Privacy Policy

1. Introduction

BayBoard LLC (“BayBoard,” “we,” “us,” or “our”) is a Colorado limited liability company that provides a business-to-business scheduling and operations platform for auto repair shops at bayboard.io and app.bayboard.io (the “Service”).

This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the choices you have. It applies to information we collect through the Service, our marketing website, and related communications.

This policy is written for two audiences: (1) the auto repair shop businesses that subscribe to BayBoard (our “Customers”), and (2) the individuals whose information appears in the Service, including Customer employees, independent contractors, and the end customers and vehicles those shops serve.

In most cases, BayBoard processes shop operational data on behalf of our Customers as their service provider and processor. The shop decides what goes into its account and who can see it; BayBoard stores and processes that Customer Data only to provide, secure, support, and improve the Service. Where BayBoard decides the purposes of processing itself, such as for our marketing website and account administration, BayBoard is responsible for that data directly. Our Data Processing Addendum covers the service-provider / processor relationship in detail.

2. Information We Collect

2.1 Information You Provide Directly

• Account information: name, work email address, phone number, business name, role or title, and authentication credentials.
• Billing information: billing contact, billing address, and the last four digits and brand of the payment card. Full payment card numbers are submitted directly to our payment processor (Stripe) and are not stored on BayBoard systems.
• Communications: support requests, demo bookings, sales inquiries, access requests, and survey responses. Access requests and Contact Support messages submitted through the BayBoard application are delivered through our email platform (Resend). Where the application shows a public form, our bot-protection service (Cloudflare Turnstile) may check the visitor’s IP address when that form is submitted. The marketing site at bayboard.io does not collect access-request details.
• Shop operational data: schedules, repair orders, technician profiles including skill notes, technician hours and time off, job assignments, job statuses, end-customer records (first and last name, and a phone number held in a role-restricted lookup that technician accounts cannot read), vehicle information (year, make, model, VIN, and license plate), and related notes that Customers and their authorized users enter into the Service. BayBoard does not collect end customers’ email or postal addresses.

2.2 Information Collected Automatically

• Usage and product analytics: page views, feature usage, click events, performance metrics, error reports, and similar telemetry. Our error monitoring is configured to exclude personal identifiers from what it collects.
• Device and connection data: IP address, browser type and version, operating system, device identifiers, language preference, referring URL, and timestamps.
• Cookies and similar technologies: first-party and third-party cookies, local storage, and similar identifiers used for authentication, security, analytics, and marketing.

For details on the cookies we use and how to manage them, see our Cookie Policy.

2.3 Information from Third Parties

• Payment processor: Stripe shares billing status, subscription state, and the limited card metadata described above.
• Analytics and marketing platforms: we may receive aggregated reporting from analytics, advertising, and email tools we use.
• Shop management systems: BayBoard does not currently import repair orders or customer records from a shop management system. Jobs are entered by hand. If a Customer uses a shop management system alongside BayBoard, that system remains the system of record for its own data. BayBoard does not replace it.

2.4 Ask BayBoard

Ask BayBoard is a documentation-only help assistant. It answers questions about how to use BayBoard from BayBoard documentation only. It must not use shop operational data. It cannot see jobs, customers, vehicles, technicians, schedules, settings, or billing.

Do not submit sensitive, confidential, personal, payment, credential, customer, or shop operational information to Ask BayBoard. Ask BayBoard does not accept file, image, or video uploads. Answers can be wrong. Check the cited documentation or contact support before you rely on an answer.

Authenticated Ask BayBoard requests are sent through Vercel AI Gateway to a selected upstream model provider. The selected provider and model can change. This policy stays provider-neutral for that reason.

Provider handling and BayBoard retention are different. For supported models, BayBoard requests zero data retention and no prompt training from the gateway and the selected provider. Separately, BayBoard intentionally retains Ask BayBoard records for 90 days, as described in Section 6.

3. How We Use Information

• Providing the Service: authenticating users, displaying schedules and shop data, running the auto-scheduler, enforcing role-based access, and performing related operational functions.
• Account administration and billing: creating and managing accounts, processing subscription payments, issuing invoices, applying credits, and handling cancellations.
• Customer support: responding to inquiries, troubleshooting, and improving support quality.
• Service improvement: monitoring performance and reliability, debugging, analyzing usage trends, and developing new features.
• Security and fraud prevention: detecting and preventing unauthorized access, abuse, and security incidents.
• Communications: sending transactional messages (such as account, billing, and security notices) and, where permitted, product updates and marketing communications.
• Legal and compliance: complying with applicable laws, responding to lawful requests, and enforcing our agreements.

Aggregated Data. We may use Aggregated Data (as defined in the Terms of Service) solely to internally improve the Service and to produce de-identified internal statistics. We do not publish industry reports from Aggregated Data, we do not name Customer, any Authorized User, any individual, or any specific shop in those statistics, and we do not sell Aggregated Data.

4. How We Share Information

We do not sell personal information. Our use of Aggregated Data solely to internally improve the Service and to produce de-identified internal statistics, described in Section 3 above and in the Terms of Service §5.3, is not a sale of personal information. We share information only as described below.

4.1 Service Providers and Subprocessors

We share information with third-party vendors that help us operate the Service. These vendors are contractually limited to using personal information only to provide services to us and are subject to confidentiality obligations and reasonable security requirements. The current list of vendors, what each one does, and where each one processes data is published on our Subprocessors page.

4.2 Within Our Customers’ Accounts

Information entered into the Service by a Customer is visible to other authorized users within that Customer’s shop, based on the role assigned to them by the Customer (such as Owner, GM, Service Advisor, Foreman, or Technician).

4.3 Business Transactions

If BayBoard is involved in a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, personal information may be transferred or disclosed as part of that transaction. We will require successors to honor commitments made in this Privacy Policy or provide notice and choice where required by law.

4.4 Legal Reasons

We may disclose information when we believe in good faith that disclosure is necessary to comply with applicable law, valid legal process, or a lawful government request; to enforce our agreements and policies; to protect the rights, property, or safety of BayBoard, our Customers, or others; or to investigate or prevent fraud or security incidents.

4.5 With Your Direction or Consent

We may share information at your direction or with your consent.

5. Cookies and Tracking Technologies

We and our service providers use cookies and similar technologies to authenticate users, remember preferences, secure the Service, measure performance, and support marketing. We do not set non-essential cookies until you make a choice in the consent banner, and you can change your preferences at any time. We do not use advertising cookies and we do not sell or share your personal information for advertising. For full details, see our Cookie Policy.

6. Data Retention

• Active accounts: we retain shop operational data and account information for the life of the Customer’s subscription.
• Cancelled accounts: when a subscription ends, we delete the Customer’s shop data 90 days after the end of the subscription, except where retention is required by law or for limited business records such as billing history, fraud prevention, or dispute resolution.
• Backups: residual copies may persist in routine backups for a limited period until those backups roll off in the ordinary course.
• Marketing and access-request data: retained until you unsubscribe or request deletion, and for a reasonable period thereafter for record-keeping.
• Logs and analytics: typically retained for a shorter period sufficient for security, debugging, and product analytics.
• Ask BayBoard records: for authenticated Ask BayBoard use, BayBoard retains the question, the answer, citations, response and outcome metadata, timing, model, policy, and source-version metadata, and the user’s Helpful or Not helpful rating for 90 days, except where retention is required by law. BayBoard uses those records to monitor quality, diagnose problems, improve Ask BayBoard and BayBoard, and understand documentation or feature needs. These records are not shown to normal app users, Owners, or GMs through an in-app history or admin screen. They are available only through restricted, authorized BayBoard operator and cloud access.

7. Data Security

BayBoard maintains administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. Our practices include:

• Encryption in transit: TLS for connections to and from the Service.
• Encryption at rest: provided by our cloud database and storage providers.
• Access controls: role-based access within the Service and least-privilege access for BayBoard personnel.
• Tenant isolation: multi-tenant architecture with security rules that scope data access to the Customer’s own shop.
• Authentication: password and federated authentication, with support for stronger authentication methods over time.
• Monitoring: error monitoring and operational logging.
• Vendor diligence: we select vendors with mature security programs and contractually require appropriate safeguards.

No security program can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for limiting access to authorized personnel. See our Security page for more detail.

8. Data Breach Notification

If BayBoard becomes aware of a Security Incident (as defined in the Data Processing Addendum) affecting a Customer’s personal information, we will notify the affected Customer without undue delay after BayBoard becomes aware, and in any event no later than 72 hours after BayBoard becomes aware. Unsuccessful attempts or activities that do not compromise the security of personal information — including unsuccessful log-in attempts, pings, port scans, denial-of-service attacks, and other network attacks on firewalls or networked systems — are not Security Incidents and do not trigger this notice. We will provide the information reasonably necessary for the Customer to meet its own notification obligations to its employees, end customers, or regulators. Our Security page and Data Processing Addendum state this commitment in full.

9. Where Data Is Stored

BayBoard is based in the United States, and the Service is hosted in the United States. If you access the Service from outside the United States, your information will be transferred to, processed, and stored in the United States and other countries where our service providers operate.

10. Children’s Privacy

The Service is intended for businesses and is not directed to children under 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16 without appropriate consent, we will delete that information. If you believe a child has provided us with personal information, please contact us at the address in Section 14.

11. Your Choices

You can ask us to access, correct, delete, or export the personal information we hold about you, and we will honor reasonable requests regardless of where you live, subject to legal exceptions such as records we must keep for billing or fraud prevention.

If you are an end user of a Customer’s account (for example, a technician or service advisor employed by a shop, or an end customer of a shop), please direct your request to that shop first. The shop controls its account data, and BayBoard will assist the shop in responding.

To make a request, contact us at the address in Section 14. We will not discriminate against you for making one.

Named statutes. For California residents, the rights above include the rights provided under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, “CCPA/CPRA”). For Colorado residents, the rights above include the rights provided under the Colorado Privacy Act (“CPA”). Where BayBoard is a service provider or processor with respect to Customer Data, we will assist the shop (the business / controller) in responding. Where BayBoard decides the purposes of processing itself — for example, our marketing website, access requests, and account administration — you may submit your request directly to us at the address in Section 14.

Appeal. If we deny a request you validly submitted, you may appeal by emailing hello@bayboard.io and asking for a second look. We will review the denial and respond in writing. If we deny the appeal, Colorado residents may contact the Colorado Attorney General to submit a complaint.

12. Marketing and Communications

We may send marketing communications about BayBoard products, features, and events. You can opt out of marketing emails by clicking the unsubscribe link in any marketing message or by contacting us. Even if you opt out of marketing, we may still send you transactional and service-related communications.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of the policy and provide additional notice as required by law (for example, by email or in-app notification). Your continued use of the Service after the effective date of the updated policy constitutes acceptance of the updated terms.

14. Contact Us

If you have questions about this Privacy Policy or want to exercise your choices, contact us at:

BayBoard LLC
Jessen Perko
3773 E Cherry Creek North Dr
Denver, CO 80209
303-398-7088
Email: hello@bayboard.io
Website: bayboard.io

Operational questions and rights requests may go to hello@bayboard.io. Formal legal and privacy mail may be sent to the Jessen mailing address above.

15. Governing Law

This Privacy Policy is governed by the laws of the State of Colorado, without regard to its conflict of laws principles. Subject to the dispute-resolution provisions of the Terms of Service — which, for disputes arising out of or relating to the Terms or the Service, provide for informal discussion and then binding commercial arbitration, with the state and federal courts located in Denver County, Colorado reserved for the court matters listed in the Terms — any dispute arising solely out of or relating to this Privacy Policy will be resolved in the state and federal courts located in Denver County, Colorado, except where prohibited by applicable law.