Privacy Policy

1. Introduction

This Privacy Policy describes how Refit LLC (“Company,” “we,” “us,” or “our”), operating under the brand name ShopForge, collects, uses, stores, and protects personal information when you use our shop management platform (the “Service”). By using ShopForge, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

• Account Information: When you register for ShopForge, we collect your name, email address, phone number, business name, and business address.
• Customer Data: You may enter information about your customers into ShopForge, including names, phone numbers, email addresses, mailing addresses, and vehicle information (make, model, year, VIN, license plate number).
• Service Data: We collect information generated through your use of the Service, including work orders, estimates, invoices, inspection reports, appointment records, purchase orders, time clock entries, parts inventory, and SMS message logs.
• Media: Photos and videos uploaded through the Service, including vehicle inspection photos and annotated images.
• Payment Information: Payment processing is handled by Stripe, Inc. We do not directly store credit card numbers. We store transaction references, invoice amounts, and payment status.
• Usage Data: We automatically collect information about how you access and use the Service, including IP addresses, browser type, pages visited, and timestamps.
• Communications: SMS messages sent and received through the Service via Twilio are logged, including phone numbers, message content, and timestamps.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process transactions and send related information
• Send appointment reminders, service notifications, and invoice payment links via SMS and email
• Synchronize financial data with QuickBooks Online when you enable the integration
• Generate reports and analytics about your business operations
• Respond to your requests, comments, and questions
• Comply with legal obligations

4. Third-Party Services

We share information with the following third-party service providers who assist us in operating the Service:

• Supabase: Database hosting and authentication. Your data is stored in Supabase's cloud infrastructure with row-level security ensuring complete isolation between shops.
• Stripe: Payment processing. When customers pay invoices via payment links, Stripe processes the transaction. Stripe's privacy policy governs their handling of payment data.
• Twilio: SMS messaging. Phone numbers and message content are transmitted through Twilio's network for sending and receiving text messages.
• Intuit QuickBooks: Accounting synchronization. When you connect QuickBooks, customer names, invoice details, and payment records are transmitted to your QuickBooks account.
• Resend: Email delivery. Email addresses and message content are transmitted through Resend for sending invoices, estimates, and notifications.
• PlateToVIN: Vehicle identification. License plate numbers and state information are transmitted to look up vehicle details.
• Vercel: Application hosting. The Service is hosted on Vercel's infrastructure.

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

5. Data Isolation and Security

ShopForge is a multi-tenant platform. Each shop's data is isolated using database-level row-level security (RLS) policies. This means no shop can access, view, or modify another shop's data. All data is transmitted over encrypted HTTPS connections. Sensitive credentials (API keys, authentication tokens) are encrypted at rest and masked in user interfaces. Access to administrative functions is protected by strong authentication keys.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide you the Service. If you cancel your subscription, we will retain your data for 90 days to allow for reactivation, after which it will be permanently deleted. You may request earlier deletion by contacting us.

7. Your Rights

• Access: You may request a copy of the personal data we hold about you.
• Correction: You may update or correct your information through the Service's settings or by contacting us.
• Deletion: You may request deletion of your account and associated data.
• Data Export: You may export your customer, vehicle, and parts data in CSV format through the Service's import/export functionality.
• Opt-Out of SMS: Your customers may opt out of receiving SMS messages by replying STOP to any message sent through the Service.

8. California Privacy Rights (CCPA)

If you are a California resident, you have the right to:

• Know what personal information we collect and how it is used
• Request deletion of your personal information
• Opt out of the sale of personal information (we do not sell personal information)
• Not be discriminated against for exercising your privacy rights

To exercise these rights, contact us at the address below.

9. Children's Privacy

ShopForge is a business-to-business service and is not directed at individuals under the age of 16. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on the Service and updating the effective date. Your continued use of the Service after changes are posted constitutes acceptance of the revised policy.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, contact us at: