Privacy policy

There are two organisations involved and they owe you different things.

The repair shop is the business you dealt with. They collected your details, they decided what to collect, and they remain accountable for it. If you want to see what is held about you, correct it, or complain, the shop is who to ask first.

Teardown is the software the shop uses. We store and process the information on the shop's behalf and under their instruction. We do not decide what the shop collects, we do not use it for our own purposes, and we do not sell it or share it with anybody for advertising.

Write to info@teardownauto.com for anything about the software itself.

Only what a repair needs. In practice that is:

• Your name, phone number, email address and postal address.
• Your vehicle: year, make, model, VIN, plate, colour, paint code and mileage.
• Photographs of the vehicle, taken during teardown, repair and delivery. These sometimes show a driveway, a garage or the inside of a car.
• If an insurer is paying: the claim number, the policy number, the date of loss, the deductible, and the adjuster's name and phone number.
• The repair itself: the estimate, the parts, the dates, the invoice and what was paid.
• Notes shop staff wrote about the job.

Nothing else. There is no tracking of you across other websites, no advertising identifiers, and no analytics that follow an individual.

To do the repair and to run the business around it: writing the estimate, ordering the parts, telling you when the car is ready, invoicing whoever is paying, and keeping the record afterwards. A shop also has to keep records for tax and for warranty on the work.

Giving your details to the shop is how a repair gets written up, so consent for these purposes is part of asking for the work. If you would rather something was not recorded, say so to the shop: some fields are genuinely optional and the software does not require them.

Staff at the shop that holds the record, and nobody else. Another shop using Teardown cannot see your record, and this is enforced by the database rather than by the screens: every request is filtered by which shop the person belongs to, so a fault in the application cannot show one shop another shop's customers.

Within a shop, the owner decides what their staff can see. Some figures, such as what the shop pays for a part, can be restricted to the owner.

We cannot read a shop's records as a matter of course. Support access has to be granted by the shop's owner, expires on its own, can be withdrawn at any time, and every access made under it is logged where the owner can see it.

Information is shared outside the shop only where the repair requires it: with the insurer or fleet paying for the work, and with parts suppliers, who receive what is needed to supply a part and not your personal details. It is never sold.

This part is about the people who work at a shop, not its customers. A shop can use Teardown as its time clock, on a device it sets up in the shop. The shop is the employer: it decides who is on the timesheet, and it is accountable for what is recorded, the same way it is for a repair.

What is held about each person on it: the name the shop puts on the clock; a four digit code, stored only as a one way hash, so the code itself is not kept; when they clocked in and out, and any note on a shift; whether they are paid by the hour or at a flat rate, and the rate; and for a flat rate technician, the jobs assigned to them, the hours on each and what has been paid. A shift changed afterwards is logged with who changed it and when, like any other change.

What is held about the device: the name the shop gave it, who started it and when, the internet address it was started from, and when it was last used.

Who sees it: rates and what a person has been paid are seen only by the shop's owner. Hours are part of the shop's own records, like its repairs, so people at the shop who sign in to the software can reach them, and the owner decides who has an account. The device in the shop shows a person their own hours and jobs only after their code is typed, and shows no pay at all. Another shop never sees any of it.

It is used to work out hours and pay for the shop's payroll, and for nothing else. It is kept as described below, and a person can ask the shop to see or correct their own record, the same as anybody can with a repair.

A shop can connect Teardown to its own QuickBooks Online company, which is run by Intuit. Connecting sends nothing. An invoice reaches the shop's QuickBooks only when somebody at the shop chooses to send that one job, so a repair nobody sends stays out of it.

What we hold about the connection: the QuickBooks company's name and Intuit's number for it, who at the shop connected it and when, and the permission Intuit issues so the software can reach that company. The permission is encrypted before it is stored, with a key the database does not hold, so the database and its backups contain nothing that could be used to reach the shop's QuickBooks.

What we read from QuickBooks: only what sending an invoice needs. The company's name. The lists an invoice is made from: the shop's customers, its products and services, the accounts those are booked to, and the tax codes and their rates. The settings that decide how an invoice is numbered and taxed. The invoice numbers already used, so that sending a job cannot land on a number the shop's books already hold. And the invoice itself, read back after it is created, to check it arrived as it was sent.

What stays here afterwards: which company was connected, the products, accounts and tax codes the shop picked, and, for each job that was sent, QuickBooks' own number for the invoice and its total, so the shop can see what went where. If QuickBooks refused a job, what it said about it is kept with that job so somebody can put it right.

What goes to QuickBooks when a shop sends a job: the invoice. That is who it is made out to, which on a job you are paying for yourself is your name, the invoice number and date, the amounts and tax, and a reference to the repair.

Information from QuickBooks is used only to do this. It is seen only by people at that shop, it is never shown to another shop, it is never sold, and it is never used to advertise or to train anything. Once an invoice is in the shop's QuickBooks it is the shop's own accounting record, held by Intuit under Intuit's privacy statement. Disconnecting destroys the permission straight away, and from that moment nothing here can reach the shop's QuickBooks. Two things outlast it on purpose: invoices already sent stay in QuickBooks, because they are part of the shop's books, and the shop's own record of which company was connected and which jobs were sent to it stays here, because it is the record of what the shop did. A shop can ask for that to be erased, the same way as anything else on this page.

Records are stored on servers in the United States: the database in Ohio, and photographs and documents with Cloudflare, which stores them in its own network.

This is worth stating plainly. Information held in another country is subject to that country's laws, and a court or a government agency there may be able to compel access to it, whatever Canadian law says and wherever you live. That is true of most software a Canadian business uses, and it is true here.

Backups are taken nightly and are held in the same way.

Indefinitely, unless a shop asks for a record to be removed.

This is deliberate rather than an oversight. A repair record is something a shop, an insurer or a customer may need to point at years later: a warranty claim on paintwork, a dispute about what was done, a car being sold with its history. When something is deleted in the software it is marked as deleted and stops appearing, rather than being erased, so a mistake can be undone.

If you want a record erased rather than hidden, ask the shop. They can ask us and we can do it. It cannot be undone afterwards, and a shop may have its own legal reasons to keep some of it, such as tax records.

• Everything travels encrypted, and is stored encrypted.
• Each shop's records are separated in the database itself, not merely on screen.
• Photographs have no public address. They are reachable only through a link that is generated for one signed in person and expires shortly after.
• Every change to a record is logged with who made it and when, and the log cannot be edited.
• There is no public sign up. An account exists only because a shop owner or we created it.

Under PIPEDA you can:

• Ask what is held about you, and be given a copy.
• Ask for anything wrong to be corrected.
• Ask what it has been used for and who it has been given to.
• Withdraw consent, subject to what the law or a contract requires.
• Complain, and be told what came of the complaint.

Ask the shop first, because the record is theirs and they can answer faster. If you cannot reach them, or the request is about the software rather than the repair, write to info@teardownauto.com and we will respond within thirty days.

If you are not satisfied with the answer, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Only for people who sign in to the software, and on a shop's timesheet device. One keeps you signed in between pages. A second exists only while a shop owner is connecting QuickBooks: it lasts ten minutes and proves the connection was started by that person, here.

A timesheet device carries two of its own. One keeps it set up as that shop's clock, for up to 400 days or until the owner takes it off. The other is set when somebody types their code and ends two minutes after the last thing they did, so the next person at the device cannot open their page.

There are no advertising or tracking cookies, and there is nothing here that follows a visitor to another site.

If this changes in a way that affects what is done with your information, the date at the top changes and shops are told. The previous wording is kept.