Privacy Policy

1. Information We Collect

This falls into a few different buckets:

• Site visitors. If you use a form on this Site — requesting a demo or subscribing to the blog — we collect what you type into it: typically your name, email, and shop name.
• Shop accounts. Signing up creates a shop record with a business name, billing email and address, and whatever billing details Stripe collects to run your subscription (see Section 3 — we never see or store your card number). Staff you add sign in with a name and a 4-digit PIN, which is stored as a one-way hash, not the PIN itself.
• Your customers' information. The Service is built to hold what a repair shop normally keeps on its own customers and their vehicles: names, phone numbers, emails, addresses, VINs and vehicle details, service history, estimates, invoices, photos taken during inspections or jobs, and uploaded documents. You control what goes in. We process it on your behalf to run the Service — we don't use it for our own marketing, and we don't sell it. If a shop uses text messaging and a customer has separately opted in, their phone number is also used to send those messages — see our Text Messaging Terms for how that consent works and how to opt out.
• Payments. When a shop takes a payment from its own customer, that card transaction is handled entirely by the shop's own connected Stripe or Square account — Underhood never receives or stores card numbers. Sensitive credentials for those connected accounts are encrypted at rest.
• AI features. Some optional features (cleaning up a technician's note, drafting a repair summary, reading an inspection photo) send the relevant text or image to Anthropic's Claude API to generate a result. This only happens when a staff member triggers one of those features.
• Diagnostics. If something in the Service errors out, technical details about that error (not a general record of what you did) are logged so we can fix it.

2. How We Use It

To provide and support the Service: running your shop's account, processing your subscription, sending transactional email (invoice copies, estimate approval requests, account setup links), responding to support requests, and fixing problems. We don't use a shop's customer data to advertise to anyone, and we don't sell it to data brokers or anyone else.

3. Who We Share It With

We use a small number of service providers to run Underhood, each processing only what they need to do their job:

• Stripe — our own subscription billing, and (for shops that choose it) their customer payment processing.
• Square — an alternative to Stripe for a shop's own customer payment processing, for shops that choose it.
• Resend — delivers transactional email on our behalf (setup links, invoices, estimate approvals, demo requests).
• Anthropic — powers the optional AI features described above.
• Sentry — error monitoring, so we find out about bugs before a shop has to report one.
• Neon and Amazon Web Services — host our database and uploaded photos/documents.
• Vercel — hosts the application itself.

We don't sell personal information, and we don't share it with anyone else except where required by law or to protect Underhood's or a shop's legal rights.

4. Data Retention

While a shop's subscription is active, we keep its data for as long as the account exists. If a subscription is canceled or lapses, the shop's data is kept for 90 days — reactivating at any point during that window restores full access with nothing lost. After 90 days, the shop's business data (customers, vehicles, invoices, photos, and everything else entered into the Service) is permanently deleted. We separately keep our own billing records for a canceled shop's subscription, as we're required to for our own tax and accounting purposes — that's our record of what we charged, not the shop's customer data.

Email support@getunderhood.com within that 90-day window to request a full export of your shop's data before it's deleted.

5. Security

Payment provider credentials and other sensitive secrets are encrypted at rest. Staff PINs are stored as one-way hashes, never in plain text. Access to a shop's data requires a valid staff session scoped to that shop. No system is perfectly secure, but we treat shop and customer data as something we're trusted with, not just stored data.

6. Your Rights

You can ask us to export or delete data at any time using the contact information below. If you're a customer of one of our shops rather than a shop yourself, reach out to that shop directly first — they control what's in their own account — and contact us if you need help going further.

7. Children's Privacy

The Service is a business tool for auto repair shops and is not directed at children under 13. We don't knowingly collect information from them.

8. The Underhood Products

"Underhood" refers to our full shop-management software, and "Underhood Go" refers to our phone-first product for mobile automotive trades (detailing, paintless dent repair, wheel repair, and similar). Both are operated by the same company under this one Privacy Policy — a shop's data is handled the same way regardless of which product it's subscribed to.

9. Changes to this Policy

We may update this Privacy Policy as the Site and product evolve. We'll update the "Last updated" date above when we do, and let subscribed shops know if a change is material.

10. Contact

Questions about this Privacy Policy, or a data export or deletion request? Email support@getunderhood.com.