Privacy Policy

Who is responsible

Garage Saga is published by Marco Zucchetti, sole trader based in France (SIRET 108 868 217 00010). For anything about your data, write to info@garagesaga.com.

What data the service holds

• Account: email address, password (stored only in hashed form), the name you choose, language and currency preferences.
• Vehicles: brand, model, year and, if you choose to add them, registration plate and chassis number (VIN).
• History entries: dates, kilometres, costs, notes and workshop names you record.
• Files you upload: photos of the vehicle, invoices, inspection certificates.
• Technical data: aggregated, cookie-free visit statistics, error reports and standard server logs kept for security.

What it is used for

To run the service you signed up for: storing your history, showing it to the people you choose, sending service emails such as password resets and the deadline reminders you can switch off in your profile (legal basis: the contract between us).

To keep the service safe: usage quotas, abuse prevention and error diagnostics (legal basis: legitimate interest).

Nothing else. There is no advertising, no sale of data and no automated decision-making about you.

Invoice reading with AI

When you tap the scan button, the photo of that invoice is sent to Mistral AI (Paris, France) to prefill the form, and the reading is billed to us, not to you. This happens only when you request it, Mistral does not train on your data (training is disabled on our account), and you can always type the entry by hand instead.

Where the data lives

Your data is stored in the European Union. The providers that process it on our behalf are:

• Supabase: database and file storage, EU region.
• Vercel: application hosting, Frankfurt (EU) deployment.
• Mistral AI (France): invoice reading, only when you use the scanner.
• Brevo (France): service emails.
• Sentry: error diagnostics, so that failures get noticed and fixed.
• Backblaze (EU region, Amsterdam): weekly backups, encrypted on our side before upload with a key only we hold.

Transfers outside the EU

Some of these providers are US companies operating European infrastructure. Where a transfer outside the EU can occur, it relies on the safeguards recognised by EU law (standard contractual clauses or the EU-US Data Privacy Framework).

Sharing that you control

A history link makes that vehicle's history readable by anyone who has the link. You create it, you can revoke it at any time, and invoices appear on it only if you switch them on. The for-sale banner and its price appear only while you keep the vehicle marked for sale.

A Garage Saga sticker QR opens only what you have already made public through a share link. Scanning is never a permission.

Transferring a vehicle hands the vehicle and its entire history to the buyer, deliberately and permanently: from that moment the entries belong to the new owner.

Why an entry closes after 24 hours

An entry stays open for 24 hours after it is recorded: within that window you can edit it, delete it, or remove a file attached by mistake. It is the time needed to notice a typo, or that the photo shows the wrong document. After 24 hours the entry is sealed: it can no longer be modified or deleted, and a correction is recorded as a new, visible entry linked to the original. Both rules are enforced by the database itself, not by the interface. Your right to erasure is preserved in full: you can delete a whole vehicle, or the entire account, at any time.

How long data is kept

For as long as your account exists. When you delete a vehicle or your account, the deletion is immediate; encrypted backup copies expire within 8 weeks. Histories you transferred to a buyer before deleting belong to the new owner and are not affected.

Your rights

You can access and export your data (Profile, Your data, Export), correct it (through the visible-correction mechanism, or by writing to us for account data), delete it (a single vehicle from its page, the whole account from your profile), and object to or restrict processing by contacting info@garagesaga.com.

You can lodge a complaint with the French supervisory authority (CNIL, cnil.fr) or with the authority of your own country.

Age and other people's data

The service is intended for adults (18+).

Invoices and photos can contain other people's details, such as a workshop's staff names. You are responsible for what you upload and for what you choose to share publicly.

Changes

If this policy changes in a way that matters, the change is announced in the app or by email. The date at the top always tells you the current version.