Privacy Policy

1. Introduction & Scope

AutoArchiveX is operated by EnviaLabs ("we", "us"). This Privacy Policy explains how we collect, use, disclose, and protect information when you use our website and mobile apps (iOS and Android). The Service is for individuals aged 16 and over. We do not knowingly collect data from anyone under 16. If you are under 16, do not use the Service.

By using our Service, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

We collect various types of information to provide and improve our Service:

3. How We Use Information

Your information is used for the following purposes:

• Provide and secure your account
• Store and manage vehicle and service records
• Enable secure vehicle transfers
• Send reminders, notifications, and service communications
• Improve features and safety (aggregated/anonymous analytics)
• Comply with legal obligations and enforce terms

4. Legal Bases (GDPR)

For users in the European Union/UK, our legal bases for processing your data are:

• Contract: to provide the Service as per our Terms of Service.
• Legitimate interests: to improve, secure, and prevent abuse of our Service.
• Consent: for marketing emails and optional analytics/cookies, which you can withdraw at any time.
• Legal obligation: for record-keeping and compliance with applicable laws.

5. Security & Encryption

We implement robust security measures to protect your data:

• Data in transit: Secured with TLS 1.3 encryption.
• Data at rest: Encrypted using AES-256; media access uses signed URLs.
• Field-level encryption: Applied to sensitive secrets (e.g., 2FA keys).
• Access controls: Role-Based Access Control (RBAC), Multi-Factor Authentication (MFA), rate limiting, and comprehensive audit logs.

6. Third-Party Services

We use the following trusted third-party services:

• Twilio: For SMS and OTP (One-Time Password) delivery for verification and vehicle transfers.
• SendGrid: For email delivery, including account verification, important notices, and service reminders.
• PostHog: For product analytics to understand feature usage and improve the Service. You can opt out of analytics in your account settings.
• OpenAI: For AI-powered features including the AI Mechanic chat, invoice data extraction, vehicle intelligence analysis, and service schedule recommendations. Vehicle and service data you provide may be processed by OpenAI's API to generate responses. OpenAI's privacy policy applies.
• Backblaze B2: For secure, encrypted storage of media files (e.g., invoice photos, vehicle images).
• Firebase Cloud Messaging (FCM): For delivering push notifications to our mobile applications.
• OAuth providers: Google and Apple for streamlined user authentication.
• No advertising SDKs: We do not use third-party advertising SDKs, and we do not sell your data.

7. Sharing and Disclosure

We may share your information in limited circumstances:

• With trusted service providers under strict contract to operate and maintain the Service.
• When required by law or legal process (e.g., court order, government request).
• In the event of a business transfer, such as a merger, acquisition, or sale of assets.

8. Your Rights

You have rights regarding your personal data:

• Access, correction, deletion, and portability: You can request to access, correct, delete, or receive a copy of your personal data.
• Object/restrict processing: You can object to or request restriction of certain data processing activities.
• Communication preferences: You can opt-out of marketing communications and manage notification settings.
• Request fulfilment: We will respond to data rights requests within 30 days as required by applicable law.

EU/UK users may lodge complaints with their local data protection supervisory authority. California residents have rights under the CCPA/CPRA; we do not sell personal information.

9. Retention

We retain your personal information for as long as necessary to provide our services and comply with legal obligations:

• Account data: Until account deletion or 3 years of inactivity.
• Service records: Up to 7 years from creation (for warranty and legal record-keeping purposes).
• Logs/diagnostics: Approximately 12 months.
• Backups: Typically retained for about 90 days.

10. International Transfers

We operate globally from Sri Lanka. Your data may be transferred to and processed in countries outside your own. Where required, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or comparable mechanisms for data transfers.

11. Cookies (Web)

On our website, we use cookies:

• Essential cookies: Necessary for basic functionality, like maintaining your login session.
• Analytics cookies: Used only with your explicit consent (via PostHog) to help us understand website usage patterns and improve our service.
• No third-party advertising cookies: We do not use cookies for targeted advertising.

You can manage your cookie preferences through your browser settings.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the updated policy on our website.
• Sending an email notification to your registered email address.
• Displaying a notice within our application.

Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

13. Contact Information

If you have questions about this Privacy Policy or our data practices, please contact us:

• Email: hello@envialabs.com
• Website: envialabs.com

14. Children's Privacy

The Service is intended for users aged 16 and over and is not intended for anyone under 16 years of age. We do not knowingly collect personal information from anyone under 16. If we become aware that we have collected personal information from a user under 16, we will take steps to delete that information and may disable the associated account. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.