Privacy Policy
This Privacy Policy explains how Bay Three Software Inc. (“Bay Three”, “we”) collects, uses, and protects personal information in connection with WrenchFlow (the “Service”). Bay Three is the controller of the personal information described here, and complies with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).
1. Information we collect
We collect information in three broad categories:
Account information
- Name, email address, phone number, business name, and role of users at shops using the Service.
- Authentication information (passwords are stored using industry-standard hashing).
- Billing contact information and the last four digits of your payment card (full payment details are handled by Stripe and are not stored by us).
Customer Data submitted by shops
- Shop customer names, phone numbers, email addresses, and vehicle information.
- Service history, inspection results, photos, videos, and SMS conversations.
- Invoices and payment records.
Usage and technical information
- Log data such as IP address, browser, device, pages visited, and timestamps.
- Diagnostic and error information used to keep the Service reliable.
2. How we use information
- To provide, operate, and improve the Service.
- To authenticate users and protect against fraud and abuse.
- To process payments and send transactional notifications.
- To respond to customer-service requests.
- To comply with legal obligations.
We do not sell personal information, and we do not use Customer Data to train third-party AI models.
3. Service providers
We share information with service providers who help us operate the Service, under contracts that limit how they may use it:
- Stripe — payment processing.
- Twilio — SMS and voice delivery.
- SendGrid or AWS SES — transactional email.
- Cloud infrastructure providers — hosting, storage, and backups.
- Sentry — error monitoring.
Some of these providers may process information outside Canada, including in the United States. We use providers that maintain appropriate safeguards for cross-border data transfers.
4. Disclosures required by law
We may disclose personal information where required by law, court order, or to protect our rights, the safety of users, or the integrity of the Service.
5. Retention
We retain personal information for as long as your account is active, and for a reasonable period afterward to comply with legal, accounting, or reporting requirements. Customer Data is made available for export for a reasonable period after account closure, after which it is deleted from active systems and from backups in the ordinary course.
6. Your rights
Subject to applicable law, you have the right to access, correct, or request deletion of your personal information, and to withdraw consent where consent is the basis for processing. Shop customers should contact the shop that holds their records first; if the shop is unable to assist, we will help where we are able.
7. Security
We use administrative, technical, and physical safeguards to protect personal information, including encryption in transit, access controls, isolated tenant databases, and regular backups. No system is perfectly secure; we cannot guarantee that information will never be accessed by an unauthorized party.
8. Cookies
The Service uses a small number of cookies that are necessary for authentication and session management. We do not use third-party advertising cookies on the marketing site or in the Service.
9. Children
The Service is intended for businesses and is not directed at children under 13. We do not knowingly collect personal information from children.
10. Changes to this policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the latest version. Material changes will be communicated in advance.
11. Contact
Privacy questions or requests can be sent to hugo@baythreesoftware.ca.