DRAFT — for review by a qualified attorney/privacy professional before launch. Bracketed items must be completed.
Who we are. Project Apex, operated by [LEGAL ENTITY NAME], [ADDRESS]. Contact: support@projectapexsoftware.com.
Data we process. Account data (name, email), business profile data a shop enters, and customer/vehicle/service data a shop's customers submit through that shop's intake (names, contact details, vehicle details, service descriptions, messages, estimate approvals, and payments the shop records). Payment card data for subscriptions is processed by Stripe and is not stored on our servers.
Separation. Each business's data is isolated by business account with database row-level security. A business cannot access another business's records, and customer-visible views never include a shop's internal notes, part costs, or markup.
How we use it. Only to operate the service: running the workflow, sending notifications a shop/customer has triggered (via our email provider), subscription billing (Stripe), security, and support. We do not sell personal data and do not use shop/customer data for advertising.
Processors. [LIST TO CONFIRM: Supabase (database/auth/storage hosting), Vercel (application hosting), Stripe (subscription payments), Resend (transactional email).]
Retention & rights. Data is retained while an account is active and for [RETENTION PERIOD] after. Individuals may request access, correction, or deletion through the business that collected their data or by contacting us; we will action verified requests as the law requires.
Security. Encryption in transit, authenticated access, row-level security, and audit logging of important actions. No system is perfectly secure; report concerns to support@projectapexsoftware.com.