WrenchHarbor Privacy Policy
Version 2026-10-19.us.3 · October 19, 2026
1. Who we are and the scope of this policy
OMNI SISTEMAS - SOFTWARE HOUSE LTDA, a company established in Brazil, operates WrenchHarbor. Business address: Rua Bacurau Americano, 170, Jardim Planalto, Arapongas - PR, 86706806, Brazil. Email: contato@oficinatop.com.br. This policy explains how we handle personal information through the WrenchHarbor website and service. We determine how account, subscription, support and security information is used to operate our business. Each shop determines the purposes and lawful basis for the customer, staff and vehicle records it enters; we process those records to deliver the shop’s requested service. If your information was entered by a shop, you may contact that shop or ask us to help route your request.
2. Information we process
We process information you provide, including account names and email addresses; business and contact details; team roles; customers and vehicle identifiers; estimates, repair orders, inspections, photos and other uploaded content; and operational and financial records. Subscription information includes Stripe customer and subscription references, invoice status, plan, payment history and document acceptance evidence. Stripe receives card details directly; full card numbers and security codes are not stored by WrenchHarbor. Technical information may include IP addresses, browser/device characteristics, request times, usage events, authentication records and error or security logs. We do not require customer Social Security numbers or Brazilian CPF/CNPJ identifiers; avoid uploading unnecessary sensitive information.
3. Sources and purposes
Information comes from account users, the shop that manages the record, connected providers acting on the shop’s instructions, and interactions with our service. We use it to authenticate users, isolate shop records, provide requested workflows and documents, manage subscriptions and trial eligibility, respond to support and privacy requests, prevent abuse, troubleshoot and maintain reliability, and comply with legal obligations. Where applicable, these activities rely on performing our agreement, legitimate operational and security interests, legal obligations or consent for the specific optional activity. We do not use subscription acceptance as consent to advertising or shop marketing.
4. Service providers and disclosures
Our current core providers are Vercel for application and website hosting and technical traffic measurement, Supabase for database, authentication and realtime infrastructure, and Stripe for subscription billing and payment processing. These providers receive the information needed for their functions and operate under their own applicable terms and privacy notices. Staff and contractors receive access only as needed for their work. Optional file storage, email, AI and messaging providers receive content only when their feature is configured and used; those features may remain unavailable while infrastructure is being prepared. We do not activate optional outbound communications merely because a record contains a phone number or email address. We may disclose information when legally required, to address fraud or threats, to protect rights or safety, or in a business transfer with appropriate protections and notice where required.
5. International processing
The dedicated WrenchHarbor database is hosted in the United States. Our operating company is in Brazil, and authorized support access, hosting networks and service providers may process information in the United States, Brazil or other countries where they operate. We do not promise that every copy or processing activity remains in the United States. Where applicable law requires safeguards for a transfer, we use the relevant contractual or other lawful protections; contact us for information about a specific transfer. We do not import the Brazilian product’s customer records into WrenchHarbor.
6. Cookies, measurement and communications
We use authentication/session cookies and local device storage to keep you signed in, protect requests and remember interface preferences. Vercel may process technical traffic and performance information for the hosted service. The current US deployment does not enable advertising pixels, cross-site targeted advertising or customer marketing campaigns. Browser Do Not Track signals do not change essential session or security functions. We do not sell personal information or share it for cross-context behavioral advertising; consequently there is no such sale or sharing to opt out of in this deployment. Global Privacy Control does not trigger advertising or sale/sharing that is otherwise disabled. Security, billing and requested support communications are separate from optional marketing, which requires its own lawful permissions and cancellation mechanism before activation.
7. Retention and deletion
We keep shop records while the account is maintained and the shop needs the service, including read access after subscription expiry. Canceling a subscription does not automatically delete its records. Retention depends on the type of information, the shop’s instructions, legal or accounting obligations, security needs and unresolved disputes. On a verified deletion request, we delete or de-identify information we no longer need and explain any applicable exceptions. Limited backups may retain copies until their normal lifecycle ends; they are restricted and are not used to restore a deleted account for ordinary business purposes. We retain agreement and billing evidence as needed to meet legal obligations and resolve disputes. Contact Support before account closure to arrange the export of records you must retain.
8. Access, correction and other requests
Contact us to request access, correction, a copy or export, deletion, or information about how your data is used. Depending on your location and the law that applies, you may also have rights to object, restrict processing, withdraw consent, opt out of specified processing, or appeal a refusal. Describe your request and relationship to the shop without sending passwords, full card details or unnecessary identity documents. We may verify your identity and authority proportionately, involve the shop responsible for the record, and explain a lawful refusal. An authorized agent may contact us with evidence of permission. We respond within the applicable legal time limits, do not discriminate for exercising applicable privacy rights, and provide an explanation and a contact for review when a request cannot be fulfilled. Email: contato@oficinatop.com.br.
9. Security, children and changes
We use access controls, encrypted connections and shop-based authorization to protect information, but no system is completely secure. Report a suspected incident through Support; do not include other customers’ records unnecessarily. The service is for businesses and is not directed to children under 18; contact us if a child’s information was submitted improperly. We will update this policy when our practices change and communicate material changes through the service or account contact where appropriate. The effective date and version are shown on this page. Email: contato@oficinatop.com.br.