Privacy Policy

Last updated: 17 July 2026

AutoVin is operated by Shrayan Venugopal t/a AutoVin, ABN 55 879 826 155 ("AutoVin", "we", "us").

Who this policy covers

Two groups of people appear in AutoVin:

• Garages: the workshops that sign up for an AutoVin account. They are our customers.
• A garage's customers: the vehicle owners whose details a garage enters to manage repair jobs. The garage controls those records. We store and process them on the garage's behalf.

We are an Australian business and handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Many garages using AutoVin are in the United Arab Emirates, so the people in their records may be too.

What we store

• Garage account data: the workshop's business details and staff accounts, meaning name, email, phone, role and login records.
• Workshop records: whatever the garage enters to run its jobs. This includes customer and account details (name, phone, email, address, tax registration number), vehicle details (plate, VIN, make and model, insurance details), vehicle owner details (name, phone, email, address and Emirates ID where the garage records it) and the job paperwork itself, from bookings and estimates through job cards, invoices and parts.
• Uploaded files: photos and documents the garage attaches to its records, such as vehicle and damage photos.
• The WhatsApp message log: for each update sent we keep the recipient's phone number, the template used, the details filled into it (the customer's first name, the vehicle, amounts, the tracking link) and the delivery status. We do not store customers' replies or chat history. The WhatsApp section below covers this in detail.
• The email log: the recipient address, subject line and delivery status of emails sent on the garage's behalf. We do not keep the message body.
• An audit trail: a log of actions taken by garage staff in the system, including the IP address each action came from.

WhatsApp messaging

Garages can send their customers repair status updates on WhatsApp. It works like this:

• Each garage connects its own WhatsApp Business Account through Meta's Embedded Signup, so messages come from the garage's own business number. AutoVin is the technology provider that sends them on the garage's behalf via Meta's WhatsApp Cloud API.
• Every message uses a template Meta has approved for utility messaging, such as a repair status update or a pickup notice. There is no free-form messaging and no marketing messaging through AutoVin.
• The access token Meta issues for the garage's account is stored encrypted with AES-256-GCM. It is used to send the garage's messages and manage its templates, nothing more.
• Meta sends us delivery receipts (sent, delivered, read, failed) and we record them against the message log. Incoming messages from customers are not stored by AutoVin. Replies go to the garage's own WhatsApp.
• Message content is used to deliver the garage's update. It is not used for advertising or profiling.
• Opting out: updates link to a tracking page for the vehicle, and that page has a "Stop receiving WhatsApp updates" option. Using it stops messages for that vehicle immediately and cancels anything still queued. A customer can also ask the garage to turn updates off.

Vehicle tracking pages

Status updates can include a link to a tracking page for the vehicle. The link contains a long random token that cannot be guessed. The page shows the garage's branding, the vehicle, its repair status history, key dates and the customer's first name. It does not show costs or internal notes, and staff are not named on it.

Where data lives

AutoVin runs on:

• Supabase: database and file storage. Each garage's data is isolated with row-level security, and uploaded files sit in private storage reachable only through time-limited signed links.
• Vercel: application hosting.
• Resend: email delivery for status updates and account emails.
• Meta (WhatsApp): message delivery, as described above.

These providers process data on our behalf and may store it on servers outside Australia or the UAE. We do not sell personal information, and we do not share it with anyone beyond these providers unless the law requires it.

Cookies

AutoVin uses cookies to keep garage staff signed in to their accounts. There are no advertising or analytics cookies.

Security

• Traffic is encrypted in transit over HTTPS.
• WhatsApp access tokens and email API keys are encrypted at rest with AES-256-GCM and are never written to logs.
• Each garage's data is separated with database row-level security. Within a garage, staff access is controlled by role-based permissions.
• Uploaded files are private and served through expiring links.

If a security breach ever puts personal information at risk, we will investigate and notify the affected garages promptly.

Retention

Workshop records are the garage's business records, so we keep them for as long as the garage's account is active. When an account is closed, or we receive a valid deletion request, the data is removed as set out in our data deletion instructions. That includes message logs and uploaded files.

Access, correction and deletion

Garages can view and correct their own records directly in AutoVin. If you are a garage's customer, the garage controls your records, so start by contacting the garage. You can also email hello@autovin.dev and we will help. Deletion is covered step by step in our data deletion instructions.

Changes to this policy

If we change this policy we will update this page and the date at the top. We will flag material changes to garages in the application or by email.

Contact

Shrayan Venugopal t/a AutoVin, ABN 55 879 826 155
Email: hello@autovin.dev

If you are not happy with how we handle a privacy concern, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.