Privacy Policy

Lionwood Studio Ltd (England, company no. 17025936) operates Vector — an operating system for auto service businesses. This policy explains how personal data is processed on three surfaces: the marketing website vectorcrm.app, the shop platform used by auto service businesses ("shops"), and the mobile app for car owners. Contact: contact@vectorcrm.app.

• Your phone number is your identity in Vector — for car owners there is no email login.
• Shops enter data about their customers, vehicles and repairs. Each shop owns and controls its own records; we host and process them for the shop.
• When you activate the app, you automatically see your vehicles' service history from every shop connected to Vector (§7). Shops do not see each other's records.
• Some content is prepared with AI (OpenAI); a shop employee reviews customer-facing explanations before you see them (§8).
• Payments for repairs go directly to your shop via its payment provider; we never see card details.
• We use a small set of processors (AWS, Google/Firebase, OpenAI, Cloudflare and similar); some are in the US — we use approved transfer safeguards (§12).
• The website sets one functional cookie (your language). Google Analytics runs only if you accept it in the cookie banner. No advertising trackers.
• You have data-protection rights (§15). Some financial records are legally immutable and are kept even after deletion requests.

Each shop connected to Vector is an independent controller of its own records. The Cross-Shop History view assembles records from several independent controllers and shows them to you only, at your request, when you use the app. For questions about a specific repair record, the primary addressee is the shop that created it; we forward requests we receive (§15).

Data: name, shop name, city (optional), email and/or phone, your message; language preference (cookie); technical server logs (IP, user agent) kept short-term for security.
Source & delivery: the beta form; delivered to our mailbox via Resend.
Purposes / lawful bases: responding to your request and preparing cooperation (Art. 6(1)(b) UK GDPR — steps prior to a contract; Art. 6(1)(f) — legitimate interest in operating and securing the site).
Analytics (consent-based): with your consent given via the cookie banner, we use Google Analytics 4 to understand aggregate site usage (pages viewed, approximate region, device type). Declining does not limit the site in any way; you can change your choice via "Cookie settings" in the footer (§16). Basis: consent (Art. 6(1)(a)). No advertising trackers are used.

Data: name, phone number (login), password hash, role, location access, language, activity and audit records of actions in the platform (who changed what, when).
Purposes / bases: providing the platform under the contract with the shop (Art. 6(1)(b) towards the shop; for staff members our basis is legitimate interest in serving our business customer and securing the service, Art. 6(1)(f)); security and audit obligations (6(1)(f)); legal compliance (6(1)(c)).
Audit records are retained as immutable security records.

Data we process:
- Identity: phone number (verified by one-time code via Firebase), display name you set, language.
- Vehicles: VIN, plate, make/model/specs, mileage, photos, and the vehicle data shops record for you.
- Service records made visible to you by shops: work orders, diagnostic findings (condition statuses, wear), approvals you give or decline, invoices and payment status.
- Approvals: your in-app decisions are recorded (what, when, from which channel) — they form the audit trail of your instructions to the shop.
- Payments: transaction reference, amount, status only. Card data is entered in your shop's payment provider (LiqPay/WayForPay) interface and never reaches Vector.
- AI assistant (premium, when available): the questions and symptom descriptions you type, and the context listed in §8.
- Notifications: push token (Firebase Cloud Messaging), notification log. Push permission is optional and controlled in your device/app settings.

Purposes / bases: providing the app service you request — including showing you your service history and processing your approvals (Art. 6(1)(b)); security, fraud prevention and audit (6(1)(f)); compliance (6(1)(c)); optional features you enable (consent, 6(1)(a), where applicable).

When you activate the Vector app, we match your phone number against customer records at all shops connected to Vector. From that moment the app automatically shows you the customer-visible service history of your vehicles from all of those shops — past and future.

What this does and does not mean:

• You see your consolidated history. This is the point of the feature: your car's story in one place.
• Shops do not see each other's records. A shop only ever sees its own records about you.
• When a shop looks you up by phone number, it sees only limited context: your name, whether you have activated the app, and how many vehicles are linked — not other shops' service data.
• A shop may ask you to share your vehicle data with it; that is your choice.
• Current limitation: the app does not yet offer per-shop controls to hide parts of your history. If you object to specific records being shown to you in the consolidated view, contact contact@vectorcrm.app and we will handle it manually. Visibility controls are on the product roadmap.

Lawful bases: performance of the app contract with you (showing you your own data, Art. 6(1)(b)); legitimate interests in phone-based record matching and the limited lookup context that prevents duplicate identities (6(1)(f)) — you may object (§15).

Vector uses AI models (currently OpenAI, processing in the US) for:

• Repair and part explanations, service summaries (shop side): the model receives a snapshot of the relevant work context — mechanic comments, condition statuses, parts and labour lines, vehicle profile. A shop employee reviews and approves these texts before you see them.
• AI assistant (app, premium): the model receives your typed questions/symptoms plus your customer-visible context (vehicle profile, visible history, approved explanations). It never receives shops' internal notes or content not marked visible to you.

Commitments and limits: AI output is informational — it explains, it does not diagnose; we do not use AI for automated decisions with legal or similarly significant effects (Art. 22); do not type other people's personal data into free-text fields; our API arrangements with the provider do not permit use of your data for model training.

Photos/videos documenting vehicle condition and work are uploaded by shop staff (or you) and stored in AWS S3 with per-tenant path isolation. Media is internal to the shop by default; a shop manager decides what becomes visible to you. Don't include people or unrelated personal items in frame where avoidable.

Sub-processors/processors we use (canonical list, kept identical with Schedule 2 of the Terms of Service): Amazon Web Services (S3) — media/files; Google Firebase — phone verification and push, US/global; OpenAI — AI features, US; Cloudflare — hosting/CDN/security, US/global; TecDoc — parts-catalogue queries, Germany; SMS gateway provider — SMS invites; Telegram/WhatsApp (Meta) — messenger invites; Resend — website transactional email, US.

Website analytics (only with your consent, §16): Google Analytics 4 — Google Ireland Ltd / Google LLC (US).

Also receive data: the shop(s) you deal with (they see their own records about you and your approval decisions); LiqPay / WayForPay — your shop's payment providers under the shop's own merchant agreements (we receive only reference/status/amount); authorities where the law requires; professional advisers under confidentiality.

We do not sell personal data and do not share it with advertisers.

We are a UK company; some processors are in the US or operate globally. Transfers from the UK rely on: the UK Extension to the EU–US Data Privacy Framework where the vendor is certified; otherwise the UK International Data Transfer Agreement / Addendum with a transfer risk assessment; UK adequacy for EEA processing. For users in Ukraine: data is transferred to the UK and onwards as described; Ukrainian law (Law 2297-VI) treats transfers to GDPR-aligned jurisdictions as permitted.

Principles: we keep personal data while the relevant account or record is active, then delete or de-identify per schedule. The platform uses a deactivate-not-delete model for operational integrity, and some records are immutable by design (issued invoices, approval history, audit and stock ledgers) — they are retained for statutory record-keeping periods even if other data is erased.

Honest note: self-serve deletion is not yet available in the product; deletion requests are fulfilled manually (§15) within statutory timelines.

TLS encryption in transit; role-based access with per-location scoping; support tooling shows masked phone numbers and VINs, with unmasking audited; no staff impersonation of users; read-only support access; tenant separation including path-isolated media storage; audit logging of sensitive actions; integration secrets stored in secret storage and never redisplayed. No system is 100% secure; we notify affected controllers/subjects of breaches as the law requires (72h processor commitment in the DPA).

Under UK GDPR (and, for Ukrainian data subjects, Law 2297-VI): access, rectification, erasure, restriction, portability, objection (including to legitimate-interest processing such as §7 matching), and withdrawal of consent. How: email contact@vectorcrm.app; we verify identity via your registered phone (OTP); response within one month (extendable per law).

Limits you should know about: records we hold as processor belong to the shop — we forward your request to it and assist; immutable financial/approval/audit records are retained under legal obligation (Art. 17(3)(b)) and for legal claims (17(3)(e)) even after erasure of your profile; erasing your app account does not erase the shops' lawful business records about services they performed.

Complaints: UK — Information Commissioner's Office (ico.org.uk, reg. no. pending); Ukraine — the Ukrainian Parliament Commissioner for Human Rights. We'd appreciate the chance to resolve issues first: contact@vectorcrm.app.

Functional (no consent needed): `vector_locale` — your language choice, 12 months; `vector_consent` — remembers your analytics choice, 180 days.

Analytics (only with your consent): if you press "Accept" in the cookie banner, Google Analytics 4 sets its statistics cookies (`_ga` and `_ga_*`, up to 2 years) to measure aggregate site usage. Until you accept, nothing from Google loads. You can change or withdraw your choice at any time via "Cookie settings" in the site footer (this clears the stored choice and shows the banner again) or by deleting cookies in your browser.

No advertising cookies are used. We will update this policy before introducing any new categories.

Vector is not directed at persons under 18. Vehicle ownership context assumes adults; we do not knowingly process children's data. Contact us to remove data of a minor.

We version this policy and give notice of material changes in the app/on the site before they take effect. Previous versions are available on request.

LIONWOOD STUDIO LTD, 17 Church Lane, Heckmondwike, England, WF16 0AT · contact@vectorcrm.app · support: contact@vectorcrm.app.