Who is responsible for your data
[company name] (CR [CR number]) is the data manager (controller) for your Garagy account, orders and payments. When a garage or shop records you as its customer, that business is the controller of its own records and Garagy processes them on its behalf.
Contact for data protection: [privacy email], [postal address].
What we collect
Account: name, mobile number, email, language, area, password (stored only as a secure hash), the consents you gave and when.
Cars and orders: your cars (make, model, year, VIN, plate), addresses, orders, payments (never card numbers), returns, reviews, requests for quote and support requests with any photos you send.
Security: sign-in history (time, device, IP address), trusted devices, verification codes (kept for one day).
From garages: if a garage registers your car and mobile number, its service history is linked to your account once your mobile is verified.
Why we use it and on what basis
To provide the service you asked for (the contract): accounts, orders, payments, delivery, service history, support.
To meet legal duties: tax invoices and financial records, which the law requires us to keep.
To keep accounts safe (legitimate interest): sign-in checks, fraud prevention, audit logs.
With your consent, which you can withdraw at any time in My account: marketing messages and sharing your car's service history with other garages.
Who we share it with
The garage or shop you deal with receives what it needs for your order or job (name, mobile, car, address for delivery).
Service providers that process data for us under contract: Supabase (database, sign-in and file storage), Cloudflare (website hosting), Twilio (SMS and WhatsApp messages), our payment provider [MyFatoorah or Tap] and BenefitPay, Expo, Apple and Google (app notifications), and Google and Apple if you sign in with them.
Authorities, when the law requires it. We never sell personal data.
Transfers outside Bahrain
Some of these providers store data outside Bahrain ([hosting region]). We use providers that protect data to standards at least equal to Bahrain's law, under written agreements, as the Personal Data Protection Authority allows.
How long we keep it
Account details: until you delete the account (erased 7 days after you ask). Sign-in history: 180 days. Verification codes: 1 day. Notifications: 1 year. Support requests: 2 years after they are closed. Requests for quote: 1 year after they expire.
Invoices, payments and orders: kept for the period the tax and commercial laws require, even after an account is deleted, without a usable link to you.
Your rights
You can see and download your data (My account → Download my data), correct it, delete your account, withdraw consent, and object to processing. You can also complain to the Personal Data Protection Authority in Bahrain.
To ask about data a garage or shop holds about you, contact that business; we will help it answer.
Security
Data is encrypted in transit, each business can only see its own records, staff access follows their role, and important actions are logged. Owners and admins confirm sign-ins with a second step.
Changes
We will tell you about important changes to this notice and ask you to accept it again in the app.