Effective October 9, 2026 · Version 1.5
Your account: email address, password (stored as a one-way hash — we cannot read it), and your name.
Your shop: business name, address, contact details, and the settings you configure (labor rates, tax rates, etc.).
Your customers' data: names, vehicles, repair history, communications — everything you enter on their behalf. You are responsible for this data; we store and process it only to run the service for you.
Security logs: login timestamps and IP addresses, kept for 90 days for fraud prevention and then deleted.
We use your information to run Daedalus — to authenticate you, deliver the features you pay for, send the notifications you ask us to send, and keep the service secure. That's it.
We do not sell your data. We do not use it for advertising. We do not share it with anyone except the services we need to operate the platform — hosting, network delivery, email, card payments, maps for mobile routing, address lookup, and the AI provider described below. Addresses typed for a mobile-service job or an appointment are looked up with OpenStreetMap’s Nominatim service (OpenStreetMap Foundation, United Kingdom) to place them on a map; only the address text is sent, with no name attached. Those services process data on our behalf and are bound to handle it appropriately. The current list is in Schedule B of the Data Processing Addendum.
Daedalus includes AI features: the assistant in the shop app, writing help on repair orders, and the assistant on a shop's customer portal. They are on by default. A shop can turn the shop assistant off in Settings → Shop Features (“AI assist”) and the portal assistant off in Settings → Customers (“Let customers ask the assistant”).
When an AI feature is used, the request and the records it needs are sent to our AI provider, Anthropic (United States), to produce the answer. That can include customer personal information: customer names and contact details, vehicles and VINs, repair-order text (concerns, diagnoses, notes), estimate and invoice lines and amounts, messages a customer types to the portal assistant, and files a user attaches. Anthropic processes this under its commercial terms, which do not permit it to train its models on this data. The portal assistant tells customers it is an automated AI assistant. While the shop assistant is on, closing a repair order that has fault codes also sends its write-up (concern, cause, correction and notes) to Anthropic, to sort which repair fixed each code for the anonymous pool described above; with AI switched off that does not happen.
One thing does leave, and it is not sold: anonymous aggregate statistics — fault codes with the repair category that fixed them, and quoted-versus-actual hours against a service code — are pooled with other shops so that, once five independent shops have reported the same thing, diagnostic suggestions and labor times can be offered to every shop. No shop identity, no customer, no vehicle identifier, no prices and no free text, and nothing is visible until five independent shops have sent the same thing. Terms section 3 sets out exactly what is included and what is not.
We set two cookies when you log in — a short-lived access token and a longer-lived refresh token. Both are HttpOnly and Secure, which means JavaScript can't read them. On a shop's customer portal, signing in sets a session cookie, and a second cookie remembers which customer used that browser so they can ask for a new sign-in link with one tap; it holds no email address and grants no access, and “Not you?” clears it. We use no tracking, advertising, or analytics cookies. No third-party scripts set cookies on our pages.
Depending on where you're located (GDPR, CCPA, and similar laws), you may have the right to access, correct, delete, or export the personal data we hold about you. To make a request, email [email protected] with "Privacy Request" in the subject line. We respond within 30 days.
Shop owners can handle customer-level requests (GDPR / CCPA export or deletion) directly from Settings → Privacy & Data.
California residents: we do not sell or share personal information for advertising purposes. Do Not Sell or Share My Personal Information →
All connections are encrypted with TLS. Passwords are bcrypt-hashed. Authentication cookies are HttpOnly, Secure, and SameSite=Lax, so browsers do not send them with requests that start on another site — a cross-site form cannot act as you. Access tokens expire after one hour. In the event of a breach affecting your data, we will notify you by email within 48 hours of confirming it.
We'll notify you of material changes by email and in-app notice before they take effect. The effective date above reflects the most recent update.
Daedalus Automotive
[email protected]