Privacy policy

AutoSoft Web is a product of Santa Rita Investments Inc., located at 17940 43rd Road N., Loxahatchee, FL 33470, USA. For anything about your data, write to [email protected].

This policy covers the sales site and the cloud app. It does not cover the desktop version, which is a separate product and does not send data to our servers.

About you, as our customer: name, email, billing address, and a record of your sign-ins and actions inside the app.

About your customers and their vehicles: whatever you enter to run your shop — name, contact details, tax identification where an invoice requires it, plate, VIN, odometer and service history.

Payment data: we do NOT store card numbers. Stripe processes the charge and we keep only the outcome, the last digits and the reason for a decline.

To provide the service you subscribed to: performance of the contract.

To bill you and meet tax and accounting duties: legal obligation.

To tell you about incidents, service changes and renewals: legitimate interest.

For marketing tracking and site analytics: only with your consent, which you can withdraw at any time from "Cookie settings" at the foot of any page.

You are the controller of your own customers' data; we process it on your behalf and on your instructions.

Stripe, to process payments. Twilio, for text messages. Resend, for email. Cloudflare and Railway, to host the service. Each one handles only what its function requires.

Google (Analytics), to measure visits and site usage. Meta (pixel), to measure campaigns and deliver targeted advertising. PostHog, for product analytics and the purchase funnel. None of the three loads before you accept the corresponding cookies.

If you enable reporting to the Carfax Service Network, the details of the completed service and the vehicle — including the VIN — are sent so they appear in its history. That is your decision, and you can exclude a specific repair order.

We do not sell personal information. We do use third-party advertising and measurement tools which, under California law, may constitute sharing personal information for cross-context behavioural advertising; you can opt out by rejecting advertising cookies from "Cookie settings" at the foot of any page.

Our servers are in the United States. If you use the service from the European Union, the United Kingdom or Switzerland, your data is transferred to the United States under the European Commission's Standard Contractual Clauses (Decision 2021/914), with the UK Addendum where applicable, executed with each of our providers. We retain the signed agreements and make them available to a supervisory authority on request.

While your subscription is active, and for as long as tax and accounting rules require.

If you cancel, your shop stays recoverable for 7 days and is then purged. We keep a backup for 30 days beyond that in case of a payment dispute or an operational mistake, and it is deleted for good when those 30 days are up.

In total, your data is permanently gone 37 days after cancellation.

Separately, we keep a security record of actions on accounts — who asked to recover a password, who blocked or unblocked an account, and when — which we need in order to investigate unauthorised access. In that record, email addresses and IP addresses are erased after 365 days, and 30 days after the purge if the shop was purged: what remains after that identifies nobody.

You can ask for access to your data, correction, deletion, and to withdraw a consent you previously gave. Write to [email protected] and we will answer within the period the applicable law sets.

If you are in Canada you may complain to the Office of the Privacy Commissioner. Depending on your state, you may have additional rights over the sale or sharing of personal information; we do not sell it.

If you are a customer of a shop that uses AutoSoft Web and want to exercise your rights, contact that shop: they decide what they keep about you.

Cookies on this site fall into three categories, and only the first is used without asking you.

Strictly necessary. They keep you signed in, remember your language and theme, store your own cookie choice, and make the anti-bot protection work. They do not require consent because the site does not work without them.

Analytics. To know which pages get read and how the site is used. Only with your consent.

Marketing. To measure campaigns and advertising. Only with your consent.

We also use analytics and advertising cookies from Google, Meta and PostHog, which let us know which pages work and measure our campaigns. These are only set if you accept them, and you can change your mind at any time from "Cookie settings" at the foot of any page, without it affecting your use of the site.

If you reject them the site works just the same: we simply stop measuring your visit.

Until you accept, no analytics or marketing cookie is loaded: it is not that they are set and then ignored — the script is never even requested. You can change your mind at any time from "Cookie settings" at the foot of any page, and the change takes effect immediately.

These are the strictly necessary cookies the site uses:

Payment is not taken on this site: it happens on Stripe's checkout, a separate company with its own privacy policy and its own cookies.

When you reach that screen you are on a Stripe domain, and what happens there is governed by their terms, not by these. We never see or store your card number.

Santa Rita Investments Inc. does not currently offer its services to repair shops established in the European Union. When it begins to do so, it will designate a representative in the Union under Article 27 GDPR and publish that representative's contact details here.

We have assessed the requirement under Article 37 GDPR and concluded that appointing one is not mandatory: we are not a public authority, our core activities do not consist of regular and systematic monitoring of individuals on a large scale, and we do not process special categories of data on a large scale. Data protection questions may be sent to [email protected].

We do not currently meet the applicability thresholds of the state privacy laws of California, Virginia, Colorado, Connecticut, Utah or Texas, which apply above defined revenue or volume levels. We do not sell personal information.

We do use third-party advertising and measurement tools which, under California law, may constitute *sharing* personal information for cross-context behavioural advertising. You can opt out by rejecting advertising cookies from "Cookie settings" at the foot of any page at any time, or by writing to [email protected].

We also offer the rights described in this policy to residents of those states. To exercise them, write to [email protected] from the address registered on your account.

Passwords are stored with an algorithm designed for that purpose and never in readable form. Traffic is encrypted. Each shop's data is kept separate from every other shop's.

No system is perfect: if a breach affected you, we would tell you without undue delay.

The service is aimed at businesses, not at minors.

If we change this policy we will tell you by email or inside the app before it takes effect.