Privacy Policy

1. Who we are

Motorsmith is shop management software for independent auto repair shops. It is made and operated by Cosmic Vista LLC (“we”, “us”). For anything in this policy you can reach us at info@usemotorsmith.com or by mail at 9425 Rolater Road, Apt 338, Frisco, TX 75035.

This policy is written for two readers: the shop owners and team members who have Motorsmith accounts, and the customers of those shops, whose information a shop keeps in Motorsmith. Where a section applies to only one of you, it says so.

2. What this policy covers

This policy applies to:

• Our website at https://usemotorsmith.com, including the contact form.
• The Motorsmith application at https://app.usemotorsmith.com.
• The customer-facing pages the application generates for a shop: online booking pages, estimate-approval links, payment links and inspection-report links.
• Emails and text messages the application sends, on its own behalf or on a shop’s behalf.

It does not cover what a shop does with its own records outside Motorsmith, or the websites and services of other companies we link to. Stripe’s handling of payment data is governed by Stripe’s own privacy policy.

3. Two roles: your shop’s account and your customers’ data

For shop accounts we are the business deciding how data is used (a “controller” or “business” in privacy-law terms). This covers the information an owner or team member gives us to open and run an account: names, logins, business details, billing, support conversations, and how the application is used.

For a shop’s customer and vehicle data we act on the shop’s instructions (a “processor” or “service provider”). When a shop enters a customer’s name and phone number, photographs a vehicle, or sends an estimate, the shop decides why that data is collected and what happens to it. We store and process it only to provide the Service to that shop, under our Terms of Service, and we do not use it for our own purposes beyond running, securing and improving the Service.

4. Information we collect

From shop owners and team members

• Account and identity. Name, email address, mobile number, password (stored hashed, never in plain text), role in the shop, and one-time verification codes.
• Business details. Shop name, address, phone, email, hours, logo, tax settings and the services you offer.
• Billing. Plan, add-ons, invoices and payment history. Card details for your subscription are collected by Stripe on Stripe-hosted fields; we receive only a token, the card brand and last four digits.
• Payout account. If you take card payments, Stripe collects the identity, bank and tax information it needs to open your connected account and to file tax forms. We see the status of that account, not the underlying documents, bank numbers or taxpayer ID.
• Support and contact. What you send us by email, the contact form on our website, or in-app messages.

Entered by a shop about its customers (processed on the shop’s behalf)

• Customer records. Name, phone, email, address, notes, and whether the customer agreed to receive text messages.
• Vehicle records. Year, make, model, VIN, license plate, mileage and service history.
• Work records. Appointments, repair orders, estimates, invoices, approvals, payments and inspection findings.
• Photos and video. Inspection photos and short videos of the vehicle, uploaded by the shop.
• Customer actions on public links. When a customer books online, approves an estimate, pays, or views an inspection report, we record what was done and when, along with the device and network information below.

Collected automatically

• Device and network. IP address, browser and operating system, screen size, language, the pages and features used, and timestamps.
• Logs. Server logs of requests, errors and security events.
• Messaging records. For each email or text the application sends: the recipient, the message type, delivery status, and any replies such as STOP, HELP or a numeric confirmation.

We do not collect precise geolocation, biometric data, or Social Security numbers, and we do not use third-party advertising or analytics trackers on the website or in the application.

5. How we use information

• To create and run accounts, and to deliver every feature of the Service a shop uses.
• To send the messages a shop asks us to send: estimates, invoices, payment links, appointment confirmations and reminders, inspection reports.
• To verify identities with one-time codes and to keep accounts secure.
• To bill subscriptions and add-ons, and to support card payments through Stripe.
• To answer support requests and to tell owners about changes that affect their account.
• To look up vehicle, labor and plate data from third-party sources when a shop asks for it.
• To understand how the Service is used and to fix and improve it, using data that has been aggregated or stripped of identifying details wherever that is practical.
• To detect fraud, abuse and security incidents, and to enforce our Terms.
• To comply with the law, respond to lawful requests, and protect our rights and the rights of others.

We do not sell personal information, we do not use it for targeted advertising, and we do not send marketing text messages. If we ever send marketing email to shop owners, every message will carry an unsubscribe link.

6. Who we share information with

We share information only with the companies that help us run the Service, and only what each needs to do its job. They are bound by contract to use it for that purpose and nothing else.

• Stripe, Inc. Subscription billing, card and bank payments from a shop’s customers, payout accounts and the related identity and tax checks.
• Amazon Web Services, Inc. Storage of uploaded files (photos, video, documents, PDFs), and delivery of the emails the application sends.
• Twilio Inc. Delivery of the text messages the application sends, and of the one-time verification codes. Twilio receives the mobile number and the message, and nothing else.
• Hostinger. The virtual servers that run the application and its database.
• Vehicle data, labor guide and license-plate lookup providers. When a shop runs a lookup, the provider receives only the VIN, or the plate and state, needed to answer it. They do not receive the customer’s identity.

We may also disclose information:

• On a shop’s instruction, for example when the shop sends a report or invoice to its customer.
• To comply with the law, such as a subpoena, court order or lawful government request, or to protect the safety, rights or property of anyone.
• In a business transfer. If Cosmic Vista LLC is involved in a merger, acquisition or sale of assets, information may transfer with the business. We will tell affected shop owners before their information becomes subject to a different privacy policy.

7. Text messages and mobile information

Mobile numbers and text-message consent are used only to send verification codes for signing in, signing up and resetting a password to Motorsmith, which go through a separate verification service, and the messages described on our SMS Program page: account and support messages to shops that opt in, and messages on a shop’s behalf, such as appointment confirmations and reminders and a one-time code when a customer opens a secure link from the shop, plus the automatic replies to STOP and HELP.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging originator opt-in data and consent are not shared with any third party. Mobile numbers are shared only with the messaging providers required to transmit the messages.

How often we text. It depends on what you do. Verification codes are one per request, sent only when you ask for one. Account and support messages go only to shops that opted in. Message frequency varies: a confirmation when you opt in, a few account notices in a typical month, and one reply per question you text us. Appointment messages are up to three per appointment, so they depend on how often you book. Replies to STOP and HELP are sent once, in answer to your own message.

Message and data rates may apply from your mobile carrier, according to your plan with them. Motorsmith does not charge you, the recipient, for any message.

We keep a record of every opt-in and opt-out so that an opt-out is honored for as long as the number is in our system.

8. Cookies and similar technologies

The website and the application use only what is strictly necessary to work: a session token that keeps you signed in, your saved preferences (such as the last screen you used), and security tokens that protect forms. These are stored in your browser and are not used to track you across other sites.

We do not set advertising cookies, and we do not allow third parties to set cookies on our pages. Because we do not track across sites, there is nothing for a “Do Not Track” signal to change; we treat Global Privacy Control signals as described in section 14.

9. How long we keep information

• Shop accounts and Shop Data. For as long as the account is active. After a trial ends or a subscription is cancelled, the account is read-only for 30 days so the shop can choose a plan or export its data. 30 days after the account ends we delete the data from our live systems; it leaves backups on their normal cycle within 90 days after that.
• Billing, payment and tax records. Up to seven years, as accounting and tax law requires.
• Text-message consent and opt-out records. For as long as needed to honor the opt-out, and as carrier rules require.
• Contact-form messages and support email. Up to 12 months after the matter is closed.
• Server and security logs. For as long as needed for security and troubleshooting, then deleted or anonymized.

A shop can delete individual customer, vehicle and work records at any time from inside the application.

10. How we protect information

• All traffic between your browser and the Service is encrypted in transit.
• Passwords are stored as salted hashes. We cannot read them, and we will never ask you for one.
• Uploaded photos, video and documents are held in private storage and served through signed links that expire.
• Card numbers are entered on Stripe-hosted fields and never touch our servers.
• Access inside the Service is role-based: each team member sees what the owner allows, and each shop sees only its own data.
• Access to production systems is limited to the people who operate them and is logged.

No system is perfectly secure. If we learn of a breach that affects your information, we will notify you and the authorities as the law requires.

11. Where information is stored

Motorsmith serves businesses in the United States, but not all of our infrastructure is located there. At the effective date of this policy:

• The application servers and the database that holds account and Shop Data run on virtual servers operated by Hostinger in India.
• Uploaded files, and the email the application sends, are handled by Amazon Web Services in its Asia Pacific (Mumbai), India region, and served to you through Amazon’s content delivery network.
• Text messages are sent through Twilio Inc. in the United States.
• Payment data is held by Stripe, Inc. in the United States under Stripe’s own policies.

Wherever it is stored, information is protected as described in section 10 and remains subject to this policy and our contracts with those providers. If we move any of this infrastructure, we will update this section.

12. Your choices and rights

Whatever state you are in, shop owners and team members can:

• See and update account and business details inside the application.
• Export reports and, on request, a copy of Shop Data (see the Terms of Service, section 17).
• Ask us to correct or delete personal information we hold about you.
• Opt out of any marketing email with the unsubscribe link, and out of text messages by replying STOP.

To make a request, email info@usemotorsmith.com from the address on your account, or write to us at the address in section 18. We will confirm your identity, which may mean replying from your account email or confirming a code sent to your phone, and answer within 45 days. We will not treat you differently for exercising a right. You may use an authorized agent; we will ask for proof that you gave them permission.

If you are a customer of a shop, your rights over the shop’s records run against the shop; see section 3.

13. California privacy rights (CCPA/CPRA)

This section applies to California residents and supplements the rest of the policy. It is organized by the categories the California Consumer Privacy Act uses.

Categories of personal information we collect

• Identifiers: name, email, phone, postal address, IP address, account ID.
• Customer records (Cal. Civ. Code 1798.80(e)): business name and contact details; for a shop’s customers, the vehicle and service records the shop keeps.
• Commercial information: plans bought, add-ons, billing history; for a shop’s customers, estimates, invoices and payments.
• Internet or network activity: pages and features used, device and browser information, logs.
• Audio and visual information: inspection photos and video of vehicles uploaded by a shop.
• Professional information: a team member’s role at the shop.
• Sensitive personal information: account login credentials only. We use them solely to sign you in and secure the account, which is a permitted purpose, so no “limit use” request is needed.

We do not collect precise geolocation, biometric, health, or government-ID numbers, and we draw no inferences to build a profile about you.

Sources, purposes and disclosures

We collect this information directly from you, from the shop that enters it, and automatically from your device (section 4). We use it for the purposes in section 5 and disclose it to the service providers in section 6. In the last 12 months we have not sold personal information and have not shared it for cross-context behavioral advertising.

Your rights

• Know what personal information we collect, use and disclose, and receive a copy of it.
• Delete personal information we hold, subject to exceptions such as completing a transaction or complying with the law.
• Correct inaccurate personal information.
• Opt out of sale or sharing (we do neither; see section 14).
• Non-discrimination: we will not deny service, charge more, or offer less because you exercised a right.

Make a request as described in section 12. We respond within 45 days and will tell you if we need more time. Where we hold information as a service provider to a shop, we will forward your request to that shop.

Shine the Light. We do not disclose personal information to third parties for their own direct marketing, so there is nothing to report under Civil Code section 1798.83.

14. Do Not Sell or Share My Personal Information

This page exists so the “Do Not Sell or Share” link in our footer leads somewhere honest. If you would still like your choice on record, email info@usemotorsmith.com with the subject “Do Not Sell or Share” and we will confirm it in writing. We treat a Global Privacy Control signal from your browser as a valid opt-out request to the extent the law requires, which, given the above, changes nothing about how we handle your data.

We do not knowingly sell or share the personal information of anyone under 16.

15. Other US state privacy laws

Residents of states with comprehensive privacy laws, including Texas, Virginia, Colorado, Connecticut, Utah, Oregon and others, have rights similar to those in section 13: to confirm whether we process your personal data, to access, correct, delete and obtain a copy of it, and to opt out of targeted advertising, sale, and profiling with significant effects. We do none of those three. Requests are made as described in section 12.

Appeals. If we decline a request, you may appeal by replying to our decision or emailing info@usemotorsmith.com with “Privacy appeal” in the subject. We answer appeals within 45 days and will tell you how to contact your state attorney general if you are still not satisfied.

16. Children

Motorsmith is for businesses, and every account holder and team member must be at least 18. We do not knowingly collect personal information from children under 13, and the Service is not directed at them, as the Children’s Online Privacy Protection Act (COPPA) defines those terms. If you believe a child has given us personal information, email info@usemotorsmith.com and we will delete it.

A shop may occasionally record a minor as a vehicle’s contact or in a note. That record is the shop’s, entered under its own legal obligations; we process it only as the shop’s service provider.

17. Changes to this policy

When we change this policy we update the effective date at the top. For material changes, such as a new category of data, a new purpose, or a change to where data is stored, we also email shop owners and show a notice in the application before the change takes effect. Earlier versions are available on request.

18. Contact us

Cosmic Vista LLC
9425 Rolater Road, Apt 338, Frisco, TX 75035
Email: info@usemotorsmith.com

For privacy requests, put “Privacy request” in the subject line so it reaches the right person quickly. You can also use the contact form on our website.