Privacy Notice
Version: 2026-12-06, published on 6 November 2026 (problem reports redacted on GitHub, reasons for remembered devices, card payment, data of the workshops' customers); amended on 6 November 2026: card payment is active
This notice covers Garagevo's own processing, where the Provider is the controller. For the workshops' customer data the workshop is the controller and Garagevo only a processor (see the Data Processing Agreement); the workshop informs its own customers.
Controller: VMS-KER Kft., Hajnal utca 32., 2111 Szada, Hungary, info@garagevo.hu, +36 70 603 6462. Data protection questions: adatvedelem@garagevo.hu.
Processing
| Processing | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Account and sign-in | name, e-mail, password (hashed), role, sign-in time, IP address | using the program | contract, Art. 6(1)(b) GDPR | 30 days after the account ends |
| Acceptance of the Terms | who accepted which version and when, the contracting business's data, the text and time of the declaration of business purpose and authority to represent | proof of the contract | legitimate interest, Art. 6(1)(f) | 5 years after the contract ends |
| Notice of amendments to the Terms | the owners' e-mail addresses, the version, the time of sending | proof of the prior notice (Terms clause 12) | legitimate interest, Art. 6(1)(f) | 5 years after the contract ends |
| Reference permission (founder offer) | time and text of giving and withdrawing it, the user giving it; as a reference the company name, trade name and logo | mentioning the workshop as a reference | consent, Art. 6(1)(a), can be withdrawn at any time | the reference until withdrawal, the log 5 years after the contract ends |
| Subscription and invoicing | company name, address, tax number, contact, invoices | payment | legal obligation, Art. 6(1)(c), Hungarian Accounting Act s. 169 | 8 years |
| System e-mails | e-mail address, content, delivery time | invitations, passwords, notices (for example the warning before deletion after the trial, a trial extension) | contract | 1 year |
| Support | name, contact details, content of the request | helping users | legitimate interest | 2 years |
| Problem reports and ideas from the program | title and text of the report, the screenshot (if attached), the workshop's name and id, the reporter's role and e-mail domain, the page, the program version, browser details | fixing the problem, answering, developing the program | legitimate interest, Art. 6(1)(f) | the full text and the screenshot in the EU (Supabase), deleted or anonymised 90 days after the report is closed; GitHub holds only a redacted copy, from which the details pointing to the workshop and the reporter are removed at the same time |
| Remembered devices (two-step sign in) | name of the browser and system (for example "Safari, iPhone"), when it was remembered, last used and expires, a hash of a random device id | at the user's request, not asking the code on this device for 30 days | contract, Art. 6(1)(b); after expiry legitimate interest, Art. 6(1)(f) | 90 days after expiry or forgetting (reasons below) |
| Logs, security | IP address, browser, error messages | preventing abuse, troubleshooting | legitimate interest | 90 days |
| Card payment (since 6 November 2026, only if the workshop chooses it) | the payer's name, e-mail, billing data, Stripe's card reference (we never see card data), the charges, the text, version, language and time of acceptance of the authorisation, the accepting user and their role, the time of the notice about a failed charge | payment, proof of the authorisation and the notice | contract, Art. 6(1)(b); legal obligation (invoicing) | charges 8 years (Hungarian Accounting Act), the authorisation 5 years after the contract ends |
Remembered device, 90 days: after expiry or forgetting we keep the entry for 90 more days as a security log, so that it can be traced which device signed in to the account and when, if abuse is suspected (for example a lost or stolen phone). The 90 days equal the retention of the other security logs and concern only the little data above, so they are proportionate. The user can forget the device at any time (Settings).
Card payment (since 6 November 2026): card payment is voluntary; before saving the card the workshop accepts a separate authorisation, and until then Stripe receives no data about it. Stripe acts in two roles. For payment transactions, fraud prevention and legal compliance (for example anti money laundering checks) Stripe is an independent controller under its own privacy notice (stripe.com/privacy). Where it processes data on our behalf (saving the card, carrying out the charges) it is a processor. By the Provider's decision card payment was introduced without the 30 day advance announcement (sub-processor list, Changes).
Data is processed with the providers on the sub-processor list, mainly in the EU. Only the encrypted daily backup and the redacted copy of problem reports (GitHub), if switched on the AI requests (Anthropic), and the payment data of workshops that choose card payment (Stripe) leave the EU (USA). The safeguard for each recipient is described in clause 6 of the Data Processing Agreement: a valid EU–US Data Privacy Framework (DPF) certification, failing that the European Commission's standard contractual clauses (SCC) with a transfer impact assessment and supplementary measures (encryption, redaction, data minimisation). The full text and screenshot of a problem report stay in the EU (Supabase); the report stored on GitHub only holds a link valid for 30 days. A logo uploaded by the workshop is stored by Supabase in the EU and shown only on the workshop's documents.
Data of the workshops' customers in the program
For this data the workshop is the controller and Garagevo a processor; the workshop informs its customers and the drivers of the vehicles (for a company vehicle the employer too). What the program provides for this:
- Drivers of vehicles: the workshop may also record the name and contact details of the actual user of a vehicle, the driver of a company vehicle, to agree the repair with them.
- Signature and photos: before signing, the screen shows what the signature confirms; confirming the handover does not mean accepting every condition. The program does not keep the signature and the photos of a work order indefinitely: retention follows the warranty period of the work order and the time available for asserting legal claims, and in a dispute the workshop can place a retention hold on them.
- Reminders: inspection and service due reminders may count as advertising, so they are sent to a private customer only with prior explicit consent. The program records the time, text and channel of the consent and its withdrawal; every reminder offers a way to unsubscribe.
- Service messages: the quote, the intake receipt and the "your car is ready" notice belong to the repair ordered, are not advertising and need no marketing consent.
Demo request on the website
The data entered in the demo request form on garagevo.hu is processed by the Provider.
- Data: name, workshop name, phone number and/or e-mail address, workshop size and message (if given), the time of the consent, and a one way hash of the sender's IP address against abuse (mass sending); the IP address itself is not stored.
- Purpose: answering the demo request and arranging the demo. If you ticked it separately, sending e-mails about Garagevo news.
- Legal basis: your consent (Art. 6(1)(a) GDPR) and steps taken at your request before entering into a contract (Art. 6(1)(b)). The news e-mails need a separate consent; you can send the request without it.
- Retention: the request is kept for 12 months, or until you withdraw your consent if that is earlier. With consent to news e-mails, your name and contact details are kept until you withdraw it. You can withdraw consent at any time at info@garagevo.hu or the data protection address; this does not affect the lawfulness of earlier processing.
- Recipients: the data is stored by Supabase (database, EU); the notice and confirmation e-mails are sent by Brevo (EU); both are on the sub-processor list.
Your rights
Access, rectification, erasure, restriction, portability, objection. Send requests to the data protection e-mail address; we answer within 30 days.
Complaints: Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa u. 9–11., ugyfelszolgalat@naih.hu, naih.hu; or your local supervisory authority, or a court.
Cookies and browser storage
The program stores only what it needs to work in the browser (sign-in, language, settings, and at the user's request the remembered device id for two-step sign in). It uses no advertising or tracking cookies, so it does not ask for consent.
Dictation
Dictation uses the browser's built-in speech recognition. In Chrome the audio is processed by Google, in Safari by Apple. Garagevo receives only the finished text.