Privacy Policy | Travel Mechanic

This Privacy Policy explains how Travel Mechanic (“we,” “us,” or “our”) collects, uses, shares, and protects personal information when you use our mobile auto-repair booking service in Denver, CO and San Francisco, CA, and our website. It also describes the privacy rights available to you, including under the California Consumer Privacy Act as amended by the CPRA (“CCPA/CPRA”) and the EU/UK General Data Protection Regulation (“GDPR”).

1. Information We Collect

We collect the following categories of personal information:

Contact details — your name, email address, and phone number.
Service location — the address where your vehicle will be serviced, and the approximate geographic coordinates of that address (derived by geocoding it) so we can confirm it is within our coverage area and route a mechanic to you.
Vehicle information — year, make, model, trim, and optionally your VIN and license plate, so we bring the correct parts.
Booking details — the services you request, your description of the problem, parking/access notes, and any parking photos you upload.
Payment information— processed by Square (see Section 4). We do not receive or store your full card number, CVV, or expiration date. To hold and later collect payment for a booking, and to keep that authorization valid if your appointment is scheduled or runs beyond a few days, a secure token representing your card is stored in Square’s vault on our behalf; we can reference that token to re-authorize the hold but cannot see the underlying card.
Contact information entered during booking — if you begin the booking form and enter your name, email, or phone number, we may save that contact information even if you do not complete the booking, so we can follow up to help you finish. See Section 8 on how to opt out or request deletion.
Inquiries and job applications — if you contact us or apply to be a mechanic, the information you submit, including any resume or certification documents you upload.
Technical and usage data — your IP address and basic request metadata, used for security, fraud prevention, and rate limiting, and standard server logs.

2. How We Use Your Information

To schedule, perform, and manage the services you book.
To authorize, hold, re-authorize, and collect payment for your booking.
To assign and route the appropriate mechanic to your location.
To communicate with you about your booking, including confirmations, receipts, and updates.
To verify that your address is within our service area.
To provide quality assurance, honor warranties, and resolve disputes.
To prevent fraud and abuse and to secure our service (including rate limiting by IP address).
To review job applications and for recruiting.
To comply with legal, tax, and accounting obligations.

Legal bases (GDPR). Where GDPR applies, we process personal information to perform our contract with you (fulfilling bookings and payments), for our legitimate interests (securing the service, preventing fraud, following up on incomplete bookings, and improving our service), to comply with legal obligations, and with your consent where required.

3. How We Share Your Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share it only as needed to run our service, with the following categories of recipients:

Your assigned mechanic — your name, service address, vehicle, and job details, strictly to complete your service.
Square— our payment processor, to authorize and collect payment and to store the card-on-file token described above. Square’s handling of payment data is governed by its own privacy policy.
Resend — our transactional email provider, to deliver booking confirmations, receipts, and notifications.
Vercel — our hosting and file-storage provider, which stores uploaded files (parking photos, resumes, certifications) and serves our site.
OpenStreetMap / Nominatim — a geocoding service to which we send the service address you enter in order to convert it to coordinates for coverage and routing.
Legal and safety — where required by law, to enforce our terms, or to protect the rights, property, or safety of our customers, mechanics, or the public.

These providers are service providers/processors that are contractually limited to using the information for the purposes above.

4. Payments and Card Storage

Payments are processed by Square, a PCI DSS Level 1 certified provider. Card details are entered directly into Square’s secure fields and are never transmitted through or stored on our own servers. When you book, we place an authorization hold rather than an immediate charge, and we capture payment after your service is complete. Because an authorization hold expires after a limited period, a tokenized reference to your card is stored in Square’s vault so we can re-authorize the hold if your appointment is far out or your job runs long. We can use this token only to authorize or collect payment for your booking; we cannot view or export your card number.

5. Cookies and Tracking

Our public site does not use third-party advertising or analytics trackers. We use strictly necessary, first-party cookies for essential functions such as keeping staff signed in to the admin dashboard and protecting against cross-site request forgery. We do not use cookies to build advertising profiles.

6. Data Retention

We keep booking and service records for as long as needed to provide warranties, resolve disputes, and meet tax and accounting obligations — generally up to seven years for financial records, and up to three years for other booking history. Uploaded parking photos are retained only as long as needed for the service and dispute resolution and are then deleted. Contact information captured from incomplete bookings is retained for a limited follow-up period and then deleted if the booking is not completed. Job-application materials are retained for our recruiting needs and then deleted. You may request earlier deletion as described below.

7. Security

All data is transmitted over HTTPS and stored with industry-standard encryption at rest. We restrict access to personal information to authorized staff, enforce a strict Content Security Policy, rate-limit sensitive endpoints, and store uploaded files in private (non-public) storage. No method of transmission or storage is perfectly secure, but we work to protect your information using appropriate technical and organizational measures.

8. Your Privacy Rights

California (CCPA/CPRA).If you are a California resident, you have the right to know what personal information we collect and how we use and disclose it; to request access to and a copy of that information; to request correction or deletion; and to be free from discrimination for exercising your rights. We do not sell or “share” (for cross-context behavioral advertising) your personal information, so there is no need to opt out of sale/sharing.

EU/UK (GDPR). If you are in the EU, EEA, or UK, you have the right to access, correct, delete, restrict, or object to our processing of your personal information; the right to data portability; the right to withdraw consent where processing is based on consent; and the right to lodge a complaint with your local supervisory authority.

To exercise any of these rights — including deleting contact information captured from an incomplete booking — contact us through our contact page. We will verify your request and respond within the timeframes required by applicable law. You may use an authorized agent where the law permits.

9. Children’s Privacy

Our service is intended for adults and is not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child has provided us information, please contact us and we will delete it.

10. International Users

We operate in the United States, and the information we collect is processed and stored in the United States. If you access our service from outside the United States, you understand that your information will be transferred to and processed in the United States, which may have data protection laws different from those in your country.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above. Material changes will be reflected on this page.

12. Contact Us

For any privacy question, or to exercise your rights or request deletion of your data, reach us through our contact page.