Privacy Policy

Effective date: 29 April 2026

1. Who we are

GarageOS is operated by FrameLogic, the data controller for personal data processed through this service. For privacy-related enquiries, contact us at privacy@framelogic.co.uk.

2. What we collect

We collect the following categories of personal data:

• Account information: your name, email address, and password (hashed via Firebase Auth)
• Workshop information: business name, address, phone, VAT number, company number
• Customer data you enter: names, email addresses, phone numbers, addresses
• Invoice data: itemised invoices including labour and parts
• Vehicle registration numbers and vehicle descriptions
• Usage analytics: pages visited, actions taken, session duration
• Device information: device type, operating system, app version, IP address

3. Why we collect it

• To provide and operate the GarageOS service
• To process payments via Stripe (when billing is activated)
• To send transactional emails such as invoice delivery and account notifications
• To comply with UK tax law and HMRC requirements for invoice retention
• To improve the service through aggregated usage analytics

4. Legal basis (UK GDPR)

• Contract (Article 6(1)(b)): processing necessary to provide the service you signed up for
• Legitimate interests (Article 6(1)(f)): aggregated analytics to improve the product
• Legal obligation (Article 6(1)(c)): retaining invoice records as required by HMRC

5. Who we share data with

We do not sell or share your data with advertisers. We share data only with the following sub-processors:

• Google Firebase: user authentication and session management
• Our hosting provider (Hetzner/DigitalOcean): infrastructure for the API and database
• Stripe: payment processing (when billing is activated)
• Sentry: error and crash reporting (anonymised stack traces only)

We do not use third-party advertising networks or tracking pixels.

6. International transfers

Google Firebase may process authentication data on servers located in the United States. Such transfers are made under Standard Contractual Clauses (SCCs) approved by the UK ICO. Our primary database and API servers are located within the European Economic Area.

7. Retention

• Active account data is retained for as long as your account exists
• Invoice and financial records are retained for 7 years after account closure, as required by HMRC
• Anonymised analytics data may be retained indefinitely
• After account closure, personal data not subject to legal retention is deleted within 30 days

8. Your rights

Under UK GDPR you have the right to:

• Access: request a copy of the personal data we hold about you
• Rectification: ask us to correct inaccurate data
• Erasure: ask us to delete your data (subject to legal retention obligations)
• Portability: receive your data in a machine-readable format
• Restriction: ask us to restrict processing in certain circumstances
• Object: object to processing based on legitimate interests
• Withdraw consent: where processing is based on consent, withdraw it at any time

To exercise any of these rights, email privacy@framelogic.co.uk. We will respond within 30 days.

9. Children

GarageOS is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children.

10. Security

We use TLS encryption for all data in transit. Data at rest is encrypted at the infrastructure level. Access to production systems is restricted to authorised personnel and protected by multi-factor authentication.

11. Cookies

We use a small number of essential cookies. See our Cookie Policy for details.

12. Changes to this policy

If we make material changes to this Privacy Policy, we will notify you by email at least 14 days before the changes take effect.

13. Contact and complaints

For privacy enquiries: privacy@framelogic.co.uk

If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.