Privacy Policy

GarageSeeker is responsible for personal information under its control, including information handled for us by service providers. The GarageSeeker Privacy Team is responsible for privacy questions and requests.

This policy applies to the Platform. It does not govern independent websites or services that you choose to visit through links on the Platform.

Account and authentication information: username, email address, password hash, account roles, email-verification status, account timestamps, and the date, method, and document versions recorded when you agree to the Terms of Service and acknowledge this Privacy Policy. We also record the date when a registrant confirms they are at least 13; we do not request a birth date for account eligibility. We do not store your password in readable form. If you use Google sign-in, Google provides an authentication credential and verified email information. We store Google's unique user identifier to connect your Google account to GarageSeeker. First-time account linking may require an email confirmation code; we store a hash of that code, its expiry, and confirmation attempts. We do not receive your Google password.

Shop listing information: business name, address, phone number, email address, website, hours, services, vehicle makes, description, photos, and map coordinates. Shop contact information is intended to be public. It may be personal information when a business is operated by an individual.

Shop ownership claim information: the shop being claimed, contact name, contact email, contact phone number, comments, whether you have access to the shop phone number, claim status, and SMS verification result.

Community activity: reviews, review replies, ratings, uploaded photos, saved shops, shop or review reports, report notes, moderation decisions and appeals, account-enforcement status, and the dates associated with those activities. A snapshot of reported review text, its rating, and attachment storage paths may be retained with its moderation record so an approved appeal can restore the content.

Messages and notifications: message sender and recipient, subject, message body, replies, read status, notification type, related links, and timestamps. Messages are visible to their participants and may be accessible to authorized administrators for support, safety, and moderation.

Location information: if you choose the browser-location option and grant permission, the Platform receives latitude and longitude to identify a nearby city and find nearby shops. Your selected location and label are stored in your browser so they can be reused until you clear or replace them.

Technical information: hosting and API systems may process IP address, request headers, request time, requested URL, response status, and security or error logs when the Platform is used. The Platform does not currently integrate Google Analytics, Vercel Web Analytics, advertising trackers, or web beacons.

Security audit information: GarageSeeker records important account-security events such as sign-in outcomes, temporary account locks, registration, recovery requests, password changes, sign-out, and email verification. These records may include the associated account, event time and outcome, request path, limited event details, and keyed hashes of the submitted account identifier and network address. Passwords, authentication tokens, recovery tokens, raw failed-login identifiers, and raw network addresses are not stored in this audit table.

To create and secure accounts, authenticate users, and recover usernames or passwords.

To document the Terms version you accepted and the Privacy Policy version you acknowledged.

To send account, email-verification, security, and service messages.

GarageSeeker does not currently send marketing emails or collect consent for marketing email. Account, verification, recovery, security, and privacy-request emails are transactional and are not used to include promotions. Creating an account or accepting the Terms is not treated as marketing consent.

To create, review, publish, search, map, update, and manage shop listings.

To process shop ownership claims and verify access to a shop phone number.

To display reviews and aggregate ratings, store saved shops, and operate the message center.

To investigate reports, document moderation decisions, process appeals, prevent abuse, apply repeat-offender restrictions, enforce our Terms and Community Guidelines, and support users.

To diagnose errors, protect the Platform, comply with law, and respond to lawful requests.

Approved shop listings, including business contact details, descriptions, hours, services, photos, and map location, are public. Pending or rejected listings may still be visible to their creator and administrators.

Your username appears with reviews, review replies, and certain other community activity. Review text and photos are public. Individual rating choices remain associated with an account internally, while the shop page displays rating totals and averages.

Reports, ownership-claim contact information, private account email addresses, authentication information, saved shops, and private messages are not made public through the Platform.

Please do not include private information about yourself or another person in public content.

Hosting: Vercel hosts the frontend, and Render hosts backend infrastructure. These providers process requests and operational information needed to deliver the Platform.

Image storage: Amazon S3 stores uploaded shop and review images in private object storage. Images are displayed through time-limited signed links. Amazon processes the image bytes, object keys, and ordinary storage request metadata needed to provide this service.

Email: Resend, or a configured email provider, processes email addresses, message content, and verification or recovery links to deliver account email.

Phone verification: Twilio receives a phone number and verification information when SMS verification is requested for a shop ownership claim.

Google services: Google Identity Services supports optional Google sign-in. Google Geocoding receives shop addresses or coordinates used for mapping and location labels.

Geocoding fallback: OpenStreetMap's Nominatim service may receive a shop address when Google geocoding is unavailable or does not return a result.

We may disclose information when reasonably necessary to comply with law or legal process, investigate fraud or security incidents, enforce our agreements, or protect the rights and safety of users, GarageSeeker, or others.

We do not currently sell personal information, use it for targeted advertising, or provide it to data brokers.

The Platform uses browser local storage for authentication tokens, selected location, session-activity timestamps, and limited account or interface state. Authentication tokens allow the API to recognize a signed-in user. Signing out removes authentication tokens; location can be cleared through the location control or browser settings.

Google Identity Services and hosting providers may use cookies or similar technologies under their own policies. Browser settings can be used to inspect or clear cookies and local storage, although clearing essential storage will sign you out or reset saved preferences.

Some service providers may process information outside Canada. Information processed in another country may be subject to that country's laws and may be accessible to its courts, law-enforcement agencies, or national security authorities. GarageSeeker remains responsible for selecting and overseeing providers that handle information on our behalf.

Account and profile information is generally retained while an account is active. Email-verification links expire after 24 hours, although related technical records may remain until routine maintenance removes them. Legal-acceptance records may be retained after account closure where reasonably necessary to document the agreement, resolve a dispute, or meet a legal obligation.

Application security audit records are normally retained for 180 days and then removed through routine maintenance. A narrowly relevant record may be retained longer when required for an active security investigation, dispute, fraud prevention, or legal obligation.

Shop listings are retained while they remain part of the directory. If the creator or owner deletes their account, the shop listing and shop photos may remain, but the account association is removed.

When a verified account-deletion request is completed, the account's reviews, stored review photos, review replies, ratings, saved-shop records, and other account-linked records that use automatic deletion are removed from the live application. Ownership claims, reports, minimized privacy-request completion records, system records, and messages retained for another user may remain where needed for the receiving user, moderation, fraud prevention, dispute handling, or legal obligations. The username is removed or displayed as "Deleted user" where supported.

Deleting a message from the message center hides the conversation from your view. It does not necessarily delete another participant's copy or immediately erase the underlying message record.

Deletion from the live application does not immediately rewrite provider backups or security and delivery logs. Those copies are isolated from ordinary use and expire or are removed under the applicable provider schedule. We may retain narrowly limited information longer when reasonably necessary for a legal obligation, active access request or dispute, security investigation, fraud prevention, or enforcement matter. We record and explain exceptions that apply to a request.

You can update certain account and shop information through the Platform.

You can deny or revoke browser location permission and clear the saved location at any time.

Signed-in users can submit and track access, correction, and account-deletion requests from the Privacy requests section of the account page. We send a one-time confirmation link to the account email before work begins. The link expires after 24 hours. You may also contact [email protected] for assistance and include an existing request reference if available. Do not email identification documents unless the Privacy Team specifically explains why proportionate additional verification is required.

A deletion request may not remove public business facts or records that must be retained for legal, security, moderation, fraud-prevention, active-access-request, or dispute purposes. We will explain any applicable limitation. Verified requests receive a tracked response due date, normally 30 calendar days after email confirmation. A minimized completion record is retained for two years unless a documented legal hold applies.

GarageSeeker is a general-audience service and is not directed to children under 13. Registration requires a neutral confirmation that the registrant is at least 13. We record the confirmation time, not a full birth date. We do not knowingly permit children under 13 to maintain accounts.

A parent, guardian, or other person can report a potentially under-13 account to [email protected]. Include the username and reason for the concern, but do not email identification documents or a full birth date. We will promptly restrict the account while reviewing credible information and will delete an account and associated personal information when we determine the user is under 13, except for narrowly limited records that law, safety, fraud prevention, or documenting the deletion requires. Any retained record will be minimized and access-restricted.

You must be at least 18 to claim a shop as its owner or authorized representative.

We use safeguards designed to protect personal information, including password hashing, access controls, authenticated API access, transport encryption in production, and rate limits on sensitive account actions. No method of transmission or storage is completely secure.

Keep your credentials confidential and contact us if you believe your account or personal information has been compromised.

We may update this policy when the Platform, our providers, or legal requirements change. We will update the date above and provide additional notice when a change is material or when consent is required by law.