Privacy Policy

This Privacy Policy explains how Wrench Cloud (“Wrench Cloud”, “we”, “us” or “our”) collects, uses, shares, retains and protects information when you use our garage-management platform, including the website at wrenchcloud.in and its tenant subdomains, our Android and iOS mobile applications (package in.wrenchcloud.app), and any related services (together, the “Service”).

By creating an account or using the Service, you agree to the practices described in this policy. If you do not agree, please do not use the Service.

Wrench Cloud is a business-to-business (B2B) software-as-a-service platform used by automotive garages and workshops (each a “Tenant”) to manage their operations.

• As a data fiduciary/controller for account holders (garage owners, admins and staff), we determine how their account and usage data is handled.
• As a data processor for the end-customer, vehicle and job data that a Tenant enters into the Service, we process that data solely on the Tenant’s instructions. The Tenant is the controller of that data. If you are a customer of a garage, please direct privacy requests to that garage.

We collect the following categories of information:

a. Account & identity data

• Name, email address, phone number and role, provided during sign-up or onboarding.
• Authentication credentials. Passwords are handled by our authentication provider (Supabase Auth) and are stored only as salted hashes — we never see or store your plaintext password.
• Business/garage name and profile details.

b. Operational data you enter

• Your customers’ details (name, phone, email, address, GSTIN), vehicles, job cards, estimates, invoices, inventory, mechanics and payment records.

c. Payment data

• Online payments are processed by our payment gateway (Razorpay). We do not collect or store full card numbers, CVV or bank credentials; the gateway handles those directly. We retain transaction references and status only.

d. Usage, device & diagnostic data

• Device type, operating system, app version, IP address, general location inferred from IP, pages/screens viewed and feature usage, collected via analytics and error-monitoring tools.
• Crash reports and diagnostic logs to help us fix problems and keep the Service reliable and secure.

We do not knowingly collect biometric data, precise GPS location, contacts, photos or microphone/camera input through the mobile app beyond what is described in the permissions section below.

The Wrench Cloud mobile app requests only the permissions it needs to function:

• Internet / network access — to sync your data securely with our servers.
• Secure device storage— to keep you signed in by storing your session token in the device’s encrypted keystore.
• File sharing / storage — to generate and share documents such as estimates and invoices (for example, when you export or share a PDF).

• To provide, operate and maintain the Service.
• To authenticate you and enforce tenant data isolation and security.
• To process transactions and generate invoices.
• To send service-related communications (for example via email or, where enabled, WhatsApp) such as job updates and receipts.
• To monitor, debug and improve performance, reliability and features.
• To prevent fraud and abuse and to comply with legal obligations (including tax/GST record-keeping in India).

Where the Digital Personal Data Protection Act, 2023 (India) or other applicable law applies, we process personal data on the basis of your consent, the performance of our contract with you, our legitimate business interests in operating the Service, and compliance with legal obligations.

We do not sell your personal data. We share information only in the following circumstances:

• Sub-processors / service providers who help us run the Service under contractual confidentiality and data protection obligations, including: Supabase (database, authentication and storage), Vercel (application hosting and analytics), Google Analytics (usage analytics), Sentry (error monitoring), Razorpay (payments), and Meta/WhatsApp Business (messaging, where you enable it).
• Within your Tenant — data is visible to other authorised users of the same garage account, governed by role-based access.
• Legal & safety — where required by law, regulation, legal process or to protect the rights, safety and property of Wrench Cloud, our users or the public.
• Business transfers — in connection with a merger, acquisition or sale of assets, subject to this policy.

We retain personal and operational data for as long as your account is active and as needed to provide the Service. After account closure we delete or anonymise data within a reasonable period, except where longer retention is required for legal, tax/GST, accounting or dispute-resolution purposes. Diagnostic logs are retained for a limited period on a rolling basis.

We use industry-standard safeguards to protect your data, including encryption in transit (HTTPS/TLS), encryption at rest at the infrastructure level, hashed passwords, and strict multi-tenant isolation enforced by PostgreSQL Row-Level Security so that one Tenant cannot access another Tenant’s data. Access to production systems is restricted and audited. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

You can request deletion of your account and the associated personal data at any time:

• Email info@wrenchcloud.in from your registered email address with the subject “Account and data deletion request”, or ask your garage administrator to raise the request on your behalf.
• We will verify your identity and process the request within 30 days.
• Upon deletion we remove your account and associated personal data. Some records may be retained in anonymised form, or as required to meet legal, tax/GST, accounting or fraud-prevention obligations, after which they are deleted.
• If you are an end-customer of a garage, deletion of your data is controlled by that garage (the data fiduciary); we will assist them in fulfilling your request.

Subject to applicable law, you have the right to access, correct, update and delete your personal data, to withdraw consent, and to lodge a grievance. To exercise these rights, contact us using the details below. We will respond within the timelines required by applicable law.

The Service is intended for businesses and is not directed to children under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

Our service providers may process and store data on servers located outside your country. Where we transfer data internationally, we take steps to ensure it receives an adequate level of protection consistent with this policy and applicable law.

The Service may contain links to third-party websites or services that we do not operate. This policy does not apply to those third parties, and we are not responsible for their privacy practices. Please review their policies separately.

We may update this Privacy Policy from time to time. When we make material changes we will update the effective date above and, where appropriate, notify you through the Service. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

For any questions, requests or complaints about this policy or your data, contact us at:

• Wrench Cloud
• General privacy enquiries: info@wrenchcloud.in
• Grievance Officer (DPDP Act, 2023): info@wrenchcloud.in