Privacy Policy

Updated: 27 September 2026

1. 1. Data controller

   The Garag platform (“Garag”, “the platform”, “we”) and the processing of personal data available on it are provided by the platform operator. No data protection officer (DPO) has been appointed: the obligation to appoint one under Art. 37 GDPR does not arise - large-scale systematic monitoring of data subjects is not a core activity of the platform. For any matter relating to the processing of personal data, exercising your rights or this policy - including matters normally addressed to a data protection officer - write to legal@garag140.com.

2. 2. What data we collect

   Account data (email address, name, username and, where provided, phone number; the password is stored only in encrypted (hashed) form). Data about the vehicles you add to your garage (make, model, year, VIN, registration number, photos). Booking, order and service-history data. Messages with the workshop and the reviews and ratings you leave. Consent records (including the fact, date and version of the consent). For workshop owners and mechanics - data about the workshop, the team and the services provided. For a call-out service - the address and location of the visit; for a roadside (SOS) request - the pickup point and the chat with the driver. Support requests (name, email, text). Referral programme participation (who invited whom). Technical data: IP address, device and browser type, cookies and the anonymous identifier garag_anon_id.

3. 3. Purposes of processing

   Operating the platform: finding workshops, booking online, keeping your garage and service history. Communication between the client and the chosen workshop. User support. Ensuring security and preventing abuse (spam, fraud, rule violations). Meeting legal requirements. With your consent - analytics to improve the platform and marketing communications.
   Back to contents

4. 4. Legal grounds

   Performance of a contract - providing the platform's features and handling your bookings (Art. 6(1)(b) GDPR). Consent - analytics and marketing cookies, promotional mailings (Art. 6(1)(a) GDPR); consent can be withdrawn at any time. Legitimate interests - platform security, content moderation, platform improvement and anonymised statistics on how often workshop cards are shown in the catalog (Art. 6(1)(f) GDPR). Legal obligation - where processing is required by law (Art. 6(1)(c) GDPR).

5. 5. Data recipients

   When you create a booking, the necessary data is passed to the workshop you chose and to the mechanics assigned by that workshop - so that they can carry out the booking and contact you. To run the platform we use providers that process data on our instructions and under data-processing agreements (DPAs), each only to the extent its function requires: application hosting, logs and file storage for photos (Vercel); the database (Neon); subscription payment processing (Stripe); transactional email (Resend); error monitoring and crash diagnostics (Sentry); workshop details, ratings and reviews from Google (Google); bot messages and forwarding of workshop chats to the messenger (Telegram); protecting guest forms from bots (Cloudflare); the map background your browser loads (CARTO); turning addresses into coordinates (OpenStreetMap Nominatim); cookie-free traffic and page-speed statistics (Vercel). To check a new password against known breaches we send the Have I Been Pwned service only the first 5 characters of the password hash - neither the password nor the full hash leaves the platform. To decode a VIN we query the NHTSA database (USA) - it receives only the VIN, none of your data. If a workshop has connected its own CRM system to Garag, booking data (name, phone, request description, order) is passed to that CRM on the workshop's instructions. We do not sell personal data to third parties.

6. 6. Transfers outside your country

   Infrastructure providers may store and process data on servers located outside your country or the EEA. In such cases the transfer is made using the safeguards provided for by the GDPR (for example, standard contractual clauses).
   Back to contents

7. 7. Retention period

   We keep data no longer than is necessary for the purposes of processing.

   • Account data and the content linked to it are kept while the account is active; vehicles you delete stay in the trash for 30 days and are then permanently erased.
   • The technical activity log (security log: sign-ins and key actions) is kept for up to 12 months and then deleted automatically.
   • Login sessions are deleted within 30 days after they expire.
   • In-app notifications are deleted 90 days after they are read, and unread ones no later than 12 months after they were created.
   • One-time confirmation links and codes (email verification, password reset, unaccepted workshop team invitations, links for connecting a client card to an account) are deleted within a day after they expire.
   • Consent records (together with the IP address and browser details at the time of consent) are kept append-only and are not deleted, so that we can confirm the fact and version of the consent you gave. Once you delete your account, the record is unlinked from you: the IP address and browser details are erased, and only the fact, date and version remain.
   • Orders and service history (including mechanics' escalations on an order) are retained for the period set by tax and accounting law; a workshop closing does not erase them.
   • The documents issued to you for a repair (work order, completion certificate, warranty card, invoice) are kept for the same period and for the same reason - they are your copy and the workshop's accounting record; automated clean-up does not delete them.
   • Documents a workshop attaches to its publication request (registry extract, NIP certificate, lease agreement, mechanic certificates) are kept for up to 12 months from upload and are deleted within 30 days after the workshop closes - whichever comes first; the owner can delete them at any time.
   • The result of checking a workshop's details against the public GUS/REGON registry (what the registry answered, when, and for which NIP) is kept for up to 12 months from the date of the check and then deleted.
   • SOS requests: 90 days after completion or cancellation the request location is coarsened to city level and the comment and chat are deleted; the anonymised record is kept for statistics.
   • Support requests are kept for 24 months after they are closed, and complaints and moderation records for 24 months after they are resolved.
   • Referral programme data (who invited whom, rewards granted) is kept for 24 months after the invitation is activated or the reward ends.
   • Requests to claim a workshop card from the catalog are kept for 12 months, and year-in-numbers summaries for 2 years.
   • The technical buffer for photo albums sent via Telegram is cleared within a day.
   • Anonymised statistics on workshop card views and opens in the catalog (without IP address or search text) are kept for 180 days service recommendation statistics for 180 days, and product analytics events (only with your consent) for 90 days, then deleted automatically.

   Automated clean-up runs as a daily scheduled job.

8. 8. Your rights

   In relation to your data you have the right to: obtain access and a copy, correct inaccurate data, erase data, restrict processing, object to processing, port your data, and withdraw consent previously given. You can download a copy of your data yourself in your account settings (after signing in). To exercise the other rights, write to legal@garag140.com. You also have the right to lodge a complaint with a data-protection supervisory authority - in Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa.

9. 9. Data security

   Passwords are stored only in encrypted (hashed) form. Access to data is restricted by role: a client sees only their own data, a mechanic only the orders assigned to them at their workshop, a workshop owner only their own workshop. A user's personal vehicle history is not available to their employer, even if that user is also a mechanic.
   Back to contents

10. 10. Changes to this policy

    For material changes we publish a new version of the policy and, where required, ask for consent again. The date of the last update is shown at the top of the document.

11. 11. Data contacts

    Questions about data - legal@garag140.com. See also the Cookie Policy.
    Back to contents