Privacy policy

Who we are

CarroTEQC is online management software for collision repair shops. It is a Zasenami service, in Quebec. In this policy, "we" means CarroTEQC.

The person in charge of protecting personal information at CarroTEQC is Sebouh. You can write to him at confidentialite@carroteqc.ca.

Two different roles

For a shop's customers (the people who have their vehicle repaired), the shop decides what information it collects and why. We keep and process it for the shop, on its instructions: we are its service provider.

Each shop has its own privacy page, with the name of its person in charge. The "Privacy" link is at the bottom of the pages the shop sends you. For a question about your file, ask the shop first.

For CarroTEQC accounts (staff of shops, groups and banners), we decide how the information is used. The rest of this policy applies to you directly.

What we collect about accounts

• Your name, email, language, role and the shops you work in.
• Your sign-ins: date and time, IP address, device, failed attempts, and the state of your 2-step verification.
• The security log: invitations, role changes, deactivations, settings changes, report and file exports.
• What you enter at work: notes, messages between colleagues, photos, punched hours.
• The reports you send us with "Report", and the software's technical errors.
• If you turn on notifications: your browser's subscription address.

CarroTEQC has no advertising and no ad tracking. Cookies are used only to make the software work, for example to keep you signed in.

Why

• To provide the service: sign you in and show each person their shop's data, according to their role.
• To protect accounts: 2-step verification, the security log, blocking repeated attempts.
• To help you: answer your reports and fix errors.
• To bill the shop's subscription, once billing is in place.

We sell no personal information and do not use it for advertising. We train no artificial intelligence model with your data.

Where the data is

The database and the files (photos, documents, PDFs) are hosted by Supabase, in its Canada region (Montreal).

The software itself is served by Vercel, set to its Montreal region. Vercel is an American company and its global network carries the traffic: a request may pass through a server outside Canada.

Some of the services below process information outside Canada, mostly in the United States. That information may then be subject to the laws of those countries.

The companies that help us

These providers process information for us, only to run CarroTEQC:

• Supabase: database, files and account sign-in. In Canada (Montreal).
• Vercel: hosting of the software. Servers in Montreal; American company, global network.
• Resend: sending emails (sign-in, messages to customers) and receiving estimates sent by email. In the United States.
• Twilio: text messages to customers, once that service is turned on. In the United States.
• Cloudflare: anti-robot check (Turnstile) on the sign-in pages, and forwarding of emails sent to our @carroteqc.ca addresses. Global network.
• Anthropic (Claude): the artificial intelligence features (reading PDF estimates, help, the shop's memory, drafts, photo checks). The text, PDFs or photos sent are processed in the United States; Anthropic does not use them to train its models. Nothing is sent until a person starts the feature.
• Intuit (QuickBooks): only if the shop connects its accounting. Invoices, payments, and the name and contact details of billed customers are copied into the shop's QuickBooks account.
• Stripe: payment of the shop's subscription, once billing is in place.
• NHTSA (United States government): a vehicle's serial number (VIN), with no name, is sent to its public decoder to find the year, make and model.

Notifications: if you turn them on, they travel, encrypted, through your browser's notification service (for example Google, Apple or Mozilla).

Voice dictation: CarroTEQC uses your browser's or keyboard's dictation. Depending on your device, the sound may be processed by Apple or Google; CarroTEQC receives only the text and keeps no sound.

How we protect the data

• 2-step verification (authenticator app), required by default for the owner, the manager and the accountant; the owner chooses for each role. Always required for the CarroTEQC team and for members of a group or banner.
• Signed out after 12 hours without activity, and a new sign-in at least every 30 days (except shop screens, like the TV board).
• Anti-robot check on sign-in, sign-up and forgotten password.
• Each shop sees only its own data: the rule is enforced by the database itself, not only by the screens.
• A security log the owner can read and export. It is kept 2 years.
• An encrypted backup copy of the database and the files, made every night and kept 14 days by Zasenami, in Quebec.
• Encrypted connections (HTTPS) between your device and CarroTEQC.

No measure is perfect. If an incident happens, see below what we do.

How long we keep the data

• Files of a shop's customers: per the shop's setting, at least 7 years after the last activity. Then the personal information is erased automatically; the amounts stay for statistics, without a name.
• Deleted photos and documents: 30 days in a trash, then erased for good.
• Security log: 2 years.
• Backup copies: 14 days.
• Your account: as long as you use CarroTEQC. To close it, write to us.

Your rights

You can ask to see the information we hold about you, have it corrected, or ask that it be erased when nothing requires us to keep it. Write to confidentialite@carroteqc.ca. We answer within 30 days.

Are you a shop's customer? Send your request to the shop: its privacy page gives the name of its person in charge. The shop can export your file and erase your information in CarroTEQC. If you write to us, we will pass your request on to the shop.

You can also file a complaint with Quebec's Commission d'accès à l'information (cai.gouv.qc.ca).

Confidentiality incidents

We keep a register of confidentiality incidents. If an incident affects information a shop entrusts to us, we tell the shop without delay. When an incident presents a risk of serious harm, the Commission d'accès à l'information and the people affected are notified.

Changes

If we change this policy, the date at the top of the page changes. For an important change, we tell shop owners by email.

Contact us

CarroTEQC, a Zasenami service, Quebec. Email: confidentialite@carroteqc.ca.