Privacy notice

1. Who is responsible

The controller or equivalent responsible for this notice is the Autobahn legal entity identified in the applicable signup flow or order form. Before launch, this page must include the entity’s full legal name, registered address, privacy email, and any required local representative or data-protection officer contact.

When a shop uses Autobahn to create an inspection or customer report, the shop may be the controller, business, data fiduciary, or equivalent for the personal data it instructs Autobahn to process. Vehicle owners and report recipients should direct requests about the shop’s inspection record to the shop first, unless the request concerns Autobahn’s independent processing.

2. Data we may collect

Depending on how the Service is used, we may process: account and identity data such as name, work email, shop, role, login and authentication records; billing and subscription data such as plan, transaction status, tax information, and payment-provider identifiers; support and communications data; device, browser, approximate location, IP address, log, diagnostic, and usage data; and Customer Data submitted by a shop, including vehicle make, model, year, VIN, license plate, mileage, inspection findings, estimates, photos, video, audio, customer names, contact details, and report activity.

Please do not upload government identifiers, payment-card numbers, health information, biometric templates, precise location, or other sensitive data unless the workflow requires it and the shop has a documented lawful basis and appropriate notice. A voice recording, face image, or vehicle identifier may be personal data depending on context and jurisdiction.

3. How we use data

We may use data to provide and secure the Service; authenticate users; create and deliver requested reports; support integrations and messaging; process subscriptions and payments through selected providers; respond to support requests; prevent abuse, fraud, and security incidents; maintain backups and business records; diagnose errors; measure and improve reliability and product experience; comply with law; and communicate service notices. We do not use identifiable inspection content for advertising.

The final notice will identify the lawful basis or local equivalent for each purpose where required. Depending on the context, those bases may include performance of a contract, legitimate interests, consent, compliance with a legal obligation, or another basis recognized by applicable law. We will not treat “legitimate interests” or “consent” as a universal basis without documenting the actual processing and jurisdiction.

4. Shop-controlled Customer Data

For Customer Data processed only to provide the shop’s workspace and reports, Autobahn will follow the shop’s documented instructions and the final DPA, subject to lawful requirements. The shop is responsible for collecting the data fairly, giving required notices, obtaining permissions for media and messaging, responding to its customers, and configuring retention and access appropriately.

Autobahn may process limited Customer Data independently when needed for security, abuse prevention, account administration, support, invoicing, service integrity, aggregated analytics, or legal compliance. The final DPA and this notice must state which activities are controller-to-controller, processor-to-controller, or equivalent under each relevant law.

5. Sharing and subprocessors

We may share data with infrastructure, database, object-storage, content-delivery, email, SMS, analytics, identity, customer-support, payment, hosting, security, and integration providers that help us operate the Service. We may also disclose data to professional advisers, authorities, or a successor in a corporate transaction when permitted or required. Providers will receive only the data needed for their function and will be bound by contract or other safeguards appropriate to their role.

Before production launch, publish a current subprocessor list with provider name, service, processing location, data categories, role, and notice/objection process. The current product plan contemplates providers such as PostgreSQL, Wasabi, Stripe, PayPal, email/SMS services, and DMS integrations; the actual production list is not yet confirmed.

6. International transfers

Autobahn may process data in countries other than the country where it was collected. Where a law requires a transfer mechanism, we will use the mechanism applicable to the transfer and role, such as an adequacy decision, standard contractual clauses, a local transfer contract, an approved safeguard, or another lawful basis. A public statement that data is “globally hosted” is not a substitute for a transfer assessment.

Customers considering use in the EEA, United Kingdom, Türkiye, India, the United Arab Emirates, Dubai mainland, DIFC, or ADGM must confirm the actual hosting, subprocessor, support-access, and onward-transfer path before uploading customer data. Country-specific requirements are summarized in the project’s legal-readiness memo, not conclusively resolved by this notice.

7. Retention and deletion

We retain data only for as long as reasonably needed for the purpose collected, the customer’s subscription, security and backup cycles, legal obligations, dispute resolution, or documented shop instructions. Exact retention periods for inspection reports, media, logs, billing records, support tickets, and backups are not yet finalized. They must be documented before production launch and reflected in the DPA, order form, and product controls.

A shop may request export or deletion of its Customer Data subject to the agreement, the DPA, legal retention duties, security records, and technical backup expiry. Deletion from an active system does not necessarily mean immediate deletion from encrypted disaster-recovery backups.

8. Rights and requests

Depending on where a person lives and the role Autobahn plays, they may have rights to access, correct, delete, restrict, object to, or receive a copy of personal data; withdraw consent; opt out of certain communications; or complain to a regulator. Rights and deadlines differ by law and exceptions may apply. We may verify identity and direct a request to the shop when the shop is the responsible controller.

Requests should be submitted through the contact page with “Privacy request” in the message. The final page must publish the legal privacy email, local representative or DPO contact where required, appeal process where applicable, and the relevant supervisory-authority links.

9. Cookies and similar technologies

The website may use strictly necessary cookies or local storage for navigation, security, authentication, and preferences. Optional analytics, advertising, or similar technologies must not be activated in a jurisdiction requiring prior consent until a consent mechanism, cookie inventory, retention setting, and withdrawal path are implemented. The product may also create security logs and device identifiers for abuse prevention.

10. Security and incidents

We intend to use reasonable administrative, technical, and organizational safeguards appropriate to the data and risk, including access controls, least privilege, encryption in transit, provider controls, logging, backups, and incident procedures. No online service can promise absolute security. The final security description, incident-notification process, and customer responsibilities belong in the DPA and security documentation.

11. Children and sensitive data

The Service is designed for business users and is not directed to children. Customer must not knowingly submit children’s data or sensitive data unless the workflow requires it, the applicable law permits it, and the responsible business has completed the required notice, consent, minimization, access, and retention steps. If a shop believes it submitted data contrary to this rule, it should contact us promptly.

12. Changes and contact

We may update this notice when our processing, providers, product, or legal obligations change. We will publish the new effective date and provide additional notice for material changes where required. The final notice must identify the Autobahn legal entity and privacy contact; until then, questions can be sent through the contact page.