Privacy Policy

• Shops are our customers. If you subscribe to CaliperX to run your repair business, we hold your account and billing details and we decide how they are used. For that information, we are the controller.
• Vehicle owners are the shop’s customers, not ours. If you booked an appointment with a shop, that shop chose what to collect and why. We store and process it on their behalf and on their instructions. For that information, the shop is the controller and we are their processor.

If you are a vehicle owner and you want your information corrected or deleted, the fastest route is to contact the shop you booked with — it is their record. Section 8 explains what to do if you cannot reach them.

• Account details — your name, email address or username, and a password.
• Business details — shop name, phone, email, address, service area, time zone, hours, services and prices, tax settings, travel fee, and the mechanic photo and first name you choose to show on your booking page.
• Subscription details — plan, status, renewal date, and identifiers from our payment processor. We never receive or store your full card number.
• Records you create — customers, vehicles, jobs, bookings, estimates, invoices, receipts, payments, inspections, expenses, mileage, parts, notes and photos.
• Staff accounts — the name, username and hashed password of any tech you add.
• Device tokens — if you turn on notifications, a push token and a device name, so a notification can reach the right phone.
• Acceptance record — which version of the terms you accepted, when, and the network address it came from.
• Technical logs — request and error logs generated by our hosting provider in the ordinary course of running the service.

When you book with a shop through its page, that shop collects your name and phone number, and — depending on what it asks for — your email address, service address, vehicle details including VIN and license plate, what is wrong with the vehicle, and any photos you attach.

Address and vehicle details exist so the mechanic can find you and bring the right parts. Nothing is required beyond what the shop’s booking page asks for.

If you sign an estimate or invoice, the record saved is the signature you drew, your name, the amount you agreed to, a frozen copy of the line items you were shown, the date and time, your network address and your browser identifier. Those last items exist so the shop has meaningful evidence of what was agreed.

If a shop completes a Turo annual inspection for you as the host, it records your name, and the email address, phone number and signature you provide when you sign the form.

Where. All data is held in the United States, on cloud infrastructure operated by our hosting provider, Railway, which runs on established data-center providers. We do not operate our own servers.

In what. Records live in a PostgreSQL database that is private to the service and not reachable from the public internet. Each record is tagged with the shop that owns it, and every request is filtered by that ownership so one shop cannot read another’s data.

Photos and signatures. Vehicle photos, inspection photos, your shop photo and signature images are stored as binary data inside that same database, not in a public file bucket. There is no public web address for an image, so an image cannot be found by guessing a URL or picked up by a search engine.

Passwords. Passwords are hashed with bcrypt and never stored in a readable form. We cannot see your password, and we cannot tell you what it is — we can only help you set a new one.

In transit. All traffic between your phone or browser and the service is encrypted with HTTPS/TLS. The connection between the service and its database is likewise encrypted.

Document links. Estimates, invoices, receipts, inspection reports and reschedule links are reached through a randomly generated address of 24 random bytes. They cannot be guessed or counted through, and they are marked so search engines do not index them. Anyone holding a link can open that one document, which is what makes it possible to text one to a customer.

Backups. The database is backed up by our hosting provider. Backups are held in the same region and are encrypted at rest. A deleted record may persist in a backup for a period after deletion before it is rotated out.

Access. Access to production data is limited to the people who operate CaliperX, and is used only to run the service, fix a fault or respond to a support request.

We do not sell personal information, we do not share it with other shops, and we do not use it to advertise to you. We have never sold personal information and we do not share it for cross-context behavioral advertising.

Ad measurement on our public website only. The pages of caliperx.app you can see before signing in (the home page, pricing, sign-up and the pages around them) load Google Ads conversion tracking, which sets a cookie so Google can tell us when a visit that started from one of our ads led to a sign-up. It is not loaded in the app, in the browser dashboard, in your account pages, or on any page your customers open (booking pages, estimates, invoices, inspection reports). It does not receive your name, email or anything you type into the app. If you arrived from one of our Google ads, we also keep the click identifier Google appended to the link, for 90 days in a cookie and then on your account, solely so we can report back to Google that the click led to a paid subscription. You can block it with your browser's cookie settings and the site still works.

We use a small number of service providers, each of which processes data only to provide its service to us:

• Railway — hosting, the database and its backups.
• Stripe — subscription billing for shops. Stripe receives the card details a shop enters and holds them; we receive only a customer and subscription identifier and the status of the subscription.
• Expo — delivery of push notifications to a shop’s own phone. Expo receives the device token and the notification text.
• The US National Highway Traffic Safety Administration — when a VIN is decoded, the VIN is sent to its public vPIC lookup to retrieve vehicle specifications. No personal information is sent with it.

We may also disclose information where the law requires it, to respond to a valid legal process, to protect the rights or safety of a person, or to enforce our terms. If Skyrocket Motorsports is ever involved in a merger, acquisition or sale of assets, account data may transfer as part of that transaction, and this policy will continue to apply until it is replaced.

• While your account is open, records are kept until you delete them. Deleting a job, document or customer moves it to the trash, where it stays recoverable for 30 days and is then removed.
• After an account closes — because you closed it, or because a subscription was canceled for non-payment — it is locked and kept for 90 days so you can come back to it. Within that window we email you a copy of your records. At the end of the 90 days it is deleted, except where we must keep something longer for legal, tax or dispute-resolution reasons.
• Inspection photos are kept for 99 days after the inspection is completed, which is also how long the report’s web link works. After that the photos are deleted and the report remains available to the shop as a PDF without them.
• Backups are rotated on our hosting provider’s schedule, so a deleted item can persist in a backup for a period after it disappears from the live service.
• Shops keep their own service records for their own business and legal reasons, including tax and repair-order requirements. That retention is the shop’s decision, not ours.

You can ask us to delete your account data sooner — see section 8.

We never process payments between a vehicle owner and a shop. You pay the mechanic directly, by whatever method the two of you agree. We never see or store your card details for that payment. What appears in the software is a note the shop typed to keep its own books.

A shop’s subscription payment to us is handled by our payment processor, which holds those card details. We do not.

Depending on where you live — including under the California Consumer Privacy Act and similar laws in Virginia, Colorado, Connecticut, Utah, Texas and other states — you may have the right to know what personal information is held about you, to get a copy, to correct it, to delete it, and not to be discriminated against for exercising those rights.

• Shops can view and edit their information in the app, export their records while the account is active, change a password, and ask us to close an account and delete its data.
• Vehicle owners should contact the shop they booked with, because it is the shop’s record and the shop decides. If you cannot reach them, write to us and we will pass the request on and help where we can.
• Your booking link lets you view, reschedule or cancel without an account. Keep it private — anyone holding it can see and change that booking.
• Notifications can be turned off on your device at any time.

To make a request, email support@caliperx.app. We may need to verify who you are before we act, and we will respond within the time the applicable law allows.

Traffic is encrypted in transit. Passwords are hashed and never stored in readable form. Sessions can be revoked. Access to a record is restricted to the shop that owns it, and document links are long random values that cannot be guessed.

No system is perfectly secure, and we do not claim otherwise. If we become aware of a breach affecting personal information, we will notify affected shops and, where the law requires it, the relevant authorities and individuals, without undue delay.

CaliperX is a tool for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 13. If you believe a child’s information has been entered, contact us and we will remove it.

We may update this policy. The version number and effective date at the top always tell you which one is current, and we will give shops reasonable notice of a material change before it takes effect.

CaliperX is operated by Skyrocket Motorsports, based in Tennessee, United States, which is the controller of shop account information described in this policy.

Privacy questions, data requests and anything else about this policy: support@caliperx.app.