Privacy Policy

1. Two kinds of users

Client Shops are the businesses that sign up for Scaled to Perfection. Client Shops are our direct customers.

End Customers are the leads and customers a Client Shop adds to the Platform — the consumers who reach out to the shop for detailing, tint, PPF, or ceramic coating. We process End Customer data on behalf of the Client Shop as a service provider / data processor. The Client Shop is the controller of that data.

2. What we collect

From Client Shops:

• Account info: business name, owner name, email, password (hashed), timezone
• Billing info: handled by Stripe; we store only Stripe customer + subscription IDs
• Login activity: timestamp, IP address, user-agent — for security and audit logging
• Connection credentials for integrations you opt into (Quo, Urable, GoHighLevel)

From End Customers (entered by the Client Shop):

• First and last name
• Phone number and email
• Vehicle year, make, model
• Lead source (Facebook, Google, website, referral, walk-in)
• Notes the shop adds about the customer's service interest
• SMS conversation history sent through the shop's connected VoIP provider

3. How we use it

• To provide the Platform — running pipelines, sending the shop's scheduled follow-up texts, threading replies, drafting proposals via the shop's connected tools
• To send transactional emails (account verification, password reset, billing receipts)
• To monitor for security threats — anomaly detection, rate limiting, audit logging
• To improve the Platform — aggregate usage analytics, never tied to a specific End Customer

We do not sell End Customer data. We do not use End Customer data to train AI models. We do not advertise to End Customers.

4. Who we share data with

We share data with the following sub-processors, listed in full at /sub-processors:

• Supabase — primary database, encrypted at rest
• Vercel — application hosting
• Stripe — billing (Client Shops only; End Customer data is never sent to Stripe)
• Quo, GoHighLevel — SMS delivery, only when the Client Shop has connected one of these
• Urable, OrbisX, Tint Wiz, Housecall Pro — proposal / job management, only when the Client Shop has connected one
• Resend / Postmark — transactional email delivery

We do not share data with any other third party except (a) to comply with law, (b) to enforce our Terms, or (c) with the Client Shop's explicit instruction.

5. How long we keep it

• Active accounts: kept for the life of the account
• After account cancellation: 30 days, then permanent deletion (allows for accidental cancellation recovery)
• Backups: rolling 7-day retention; backups age out automatically
• Audit logs: 13 months
• Security alerts: 13 months

6. How we protect it

• All data encrypted in transit (TLS 1.2+) and at rest (AES-256)
• Row-Level Security in Postgres — Client Shops cannot access each other's data, enforced at the database layer
• Sensitive fields (phone, email) protected by application-layer field encryption
• Audit log records every read of a customer record
• Two-factor authentication available on all accounts
• Anomaly detection cron flags suspicious access patterns (multi-IP sessions, headless user-agents, action bursts)
• Rate limiting on all API endpoints to prevent bulk extraction
• Watermarking — outbound SMS and emails embed an invisible fingerprint identifying the sender, so leaked content is traceable

7. Your rights

If you are a Client Shop:

• Export your data at any time (Settings → Account)
• Delete your account (contact info@ptpautodetails.com)
• Update your account info at any time

If you are an End Customer:

Because we process your data on behalf of the Client Shop that you provided it to, all rights-related requests should go through that shop in the first instance. You may also email info@ptpautodetails.com and we will forward your request to the appropriate Client Shop.

Specifically:

• Opt out of SMS: reply STOP to any text. Your number is added to do-not-contact across the shop's pipeline immediately.
• Access / delete: request a copy of your data or its deletion via the Client Shop or directly with us.
• California residents (CCPA / CPRA): right to know, right to delete, right to opt out of sale (we do not sell data), right against discrimination for exercising these rights.

8. Children

The Platform is not directed to children under 13. We do not knowingly collect data from anyone under 13. If you believe we have collected such data, contact us and we will delete it.

9. International users

The Platform is operated from the United States and stores data in U.S. data centers. If you use the Platform from outside the U.S., your data will be transferred to and processed in the U.S.

10. Breach notification

In the event of a data breach affecting your personal information, we will notify affected Client Shops within 72 hours of discovery. Client Shops are responsible for notifying their own End Customers as required by applicable law. We will provide the information and assistance necessary for them to do so.

11. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify Client Shops by email and prompt them to re-acknowledge on next sign-in. The "Effective" date above always reflects the current version.

12. Contact

Questions about this policy or our data practices: info@ptpautodetails.com

Scaled to Perfection · 4707 County Road 156, Unit 203, Wildwood, FL 34785