Privacy Policy

• Account details — email address, password (stored hashed, never in readable form), username, display name, and optionally your location, specialties, avatar and banner images.
• Business details (shop accounts) — business name, address, phone, email, website, social handles, labor and tax rates, shop supplies fee, repair-order and customer numbering, and pay-period settings.
• Vehicle and build records — vehicle names, VINs, mileage, parts, prices, vendors, links, labor hours and rates, statuses, photos, documents, maintenance history and notes.
• Staff and technician details — for shop accounts, the names of technicians, and for the Small Shop tier their pay basis, hourly rate, and hours you record for a pay period. Full shop staff have their own accounts with the details above.
• Internal cost figures — what you paid for a part. This is shown only to you and is deliberately excluded from every customer-facing document.

• Authentication data — session identifiers, sign-in timestamps, and password-reset tokens, handled by our authentication provider.
• Server logs — standard web-server records kept by our host, which include IP addresses and browser user-agent strings.
• Abuse-prevention counters — when the customer approval pages are used, we record a short-lived count of requests per IP address so that no one can flood those pages. These counters are deleted automatically after roughly a day.

We do not use advertising or analytics cookies, and we run no third-party tracking scripts. The only browser storage we use is functional: your light/dark theme preference, your dashboard view preference, and whether you've hidden the internal margin panel. Signing in uses standard authentication session cookies, not tracking cookies. Because we do not track you across sites, we have nothing to change in response to a Do Not Track or Global Privacy Control signal.

Shop accounts enter details about their own customers — name, phone, email, address, vehicles and VINs, and the work performed. The shop decides what to collect and why. We hold it on their behalf. In the language of privacy law, the shop is the controller (or business) and we are the processor (or service provider).

When a shop sends an approval link and a customer opens and signs it, we additionally record: the approve/decline choice made on each line and any reason given, the name typed, the signature drawn, the date and time, and the IP address and browser reported by the device used. The last two exist specifically so the signature can be attributed later — that is what makes an electronic signature meaningful — and are kept as part of the signed record.

Each shop's customer records are isolated. Customer records and numbering are scoped to the shop that created them, and one shop cannot see another shop's customers, even where the same person is a customer of both.

If you are a shop's customer and want to see, correct or delete what a shop holds about you, contact that shop — they control the record. You can also write to us at support@specistry.com and we will pass the request to the shop and help them act on it.

We use personal information only to:

• provide the service — your account, your records, and the documents you generate;
• authenticate you and keep accounts secure;
• send transactional email such as confirmation and password reset;
• prevent abuse, fraud and denial-of-service against the app;
• diagnose faults and improve the product;
• comply with law and enforce our Terms.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use your data to train machine-learning models. We do not send marketing email to shop customers.

We use a small number of service providers. Here is exactly what each receives:

• Supabase — database, authentication and file storage. Receives essentially all data described above. Data is stored in the United States.
• Vercel — hosts the application. Receives requests and keeps standard server logs, including IP addresses.
• Resend— sends account email (confirmation, password reset) and powers the optional “notify me” list on our shops page, which only ever receives the address typed into that form.
• Hostinger — domain registrar and DNS, and hosts our support inbox. Not otherwise involved in processing your data.
• Firecrawl and microlink.io — when you paste a product URL, these may fetch that page to read its price and image or generate a preview. They receive the URL, not your account information.
• NHTSA — a free public U.S. government API that decodes a VIN into year, make and model. Receives the VIN you enter.

We may also disclose information if required by law or valid legal process, to protect our rights or someone's safety, or in connection with a merger or sale of assets — in which case we will give notice and this policy will continue to apply until replaced.

You can view and change most of your information in the app. To request a copy of your data, correction, or deletion, email support@specistry.com. We will respond within 45 days.

Depending on where you live you may have specific rights — to know what we hold, to obtain a copy, to correct or delete it, to opt out of sale or sharing (we do neither), and not to be discriminated against for exercising them. We honor these requests regardless of where you live rather than checking your eligibility first.

A limit worth stating plainly: if a shop entered information about you, we usually cannot delete it unilaterally — it belongs to that shop's business records, and they may be required to keep it. We will route your request to them.

We keep your data while your account is active. There is not yet a self-service delete button; email support@specistry.com and we will process the request. We are working toward a self-service option.

Some data is kept longer for good reason: signed approval records are retained as evidence of an authorization, and shops may need them for warranty or dispute purposes. Abuse-prevention counters are deleted after about a day. Deleted content may persist in routine backups for a limited period before being overwritten.

Passwords are hashed, never stored in readable form, and must meet a strength requirement. Access to your records is enforced at the database level, not just in the app. Customer approval links use a cryptographically random token of which we store only a one-way hash, so even a copy of our database would not reopen a live estimate. Approval pages are rate limited. Internal cost and margin figures are excluded from every customer-facing document by design.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal information we will notify you and any regulator as required by law.

Specistry is not intended for anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us information, email us and we will delete it.

We operate in the United States and store data there. If you use Specistry from elsewhere, you are transferring your information to the United States, where privacy laws may differ from those in your country.

We may update this policy. If a change is material we will make reasonable efforts to notify you before it takes effect. The “last updated” date above always reflects the current version.

Questions, or to exercise any right above: support@specistry.com.