Privacy Policy

This policy explains what personal information Gearloom (Chris Johnson, doing business as Gearloom; “we”, “us”) handles, why, and your choices. It covers gearloom.app, the back office at app.gearloom.app, and the websites we host for shops.

Two kinds of information

About the shops that use Gearloom. When a shop signs up, we collect the owner's and team members' names, email addresses, phone numbers and passwords (stored only as secure hashes), the shop's business details, and billing information handled by Stripe. We decide how this is used, and this policy governs it.

About a shop's customers. Shops use Gearloom to keep records of their own customers: names, contact details, vehicles, enquiries, messages, quotes, invoices, appointments, warranties and service history. We process that information on the shop's behalf and under its instructions; the shop decides how it is used. If you are a customer of a shop and have a question about your information, contact the shop. We'll help it respond.

What we collect, and how

• Information you give us: signup and account details, what you enter into Gearloom, and messages to our support.
• Information from use: when team members last used Gearloom, a log of significant actions in each shop (for its records and security), and standard server logs such as IP addresses and browser type.
• On shop websites: what visitors submit in quote, booking and chat forms, and which ad, search or page first brought them there (see “Cookies and browser storage”).
• Email activity: whether emails a shop sends through Gearloom are delivered, opened and clicked, so the shop can follow up.

How we use it

• To provide Gearloom: run each shop's account, host its website, send the emails and messages it asks us to, and process its subscription.
• To keep it secure: sign-ins, preventing abuse, and investigating problems.
• To communicate with shops about their account, billing and important changes.
• To improve Gearloom, using information about how it is used.

We don't sell personal information, and we don't share it for advertising.

Who we share it with

Only the service providers that run Gearloom for us, each for its own part:

• Vercel, which hosts Gearloom and stores uploaded photos;
• Neon, which hosts our database;
• Resend, which sends and receives email;
• Stripe, which processes subscription payments;
• Anthropic, only for shops that turn on the AI assistant: the messages and details it works on are sent to Anthropic's API to produce drafts, summaries and lists, under terms that don't allow Anthropic to use them to train its models;
• services a shop chooses to connect, such as Square (its customers' payments), Google Calendar and Mailchimp, which receive what that connection needs.

We may also disclose information if the law requires it, to protect people's safety or our rights, or as part of a sale or reorganisation of Gearloom, in which case this policy continues to apply.

Cookies and browser storage

We don't use advertising or third-party analytics cookies. We use only what Gearloom needs to work:

• admin_session: keeps shop staff signed in to the back office (up to 30 days).
• portal_session: keeps a shop's customer signed in to that shop's customer portal (up to 30 days).
• gl_site_theme: on sites that offer it, remembers the design a visitor chose to preview (30 days).
• gl_first_touch (browser storage on shop websites): remembers the ad, search or page that first brought a visitor, for 90 days, so a later enquiry is credited to it.

How long we keep it

We keep a shop's information while its account is open. After an account closes, the shop can ask for a copy within 30 days; after that we delete it or make it anonymous, except records we must keep by law (such as billing records). Signups that are never confirmed are deleted about a week after their link expires.

Security

Information travels encrypted (HTTPS). Passwords are stored as one-way hashes, and the credentials shops connect (such as email and payment keys) are encrypted in our database. Each shop's data is kept separate from every other shop's. No system is perfectly secure; if a breach affects your information, we'll tell you as the law requires.

Your choices and rights

• Shop users can see and correct their account details in Settings, and ask us to delete their account.
• Anyone can unsubscribe from marketing emails using the link in them.
• California residents have the right to know what personal information we collect and how it is used, to ask for it to be deleted or corrected, and not to be discriminated against for doing so. We don't sell or share personal information as those terms are defined in California law.

To make a request, email support@gearloom.app. We'll confirm it's you before acting on it. If your request is about a shop's records of you as its customer, we'll pass it to that shop.

Children

Gearloom is for businesses and isn't directed at children under 16. We don't knowingly collect their information.

Changes

We'll update this policy as Gearloom changes, and change the date above. If a change is significant, we'll tell shops by email or in Gearloom before it applies. Our Terms of Service explain the rest of our agreement with shops.

Contact

Questions about privacy: support@gearloom.app.