Privacy Policy

1. Introduction

BayBoard LLC (“BayBoard,” “we,” “us,” or “our”) is a Colorado limited liability company that provides a business-to-business scheduling and operations platform for independent auto repair shops at bayboard.io and app.bayboard.io (the “Service”).

This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the choices you have. It applies to information we collect through the Service, our marketing website, and related communications.

This policy is written for two audiences: (1) the auto repair shop businesses that subscribe to BayBoard (our “Customers”), and (2) the individuals whose information appears in the Service, including Customer employees, independent contractors, and the end customers and vehicles those shops serve.

In most cases, BayBoard processes shop operational data on behalf of our Customers as their service provider and processor. The shop decides what goes into its account and who can see it; BayBoard stores and processes that Customer Data only to provide, secure, support, and improve the Service. Where BayBoard decides the purposes of processing itself, such as for our marketing website and account administration, BayBoard is responsible for that data directly. Our Data Processing Addendum covers the service-provider / processor relationship in detail.

2. Information We Collect

2.1 Information You Provide Directly

• Account information: name, work email address, phone number, business name, role or title, and authentication credentials.
• Billing information: billing contact, billing address, and the last four digits and brand of the payment card. Full payment card numbers are submitted directly to our payment processor (Stripe) and are not stored on BayBoard systems.
• Communications: support requests, demo bookings, sales inquiries, access requests, and survey responses. Access requests and waitlist signups are delivered through our email platform, and our bot-protection service checks the visitor’s IP address when a public form is submitted.
• Shop operational data: schedules, repair orders, technician profiles including skill notes, technician hours and time off, bay assignments, job statuses, end-customer records (first and last name, and a phone number held in a role-restricted lookup that technician accounts cannot read), vehicle information (year, make, model, VIN, and license plate), and related notes that Customers and their authorized users enter into the Service. BayBoard does not collect end customers’ email or postal addresses.

2.2 Information Collected Automatically

• Usage and product analytics: page views, feature usage, click events, performance metrics, error reports, and similar telemetry. Our error monitoring is configured to exclude personal identifiers from what it collects.
• Device and connection data: IP address, browser type and version, operating system, device identifiers, language preference, referring URL, and timestamps.
• Cookies and similar technologies: first-party and third-party cookies, local storage, and similar identifiers used for authentication, security, analytics, and marketing.

For details on the cookies we use and how to manage them, see our Cookie Policy.

2.3 Information from Third Parties

• Payment processor: Stripe shares billing status, subscription state, and the limited card metadata described above.
• Analytics and marketing platforms: we may receive aggregated reporting from analytics, advertising, and email tools we use.
• Shop management system integrations: at a Customer’s direction, we may receive customer, vehicle, and repair order data from a Customer’s shop management system to populate the Service.

2.4 AI Feature Inputs and Outputs

Where the Service includes AI-assisted features (for example, scheduling suggestions or natural-language assistants), inputs submitted by users and the outputs generated by those features are processed by our cloud AI provider, Google, within the same cloud project that runs the Service. We do not permit our AI provider to use Customer data to train third-party models. AI inputs and outputs are stored within the Service for product functionality, debugging, and improvement of BayBoard’s own product.

3. How We Use Information

• Providing the Service: authenticating users, displaying schedules and shop data, running the auto-scheduler, enforcing role-based access, and performing related operational functions.
• Account administration and billing: creating and managing accounts, processing subscription payments, issuing invoices, applying credits, and handling cancellations.
• Customer support: responding to inquiries, troubleshooting, and improving support quality.
• Service improvement: monitoring performance and reliability, debugging, analyzing usage trends, and developing new features.
• Security and fraud prevention: detecting and preventing unauthorized access, abuse, and security incidents.
• Communications: sending transactional messages (such as account, billing, and security notices) and, where permitted, product updates and marketing communications.
• Legal and compliance: complying with applicable laws, responding to lawful requests, and enforcing our agreements.

Aggregated Data. We may use Aggregated Data (as defined in the Terms of Service) solely to internally improve the Service and to produce de-identified internal statistics. We do not publish industry reports from Aggregated Data, we do not name Customer, any Authorized User, any individual, or any specific shop in those statistics, and we do not sell Aggregated Data.

4. How We Share Information

We do not sell personal information. Our use of Aggregated Data solely to internally improve the Service and to produce de-identified internal statistics, described in Section 3 above and in the Terms of Service §5.3, is not a sale of personal information. We share information only as described below.

4.1 Service Providers and Subprocessors

We share information with third-party vendors that help us operate the Service. These vendors are contractually limited to using personal information only to provide services to us and are subject to confidentiality obligations and reasonable security requirements. The current list of vendors, what each one does, and where each one processes data is published on our Subprocessors page.

4.2 Within Our Customers’ Accounts

Information entered into the Service by a Customer is visible to other authorized users within that Customer’s shop, based on the role assigned to them by the Customer (such as Owner/GM, Service Advisor, Foreman, or Technician).

4.3 Business Transactions

If BayBoard is involved in a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, personal information may be transferred or disclosed as part of that transaction. We will require successors to honor commitments made in this Privacy Policy or provide notice and choice where required by law.

4.4 Legal Reasons

We may disclose information when we believe in good faith that disclosure is necessary to comply with applicable law, valid legal process, or a lawful government request; to enforce our agreements and policies; to protect the rights, property, or safety of BayBoard, our Customers, or others; or to investigate or prevent fraud or security incidents.

4.5 With Your Direction or Consent

We may share information at your direction or with your consent, including when you connect a third-party integration to your BayBoard account.

5. Cookies and Tracking Technologies

We and our service providers use cookies and similar technologies to authenticate users, remember preferences, secure the Service, measure performance, and support marketing. We do not set non-essential cookies until you make a choice in the consent banner, and you can change your preferences at any time. We do not use advertising cookies and we do not sell or share your personal information for advertising. For full details, see our Cookie Policy.

6. Data Retention

• Active accounts: we retain shop operational data and account information for the life of the Customer’s subscription.
• Cancelled accounts: when a subscription ends, we delete the Customer’s shop data 90 days after the end of the subscription, except where retention is required by law or for limited business records such as billing history, fraud prevention, or dispute resolution.
• Backups: residual copies may persist in routine backups for a limited period until those backups roll off in the ordinary course.
• Marketing and waitlist data: retained until you unsubscribe or request deletion, and for a reasonable period thereafter for record-keeping.
• Logs and analytics: typically retained for a shorter period sufficient for security, debugging, and product analytics.

7. Data Security

BayBoard maintains administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. Our practices include:

• Encryption in transit: TLS for connections to and from the Service.
• Encryption at rest: provided by our cloud database and storage providers.
• Access controls: role-based access within the Service and least-privilege access for BayBoard personnel.
• Tenant isolation: multi-tenant architecture with security rules that scope data access to the Customer’s own shop.
• Authentication: password and federated authentication, with support for stronger authentication methods over time.
• Monitoring: error monitoring and operational logging.
• Vendor diligence: we select vendors with mature security programs and contractually require appropriate safeguards.

No security program can guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for limiting access to authorized personnel. See our Security page for more detail.

8. Data Breach Notification

If BayBoard becomes aware of a Security Incident (as defined in the Data Processing Addendum) affecting a Customer’s personal information, we will notify the affected Customer without undue delay after BayBoard becomes aware, and in any event no later than 72 hours after BayBoard becomes aware. Unsuccessful attempts or activities that do not compromise the security of personal information — including unsuccessful log-in attempts, pings, port scans, denial-of-service attacks, and other network attacks on firewalls or networked systems — are not Security Incidents and do not trigger this notice. We will provide the information reasonably necessary for the Customer to meet its own notification obligations to its employees, end customers, or regulators. Our Security page and Data Processing Addendum state this commitment in full.

9. Where Data Is Stored

BayBoard is based in the United States, and the Service is hosted in the United States. If you access the Service from outside the United States, your information will be transferred to, processed, and stored in the United States and other countries where our service providers operate.

10. Children’s Privacy

The Service is intended for businesses and is not directed to children under 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16 without appropriate consent, we will delete that information. If you believe a child has provided us with personal information, please contact us at the address in Section 14.

11. Your Choices

You can ask us to access, correct, delete, or export the personal information we hold about you, and we will honor reasonable requests regardless of where you live, subject to legal exceptions such as records we must keep for billing or fraud prevention.

If you are an end user of a Customer’s account (for example, a technician or service advisor employed by a shop, or an end customer of a shop), please direct your request to that shop first. The shop controls its account data, and BayBoard will assist the shop in responding.

To make a request, contact us at the address in Section 14. We will not discriminate against you for making one.

Named statutes. For California residents, the rights above include the rights provided under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, “CCPA/CPRA”). For Colorado residents, the rights above include the rights provided under the Colorado Privacy Act (“CPA”). Where BayBoard is a service provider or processor with respect to Customer Data, we will assist the shop (the business / controller) in responding. Where BayBoard decides the purposes of processing itself — for example, our marketing website, waitlist, and account administration — you may submit your request directly to us at the address in Section 14.

Appeal. If we deny a request you validly submitted, you may appeal by emailing hello@bayboard.io and asking for a second look. We will review the denial and respond in writing. If we deny the appeal, Colorado residents may contact the Colorado Attorney General to submit a complaint.

12. Marketing and Communications

We may send marketing communications about BayBoard products, features, and events. You can opt out of marketing emails by clicking the unsubscribe link in any marketing message or by contacting us. Even if you opt out of marketing, we may still send you transactional and service-related communications.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of the policy and provide additional notice as required by law (for example, by email or in-app notification). Your continued use of the Service after the effective date of the updated policy constitutes acceptance of the updated terms.

14. Contact Us

If you have questions about this Privacy Policy or want to exercise your choices, contact us at:

BayBoard LLC
Jessen Perko
3773 E Cherry Creek North Dr
Denver, CO 80209
303-398-7088
Email: hello@bayboard.io
Website: bayboard.io

Operational questions and rights requests may go to hello@bayboard.io. Formal legal and privacy mail may be sent to the Jessen mailing address above.

15. Governing Law

This Privacy Policy is governed by the laws of the State of Colorado, without regard to its conflict of laws principles. Subject to the dispute-resolution provisions of the Terms of Service — which, for disputes arising out of or relating to the Terms or the Service, provide for informal discussion and then binding commercial arbitration, with the state and federal courts located in Denver County, Colorado reserved for the court matters listed in the Terms — any dispute arising solely out of or relating to this Privacy Policy will be resolved in the state and federal courts located in Denver County, Colorado, except where prohibited by applicable law.