending on the browser, audio may be sent to the browser provider's speech service under that provider's privacy terms. GarageOS receives the resulting text; this feature does not upload an audio recording to GarageOS. Text you save becomes part of the work-order record. You can stop dictation and revoke microphone permission in your browser.

GarageOS uses authentication, workshop-specific access controls and staff permissions to restrict access. We use reasonable administrative, technical and organizational safeguards appropriate to the information. No online service can guarantee absolute security.

Protect your account and private portal links, review staff permissions, avoid uploading unnecessary personal information, and tell us promptly about suspected misuse. Uploaded workshop logos and work-order photos are currently served through public file URLs. Anyone who obtains a file URL can view that file without signing in, even though access to the associated workshop records requires authorization. Do not upload confidential documents or photos containing unnecessary personal information; share file links only with intended recipients.

If a personal information breach occurs, we will assess it and make notifications to affected people, regulators and other organizations where applicable law requires.

We keep information only as long as reasonably needed for its purpose, service delivery, security, dispute resolution or legal requirements. Retention depends on the type of information, the workshop's lawful instructions, the account relationship and applicable recordkeeping duties.

Closing an account, deleting a staff login or removing a visible record does not necessarily erase all related workshop records, audit entries or backup copies. Records may need to remain for tax, accounting, repair-history or legal purposes. Backup copies may persist until their normal replacement or deletion cycle and are not used for unrelated purposes.

To request closure, access, export or deletion, contact us. We will explain available options, verify authority and identify any lawful reason information must be retained. For workshop-controlled records, contact the workshop first; we can help route a request and carry out lawful instructions. We do not promise an immediate or universal deletion deadline.

Subject to applicable law and limited exceptions, you may request access to personal information, correction of inaccuracies, information about its use and disclosure, withdrawal of consent, or deletion where a right to deletion applies. Additional rights may apply in your location.

Email our privacy contact below. Provide enough information to identify your account or workshop and describe the request, without sending passwords, card details or identity documents in the initial message. We may verify your identity or authority and request clarification to protect other people's information.

We will respond within the period required by the applicable law. Where Canada's federal private-sector privacy law (PIPEDA) applies, access requests are generally answered within 30 days, subject to lawful extensions. If an exception prevents us from fulfilling a request, we will explain the reason and available complaint options where required. Any permitted fee will be explained in advance.

You may raise a concern with us or contact the Office of the Privacy Commissioner of Canada or the privacy regulator responsible for your province or jurisdiction. You do not have to contact us before approaching a regulator.

GarageOS business accounts are intended for adults, and the service is not directed at children. We do not knowingly collect children's information for their own accounts. If you believe a child has supplied information without appropriate authority or consent, contact us so we can investigate and take appropriate action.

We will update the effective date when this policy changes. For material changes, we will provide notice through the service or account email where appropriate and obtain new consent where required. A policy update does not authorize an incompatible new use of previously collected information without the necessary consent or other lawful basis.

For privacy questions, access or correction requests, deletion requests or complaints, email contact@emraaysolutions.com with the subject "GarageOS — Privacy". Requests are directed to the person responsible for GarageOS privacy matters.

Emraay Solutions
9-101 – 2600 Skymark Avenue
Mississauga, Ontario L4W 5B2, Canada