Privacy Policy

HeavyBase ("HeavyBase," "we," "us," or "our"), operated by Speedish Software LLC and accessible at shopbasehq.com, provides cloud-based equipment management software for heavy equipment service businesses. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you visit our website, use our platform, or interact with our services, including our SMS messaging program.

By using HeavyBase, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of our services.

1. Information We Collect

1.1 Information You Provide Directly

We collect information that you voluntarily provide when registering for an account, using our platform, or contacting us:

• Account Registration: Name, email address, phone number, business name, business address, and payment information.
• Shop Configuration: Labor rates, service bay information, staff member details (names, roles, PINs for device access), and business preferences.
• Customer Data (entered by shops): Customer names, phone numbers, email addresses, equipment information (year, make, model, serial number, unit number, hours), service history, and communication records.
• Payment Information: Payment processing is handled by Stripe. We do not store credit card numbers on our servers. Stripe may collect and store payment details in accordance with their privacy policy.
• Communications: Messages you send through our platform, including SMS messages between shops and their customers, support inquiries, and feedback.

1.2 Information Collected Automatically

When you access our platform, we automatically collect certain information:

• Device Information: Browser type, operating system, device identifiers, and screen resolution.
• Usage Data: Pages visited, features used, click patterns, and time spent on the platform.
• Log Data: IP address, access times, referring URLs, and error logs.
• Cookies and Tracking Technologies: We use cookies, local storage, and similar technologies to maintain sessions, remember preferences, and analyze platform usage. See Section 7 for details.

1.3 Information from Third Parties

• Google OAuth: If you sign in with Google, we receive your name, email address, and profile picture from Google.
• Stripe: We receive payment confirmation details and account status from Stripe for connected accounts.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our shop management platform
• Process transactions and send related information (invoices, payment confirmations, receipts)
• Send SMS messages on behalf of shops to their customers (see Section 3 for details)
• Send administrative messages including security alerts, account notifications, and service updates
• Respond to customer support requests and inquiries
• Analyze usage patterns to improve features and user experience
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations and enforce our terms of service

3. SMS/Text Messaging Program

4. How We Share Information

We do not sell your personal information. We may share information in the following circumstances:

4.1 Service Providers

We share information with third-party service providers who perform services on our behalf:

• Stripe: Payment processing and connected account management. Stripe receives payment details and shop banking information to process transactions.
• Telnyx: SMS message delivery. Telnyx receives phone numbers and message content solely for the purpose of delivering text messages.
• Supabase: Database hosting and authentication services.
• Vercel: Application hosting and content delivery.
• Google Analytics: Website usage analysis using anonymized and aggregated data.
• Resend: Transactional email delivery for invoices, payment links, and account notifications.

4.2 Between Shops and Their Customers

HeavyBase facilitates communication between heavy equipment service centers and their customers. Information entered by a shop about its customers (contact info, vehicle details, service records) is accessible to that shop and may be communicated to the customer through the platform (e.g., via estimates, invoices, SMS messages, or authorization pages).

4.3 Legal Requirements

We may disclose information if required to do so by law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

4.4 Business Transfers

If HeavyBase or Speedish Software LLC is involved in a merger, acquisition, or asset sale, your information may be transferred as part of that transaction. We will notify you of any such change.

5. Data Security

We implement industry-standard security measures to protect your information:

• All data transmitted between your browser and our servers is encrypted using TLS/SSL (HTTPS)
• Database access is protected by row-level security (RLS) policies ensuring shops can only access their own data
• Authentication is handled through secure token-based sessions with automatic expiration
• Payment processing is handled by PCI-DSS compliant providers (Stripe)
• Device-mode PIN authentication for shop floor tablets prevents unauthorized access to sensitive features
• Role-based access controls limit data visibility based on user role (owner, manager, writer, technician)

While we strive to protect your information, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security but are committed to maintaining appropriate safeguards.

6. Data Retention

We retain your information for as long as your account is active or as needed to provide our services. Shop owners may delete customer records, vehicle records, and work order history from within the platform at any time.

If you close your HeavyBase account, we will delete or anonymize your data within 90 days, except where retention is required by law (e.g., financial transaction records, tax reporting obligations) or necessary to resolve disputes.

SMS message logs are retained for 12 months for service continuity and dispute resolution, after which they are automatically purged.

6.1 Deleted Services and Work Orders

When a service, work order, or customer record is deleted by a shop owner or manager:

• Immediate Deletion: The service record and associated details (labor items, parts, notes, photos) are permanently removed from the active database.
• Related Customer Data: Customer contact information is retained only if associated with other active records. If a customer has no remaining service history, their data may be fully deleted upon request.
• Financial Records: Completed payment transactions and invoice records may be retained for up to 7 years as required for tax and accounting compliance, even if the associated work order is deleted.
• SMS History: Text message logs related to a deleted service are retained for up to 12 months for dispute resolution, then permanently purged.
• Backups: Deleted data may persist in encrypted system backups for up to 30 days before being overwritten.

To request complete deletion of all your data, including backup copies, contact us at support@shopbasehq.com.

7. Cookies and Tracking Technologies

We use the following cookies and tracking technologies:

• Essential Cookies: Required for authentication, session management, and device mode functionality. These cannot be disabled without breaking core functionality.
• Preference Cookies: Store your theme selection, layout preferences, and display settings via browser local storage.
• Analytics (Google Analytics): We use Google Analytics to understand how visitors interact with our website. This data is aggregated and anonymized. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

8. Children's Privacy

HeavyBase is a business-to-business platform designed for heavy equipment service centers. Our services are not directed to individuals under the age of 13, and we do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected information from a child under 13, we will take steps to delete that information promptly. If you believe we have collected information from a child under 13, please contact us at support@shopbasehq.com.

9. Your Privacy Rights

9.1 All Users

Regardless of your location, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your personal information (subject to legal retention requirements)
• Opt out of SMS messaging by replying STOP to any text message
• Opt out of analytics tracking

9.2 California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
• No Sale of Personal Information: We do not sell personal information as defined by the CCPA.

To exercise your California privacy rights, contact us at support@shopbasehq.com.

9.3 Other State Privacy Laws

Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws may have additional rights, including the right to access, correct, delete, and port their data, and the right to opt out of targeted advertising. Contact us to exercise these rights.

10. Third-Party Links

Our platform may contain links to third-party websites and services, including parts suppliers (O'Reilly Auto Parts, AutoZone, NAPA, etc.), payment processors, and other external resources. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the updated policy on this page with a new "Last Updated" date. For significant changes, we may provide additional notice via email or a prominent notice on our platform. Your continued use of HeavyBase after any changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy, our data practices, or our SMS messaging program, please contact us: