Public website
No behavioral ad network
Infrastructure sees ordinary request metadata. The demo form drafts an email on your device and sends nothing on its own.
Privacy policy
Your shop's data stays yours.
This policy states how the VehicleDesk website and workspace handle information: what is collected, how it is used, who processes it, how it is protected, and how to make a request.
At a glance
The short version.
VehicleDesk processes shop operating data for the workflows the shop runs. The public site uses no behavioral advertising trackers. Every customer message is consent-checked before it sends.
Workspace
Shop data stays tenant-scoped
Roles and capabilities scope access to customer, vehicle, service, payment, consent, and operational records to the shop that owns them.
Consent
Communication choices are explicit
VehicleDesk records consent and suppression evidence on every contact point and checks it before every message.
01
Scope
This policy covers the VehicleDesk marketing website and the authenticated VehicleDesk workspace. VehicleDesk is the operating platform for independent auto repair shops. The workflows, integrations, and support each shop runs are set in that shop's agreement.
This page describes current production behavior.
02
Information VehicleDesk handles
The workspace processes the information the shop's workflows need, including:
- Shop and staffBusiness profiles, settings, staff accounts, roles, authentication state, sessions, security notices, and access history.
- Customers and communicationNames, contact details, communication preferences, consent, suppression, and do-not-contact status.
- Vehicles and serviceVehicle identifiers, mileage, service context, repair orders, estimates, invoices, parts, appointments, reminders, and operational notes.
- Operations and securityRecorded payments, weekly-close records, portal activity, worker status, synchronization evidence, data-quality findings, audit records, and diagnostic metadata.
Shopmonkey stays the system of record for the repair and financial records VehicleDesk imports. VehicleDesk stores the workflow, audit, consent, suppression, and operational records its own features create.
03
How information is used
- Run the shop's workflows: daily operations, customer and vehicle context, parts and weekly close, appointments, reports, reminders, tasks, compliance visibility, and customer portal views.
- Import and synchronize records from Shopmonkey and show connection, freshness, mapping, conflict, and data-quality evidence.
- Authenticate users and enforce role, capability, tenant, origin, CSRF, rate-limit, consent, and suppression controls.
- Operate audit, security, backup, troubleshooting, support, and incident-response processes.
- Prepare drafts and recommendations in guarded workflows. Staff approve every message before it sends, and staff make every change to consent or to Shopmonkey.
04
Consent and communication choices
VehicleDesk stores communication-consent and suppression evidence: contact-point status, authorized recurring-SMS categories, disclosure references, consent and revocation timestamps, and source-document references.
The customer portal asks the customer to choose categories and agree before recurring SMS enrollment, and it provides a stop action. Staff record a customer's reminder request without changing the customer's SMS consent.
05
Service providers and sharing
VehicleDesk shares information only to run a feature the shop uses, follow an authorized shop instruction, protect the service, or meet a legal obligation.
- Production infrastructure providers process application traffic, stored records, operational logs, and security metadata needed to provide the service.
- The Shopmonkey connection processes customer, vehicle, invoice, service, and payment information for authorized import and synchronization.
- Messaging, Google, and AI providers receive information only for the features the shop has enabled.
The public website uses no behavioral advertising network. VehicleDesk does not sell personal information.
06
Security and access controls
Protected transportThe public site, the workspace, and the API run over TLS 1.2 or later.
Account controlsServer-managed sessions, tenant-scoped roles, mutation protections, rate limits, and TOTP MFA protect every account.
Scoped portalsCustomer portal links expire, can be revoked, are token-hash based, and are read-only for the permitted customer view.
Shop-approved supportSupport diagnostics require a shop-approved, time-limited, scoped grant and a case-specific audited reason.
07
Retention, export, and deletion
Records follow the lifecycle of the workflow that created them, the shop's operations, Shopmonkey's behavior for source records, and provider configuration.
- Specific records are revoked, archived, or deleted through the product workflows that own them.
- When a shop cancels, its data exports with it. Shopmonkey keeps every source record throughout.
- Suppression and opt-out evidence is retained so a customer is never contacted against a recorded preference.
08
Privacy requests
Existing customers send privacy requests through the support contact inside their workspace. We verify identity and authority before we discuss or change information.
The shop answers requests about the customer data it controls, and VehicleDesk supports the shop in fulfilling them.
09
Children and policy updates
VehicleDesk is a business application for repair shops and their staff. It is not directed to children.
This policy is updated when hosting, providers, retention, or privacy practices change, and the date at the top of the page moves with it.