HONEST MECHANIC SHOP PRIVACY NOTICE

Version: shop_privacy_v1
Last updated: August 31, 2026

This Notice explains how Honest Mechanic Technologies LLC ("Honest Mechanic," "HM," "we," "us," or "our") collects, uses, discloses, retains, and protects information in the Shop website, portal, administration, referrals, and driver-consented case workflows.

1. Contacts

Shop and general questions: hello@honestmechanic.ai

Account and technical support: support@honestmechanic.ai

Privacy requests and incident coordination: privacy@honestmechanic.ai

2. Scope And Privacy Roles

This Notice applies to Shop applicants, owners, administrators, employees, contractors, and other authorized users. The general HM Privacy Policy separately applies to drivers and app users.

HM determines the purposes and means of Shop-account, portal, consent, AI, security, and administration records. For driver case information, HM operates the consented delivery and platform while the Shop independently determines its use for inspection, diagnosis, estimates, repair, billing, warranties, and legal recordkeeping. These independent activities do not make HM responsible for the Shop's separate systems or practices. If applicable law requires a processor, service-provider, or data-processing agreement for a specific relationship, the parties must execute it before the affected processing.

3. Information We Collect About The Shop

- Application and business profile: legal or trade name, contact name, email, normalized email, phone, address, city, state, country, website, language, business message, source, application status, onboarding stage, priority, tags, and referral information.
- Review and administration: approval, rejection, suspension, disablement, follow-up, admin notes, reasons, timestamps, and audit events.
- Users and access: user name, email, normalized email, role, status, password hash, invitation records, token hashes, session-token hashes, expiration, last-seen, acceptance, revocation, disablement, and login timestamps.
- Legal acceptance: document type, version, cryptographic hash, language, acceptance time, accepting user, Shop, and audit metadata.
- Support and communications: messages, email-delivery events, password-reset activity, questions, correction requests, complaints, incident reports, and related support records.
- Technical and security data: IP-derived and request information where logged, browser/device metadata, cookies or session information, authentication and authorization events, error logs, security signals, and abuse-prevention records.

HM stores hashed passwords and tokens where the product design calls for them; HM does not need or intend to retain a user's readable password.

4. Driver Associations And Case Information

After a driver's voluntary referral or affirmative case submission, HM may process association identifiers, anonymous owner or device references, platform, referral code, first/last-seen times, status, consent time, and appointment or contact preferences.

A consented case may include case reference, customer name and contact information supplied for the case, preferred contact method, vehicle label and identifier, year, make, model, masked VIN, selected HM result or report reference, finding summary, source, status, timestamps, and other fields shown in the authorized workflow.

The Shop may add contact and appointment events, status changes, notes, closure information, estimates, work orders, invoices, photographs, and other evidence. HM may process document name, type, storage key, MIME type, size, hash, uploader, status, notes, AI eligibility and status, extracted information, bilingual summary, analysis timestamps, publication status, owner evaluation, follow-up verification, and correction/audit metadata.

When the Shop marks work complete, eligible case events, documents, owner feedback, and a sufficiently grounded evidence summary may be associated with the authorized history for that vehicle. HM retains provenance labels that distinguish information documented by the Shop, reported by the owner, observed or explained by HM, and inferred by HM.

Internal Shop notes, administrative priority, credentials, session tokens, security information, and private storage keys are restricted by role and are not intended for driver display. Driver chats that are not clearly submitted as part of a case are not intended for Shop access.

5. Sources

We obtain information directly from the Shop and authorized users; from drivers who connect or submit a case; from HM administrators reviewing access; from HM app, portal, security, notification, support, and AI systems; and from service providers acting for HM. We may receive public business information when reasonably necessary to verify an application, but the Shop remains responsible for keeping its profile accurate.

6. How We Use Information

- Review Shop applications, verify administrative eligibility, approve or restrict access, create accounts, manage invitations, authenticate users, and maintain security.
- Display the Shop profile, produce referral links, QR codes, and flyers, and attribute cases to the selected Shop.
- Deliver driver-consented cases, support contact and appointment coordination, manage operational status, receive documents, and maintain and present permitted durable customer/vehicle history.
- Analyze eligible documents, extract structured evidence, generate bilingual summaries, support case chat, publish grounded information to the applicable driver, and manage corrections or exceptional audit.
- Send transactional emails and notifications about applications, invitations, account security, cases, and service operations.
- Provide support, monitor reliability, prevent abuse, investigate incidents, enforce Shop Terms, maintain acceptance and audit evidence, and establish or defend legal claims.
- Meet legal, tax, accounting, safety, privacy, and regulatory obligations applicable to HM.

7. AI And Document Processing

HM may submit the minimum reasonably necessary content of eligible documents and related case context to an AI provider to extract, translate, compare, or summarize evidence. Automated rules may determine whether a summary is sufficiently grounded to publish. HM may regenerate, annotate, restrict, or withdraw a summary after a material error report.

AI output is not automatic proof of a completed or successful repair and is not a substitute for the Shop's original records or professional judgment. HM seeks to attribute Shop-provided facts to their source and separate them from driver feedback and automated inference. We do not state that an AI provider never retains or uses submitted data beyond processing unless the applicable contract and configuration support that statement.

8. How We Disclose Information

Drivers: HM displays to the applicable driver simplified case status, documents or access actions intended for that driver, attributed events, a published evidence summary, correction information, and other public case fields. HM does not intend to expose Shop credentials, security data, internal administrative notes, private storage keys, or another customer's information.

Other Shops do not automatically receive a completed case or prior vehicle history. HM discloses it or any part of it to a different Shop only after the driver selects that Shop and affirmatively authorizes the information identified in a new handoff flow.

HM administrators and personnel: access is limited according to operational, support, security, legal, or audit need.

Service providers: HM may disclose information as needed to providers of hosting, API and database infrastructure, private document storage, AI generation and document analysis, error monitoring, operational email, notifications, authentication, customer support, and security. Current providers may include OpenAI for applicable AI processing, Sentry for privacy-filtered error monitoring, Resend for operational email, Expo and platform services for notifications, and hosting or database providers.

Legal and business purposes: HM may disclose information to comply with law or lawful process, address safety, prevent fraud, protect rights, investigate incidents, or complete a financing, merger, reorganization, or sale subject to appropriate safeguards.

HM does not sell Shop user, driver, vehicle, case, or document data and does not share it for cross-context behavioral advertising. Referral participation does not authorize unrelated marketing.

9. Shop Responsibilities For Copies And Other Systems

The Shop independently controls information it downloads, prints, emails, enters into another system, or otherwise processes outside HM. The Shop must provide its own legally required privacy notice, collect separate consent where required, limit access, supervise vendors, respond to customer rights, follow retention and secure-disposal requirements, and make legally required incident notices for systems under its control.

HM cannot fulfill or guarantee deletion from Shop-controlled systems. A privacy request concerning both HM and Shop records may require separate responses from each party.

10. Cookies And Sessions

The Shop portal uses cookies or equivalent storage necessary for authentication, language, security, and session continuity. Disabling required cookies may prevent login. The production Shop portal must not add advertising or nonessential analytics cookies without an appropriate notice, technical consent control, and update to this Notice.

11. Retention

HM retains information only as long as reasonably necessary for application review, account access, active cases, warranties or disputes, security, fraud prevention, transaction and accounting needs, legal compliance, and establishment or defense of claims. Different categories therefore have different periods.

Application, account, consent, acceptance, invitation, session, audit, security, support, case, document, correction, and AI records may remain while the Shop program or an authorized case is active. Acceptance, security, incident, fraud, accounting, correction, and dispute evidence may remain longer when reasonably necessary or legally required. Expired session and invitation records may be retained for a limited security and audit period. When information is no longer needed, HM deletes or de-identifies it through operational processes. Backups may retain protected copies for a limited recovery cycle.

Eligible completed-case history may remain after case closure or after the Shop leaves the program so the driver can understand prior work, subject to driver deletion rights and lawful exceptions. Provenance or summary corrections may preserve the prior record and add a version, annotation, or later event when needed for integrity or audit.

12. Closure, Deletion, And Legal Holds

An authorized Shop administrator may request closure through support@honestmechanic.ai or privacy@honestmechanic.ai. HM will verify authority before acting. Closure revokes future access but does not automatically delete driver-owned history, documents or service records the Shop or driver is legally entitled to retain, legal acceptances, security and audit evidence, active disputes, or records under a legal hold.

HM may delete, restrict, minimize, or de-identify information as appropriate to the request and applicable law. The Shop must separately handle copies it controls. HM may preserve a minimal record of the request and action to demonstrate compliance and prevent unauthorized restoration.

13. Privacy Rights And Requests

Depending on location and role, an individual Shop user may have rights to request access, correction, deletion, or a portable copy; know categories and recipients; opt out of sale, sharing, targeted advertising, or certain profiling; limit certain sensitive-data uses; and appeal a denial without discrimination. Business information and data processed in a person's professional role may receive different treatment under applicable law.

Submit requests to privacy@honestmechanic.ai. HM may verify identity, account access, role, authority, and the Shop relationship. An authorized agent may act where law permits, subject to verification. HM will respond within the legally required period and explain applicable exceptions. HM does not currently sell data or use it for cross-context behavioral advertising.

14. Security And Incidents

HM uses reasonable administrative, technical, and organizational measures designed for the information, including HTTPS for production traffic, access controls, hashed credentials and session tokens, private document access, server-side secret handling, audit events, and privacy filtering for error monitoring.

No system is completely secure. The Shop must report suspected compromise or unauthorized disclosure without undue delay to support@honestmechanic.ai and privacy@honestmechanic.ai. HM will investigate, contain, coordinate, preserve evidence, and provide notices required for systems under HM's control. The Shop remains responsible for legally required action involving systems or copies under its control.

15. Processing Location

HM is based in the United States. Information may be processed in the United States or other locations where service providers operate. Those locations may have different data-protection laws. Where required, HM uses legally recognized transfer safeguards.

16. Children

The Shop service is intended only for adults acting for legitimate businesses. It is not directed to children. The Shop must not create accounts for minors or knowingly submit a child's information unless expressly authorized and lawful for the applicable service.

17. Changes And Acceptance

HM may update this Notice for product, legal, or operational changes. Material changes after publication require a new version and notice or re-acceptance where required. HM may record the version, cryptographic hash, language, Shop, accepting user, role, time, and audit metadata.