Privacy Policy

This Privacy Policy explains how SanX Solutions (“Dent Removal”, “we”, “us”, or “our”) collects, uses, discloses, and protects personal information when you use the Dent Removalapplication and related websites and services (the “Service”). Dent Removal is a business tool for paintless dent removal (PDR) companies to manage vehicles, technicians, jobs, goals, and reporting.

We act as the data controller for account and service data we determine the purposes of. Where a PDR company deploys Dent Removalto manage its own workforce, that company may also be a controller of its employees’ work data, and we process such data on the terms of this Policy. If you do not agree with this Policy, please do not use the Service.

1. Information We Collect

1.1 Information you provide

• Account & identity: full name, email address, phone number, account password (stored only as a salted hash by our authentication provider), and your role (e.g., technician, admin).
• Profile photo (face image):if you add a profile picture, we store that image. A facial photograph may be considered sensitive personal data in some jurisdictions; we use it solely to identify you within your organization’s workspace.
• Sign-in with Google (optional): if you authenticate with Google, we receive your basic Google profile (name, email address, and profile picture) to create or link your account.
• Vehicle & work data: Vehicle Identification Numbers (VINs), vehicle make/model/year, photographs of vehicles and dents you capture, job records, crew assignments and hand-offs, work notes and in-app chat messages, and related timestamps.
• Financial data: job payment and payout records, amounts, and configured rates used to calculate technician earnings and company figures. We do not collect or process payment-card numbers.
• Communications: messages you send us for support or inquiries.

1.2 Information collected automatically

• Device & technical data: IP address, browser and device type, operating system, and similar technical identifiers.
• Usage & log data: actions taken in the Service, access times, and error/diagnostic logs.
• Push notification tokens: if you enable notifications, a device/browser push token so we can deliver alerts.
• Cookies:strictly necessary cookies for authentication (session) and to remember your selected project. See “Cookies” below.

1.3 Camera and photos

With your permission, the Service uses your device’s camerato scan VIN barcodes/labels and to take photographs of vehicles and dents. Images and the text read from them are used to register and document jobs. To recognize VINs, vehicle images and/or extracted text may be sent to third-party optical character recognition (OCR) providers (see “How We Share”). The camera is never used for any purpose other than the features you invoke, and we do not access your camera in the background.

1.4 What we do NOT collect

We do not collect precise geolocation, payment-card data, biometric templates for identification, advertising identifiers, and we do not use third-party advertising or cross-app tracking technologies.

2. How We Use Information

• Provide, operate, maintain, and secure the Service.
• Authenticate you and manage your account, roles, and permissions.
• Register vehicles, manage jobs, crews, hand-offs, goals, notes, and reporting.
• Calculate and display earnings, payouts, and business figures to authorized users.
• Send transactional emails and (if enabled) push notifications.
• Prevent fraud and abuse, enforce rate limits, and protect the security and integrity of the Service.
• Provide support and respond to your requests.
• Comply with legal obligations and enforce our Terms.

3. Legal Bases for Processing

Where the GDPR (EU/UK), LGPD (Brazil), or similar laws apply, we rely on: performance of a contract (to provide the Service you or your employer requested); legitimate interests (to secure, improve, and operate the Service, and to prevent fraud); consent (e.g., camera access and push notifications, which you can withdraw at any time via your device settings); and compliance with legal obligations.

4. How We Share Information

We do not sell your personal information. We share it only as described here:

• Within your organization:your employer’s administrators and, where relevant, crew members can see work data and your basic profile (name and photo) needed to coordinate jobs.
• Service providers (sub-processors) that operate the Service on our behalf under contractual confidentiality and security obligations, including: hosting, database, authentication and file storage (Supabase); application hosting and content delivery (Vercel); transactional email delivery (Resend); VIN/OCR recognition (Google Cloud Vision, OpenAI, and Google Gemini); rate-limiting and abuse prevention (Upstash); sign-in (Google); and push notification delivery (Apple Push Notification service, Google Firebase Cloud Messaging, and/or web-push services).
• Legal & safety: when required by law, legal process, or to protect the rights, property, or safety of users, the public, or us.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

5. International Data Transfers

Dent Removalis offered globally and our providers may process and store data in countries other than yours, including the United States and the European Union. Where required, we use appropriate safeguards for international transfers (such as the European Commission’s Standard Contractual Clauses) and select providers that maintain recognized security and privacy standards.

6. Data Retention

We retain personal data for as long as your account is active and as needed to provide the Service. When an account is removed, we delete the associated profile (face) photo and replace direct contact identifiers with non-identifying tombstone values; certain work records (e.g., jobs and financial entries) are retained as legitimate business and accounting records, or as required by law. We delete or anonymize data when it is no longer needed for these purposes.

7. Security

We use technical and organizational measures to protect personal data, including encryption in transit (HTTPS/TLS), row-level access controls so users only access data they are authorized to see, private file storage served through authenticated proxies, hashed passwords, rate-limiting, and least-privilege access to production systems. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. Your Rights

Depending on where you live, you may have some or all of the following rights. To exercise them, contact us at contact@sanxsolutions.com; we will respond as required by applicable law and may need to verify your identity.

• EU/UK (GDPR): access, rectification, erasure, restriction, portability, objection, the right to withdraw consent, and the right to lodge a complaint with your data protection authority.
• Brazil (LGPD): confirmation of processing, access, correction, anonymization or deletion, portability, information about sharing, and the right to revoke consent. You may also contact the Brazilian National Data Protection Authority (ANPD).
• California (CCPA/CPRA):the right to know, delete, and correct personal information, to opt out of “sale” or “sharing” (we do not sell or share personal information for cross-context behavioral advertising), and to non-discrimination for exercising your rights.
• Mexico (LFPDPPP): ARCO rights — Access, Rectification, Cancellation, and Opposition — and the right to revoke consent and limit the use or disclosure of your data.

Some work data is controlled by your employer; if we process it on their behalf, we may direct your request to them or assist them in responding.

9. Children’s Privacy

The Service is a workplace tool intended for users who are 18 years or older. It is not directed to children, and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

10. Cookies

We use only strictly necessary cookies: an authentication/session cookie to keep you signed in, and a cookie that remembers your selected project. We do not use advertising, analytics-profiling, or cross-site-tracking cookies. Blocking essential cookies will prevent the Service from functioning.

11. Changes to This Policy

We may update this Policy from time to time. We will revise the “Last updated” date above and, for material changes, provide a more prominent notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

12. Contact Us

For privacy questions or to exercise your rights, contact SanX Solutions at contact@sanxsolutions.com, 114 W Rhapsody Dr, San Antonio, TX 78216, USA.