Privacy Policy

This Privacy Policy describes how Gearbox Technologies LLC handles personal information through BayNerve, its websites, and related support and account services.

For account administration, subscriptions, service security, product operations, and direct business inquiries, Gearbox Technologies LLC determines why and how information is processed. For customer, vehicle, employee, and shop records entered into a customer workspace, the shop generally determines the purpose of processing and Gearbox Technologies LLC processes the information to provide BayNerve under the customer's instructions.

This policy does not govern a shop's own privacy practices or an independently operated third-party service.

We process names, email addresses, password hashes, shop membership, role and capability settings, invitation records, account status, authentication timestamps, multifactor authentication settings, and related security events.

We process shop names, logos, settings, subscription status, connected-service identifiers, team records, workflow configuration, audit activity, support requests, and administrative actions.

Depending on shop use, BayNerve processes customer names and contact details, vehicle identification numbers and vehicle details, appointments, work orders, inspections, estimates, approvals, invoices, payment records, assignments, time entries, parts, notes, messages, consent events, documents, photos, videos, audio, and record history.

BayNerve also processes inventory, pricing, accounting connection, synchronization, reporting, import, export, and migration information when a shop uses those features.

The shop decides what information to enter and is responsible for its notices, permissions, recordkeeping duties, and responses to its customers and personnel.

Stripe processes payment credentials for BayNerve subscriptions and, when a shop enables Stripe Connect, for that shop's customer transactions. BayNerve stores identifiers and operational details such as Stripe customer, subscription, account, product, price, charge, payment, status, amount, and billing-period references.

BayNerve is not designed to receive or store full payment card numbers. Payment information entered on Stripe-hosted or Stripe-provided interfaces is governed by Stripe's privacy practices.

We process request and authentication metadata, IP-related security identifiers, browser and device information, timestamps, routes, error details, diagnostic events, feature activity, and security logs when needed to run, protect, troubleshoot, and support the service.

Vercel Web Analytics can process page paths, referrer information, approximate location, and browser, device, and operating-system information in aggregated analytics. BayNerve filters analytics from operational dashboard, portal, booking, store, and API routes.

BayNerve uses an authentication cookie or token to maintain signed-in sessions. Optional Google reCAPTCHA can be used on authentication pages and is subject to Google's terms and privacy practices.

The application can use browser local storage for interface state and offline text drafts. It can use IndexedDB for queued offline form information and media awaiting upload. This device-side information remains on the device until uploaded, cleared by the application, removed by the user, or removed by browser storage controls.

Vercel states that its Web Analytics product does not use cookies or collect personal information for cross-site tracking. BayNerve does not include an advertising network.

When a user invokes an AI or voice feature, relevant audio, text, and workspace context can be sent to OpenAI for transcription, embeddings, search, or briefing features, or to Anthropic for structured notes and summaries. BayNerve records provider, model, input references, output, review status, and diagnostic information for supported AI generations.

AI output is provided for human review. Users control whether to invoke optional features and must have authority to submit the information. Provider retention and model-training treatment depends on the applicable provider account and service terms; this policy does not make a broader promise about those provider practices.

We receive information from users, shop administrators, customers interacting with a shop portal or storefront, connected Stripe and QuickBooks accounts, support communications, user devices, and service infrastructure.

We can also receive information from imported files, migration tools, payment and communications providers, authorized users in the same workspace, and user-enabled integrations.

Vehicle and recall features can retrieve data from United States government sources including NHTSA vPIC and recall services. Optional integrations can provide data when enabled by a shop.

We use information to authenticate users; provide and configure workspaces; operate shop workflows; store and display records; process subscriptions and connected payments; provide user-invoked integrations and AI features; respond to support; monitor reliability; detect abuse; protect accounts; diagnose problems; maintain audit history; enforce agreements; and comply with legal obligations.

We use communication records to prepare, record, suppress, and, when a transport is enabled, facilitate shop-directed communications. We do not treat transactional communications as permission for unrelated marketing.

We can use aggregated or deidentified information, including through service providers acting on our behalf, to understand and improve the service when it is not reasonably linkable to an individual or customer. Providers can separately process identifiable uploads when necessary to deliver an enabled feature or contracted service; this does not mean that every upload is deidentified.

We do not attempt to reidentify information we treat as deidentified, and we require a service provider receiving that information to maintain the same limitation for its work on our behalf.

If a shop owner separately opts in, we use the shop name and logo to identify the shop as a BayNerve customer on BayNerve's website and social media accounts. This optional choice is not part of required Terms acceptance and can be withdrawn through Account settings. We require separate permission before using a testimonial, personal likeness, repair record, or other uploaded content for advertising.

We disclose information to service providers that perform hosting, database, storage, payment, analytics, security, support, email, AI, transcription, error-monitoring, and integration functions. The Legal Center identifies providers the application is built to use and notes which services depend on configuration or a user-enabled feature.

Information in a workspace is disclosed to the shop owner, administrators, and other Authorized Users according to their roles and capabilities. A shop can direct disclosure to its End Customers through portals, records, exports, or connected services.

We disclose information at a customer's direction, to connected services, as part of a corporate transaction, to protect rights and service security, or when reasonably necessary to comply with valid legal process.

BayNerve does not include a feature for selling personal information or using shop records for cross-context behavioral advertising. We do not sell or share shop records for those purposes.

We retain information based on the type of record, customer instructions, account and subscription status, security and audit needs, dispute and support needs, financial recordkeeping, backup cycles, and legal requirements.

The current product does not automatically purge a workspace when a subscription is canceled or a user is deactivated. Shop records remain until removed through available controls or a verified support process, subject to legitimate retention needs. Local offline drafts and queued uploads are subject to browser storage and application cleanup behavior.

BayNerve uses safeguards intended to protect information, including password hashing, role and capability checks, encrypted transport provided by the hosting platform, encryption features for selected integration secrets and multifactor authentication material, rate limiting, security headers, private storage access controls, and logging controls intended to redact common secret fields.

No safeguard can guarantee that information will never be accessed, changed, lost, or disclosed. Customers are responsible for their users, devices, exports, credentials, and access decisions.

Account holders can update selected profile and security settings. Authorized shop users with export permission can download supported record categories as CSV files. Shop administrators can manage user access. A non-owner can use the account settings to deactivate the user's login; an owner must contact support for ownership or workspace changes.

A shop owner can grant or withdraw the optional shop-name and logo publicity permission in Account settings. Withdrawal stops new uses. Removal of existing materials requires operational processing and cannot recall material already lawfully distributed outside BayNerve's control.

You may ask to access, correct, delete, or obtain a copy of personal information, or object to certain processing. We will evaluate requests under applicable law and can offer comparable requests voluntarily when reasonably feasible. We may verify identity and authority, and exceptions can apply.

Where applicable law provides them, a person may also request an opt-out of sale, targeted advertising, or qualifying profiling; use an authorized agent; appeal a denied request; and receive service without unlawful discrimination for exercising a privacy right. We will explain an available appeal route in a denial response when required.

If your request concerns records controlled by an automotive shop, contact that shop first. We will assist the shop as described in the Data Processing Addendum.

The Alabama Personal Data Protection Act is scheduled to take effect on May 1, 2027 and applies only when its statutory scope and thresholds are met. This policy does not state that the Act currently applies to Gearbox Technologies LLC or to every BayNerve customer.

Residents of a state with an applicable privacy law may have rights and appeal options under that law. We will respond as required after verifying the request and determining the applicable role, scope, and exceptions. BayNerve does not discriminate against a person for exercising an applicable privacy right.

BayNerve does not include a data-sale feature, cross-context behavioral advertising network, or a feature that makes a legally significant decision about a consumer through qualifying profiling. Sensitive shop records are processed to provide user-directed business features, not for an unrelated advertising purpose. This policy will be updated if BayNerve's practices change.

BayNerve is a business service for users age 18 or older and is not directed to children. Shops must not submit children's information unless they have an appropriate business purpose and authority to do so.

Information about a shop's personnel is controlled by the shop and can be subject to employment or contractor rules outside this policy.

BayNerve is currently intended for United States business operations. This policy does not claim compliance with privacy laws outside the United States.

We can update this policy as the product or law changes. The effective date and version identify the current text. BayNerve will request affirmative acknowledgment before an existing user resumes operational access after a material update that requires reacceptance.

Privacy questions and requests may be sent to info@gearboxtechnologies.com.