Privacy Policy

Auto128 is operated by TOPFED WEB S.R.L., a limited liability company registered in the Republic of Moldova under IDNO 1026023125543, with its registered office in Chișinău (“we”, “us”). Our company details are at the end of this page, and you can reach us at [email protected].

We are the data controller for the accounts of the businesses and team members who use Auto128, for the messages you send us and for visitors of our website. For the data a workshop keeps about its own customers, the workshop is the controller and we process that data on its behalf, as explained in “Your customers' data” below.

Account data: the name and email address you sign up with, and the identifier that Google Firebase Authentication gives your login. Your password is handled only by Firebase Authentication and never reaches our servers. For team members invited by a workshop: name, email address, role, experience and an optional photo.

Workshop profile: the business name and public link, address, city, phone, email, description, logo, cover image, work gallery photos, services and prices, opening hours, language, currency and time zone.

Customer and vehicle records, entered by the workshop or by its customers when they book: customers' names, phone numbers and email addresses, an optional address (for mobile service or car pick-up), an optional birth date, notes and photos, and their vehicles: make, model, year, plate number, VIN, fuel and mileage.

Bookings and activity: appointments with their services, date, price, status and notes, the photo of the issue a customer may add to a booking, reviews and replies, waitlist entries, automations and marketing campaigns, and whether a customer has unsubscribed from marketing emails.

Plan and payments: your plan and its status. For a plan bought in the iOS app, the App Store transaction details (product and transaction identifier); for a plan bought on the website, the customer and subscription references at Stripe. We never receive your card details.

Where you came from: if you create an account after visiting our website, the campaign of that visit (for example utm parameters), the referring website and the landing page, saved once with the new account.

Messages: what you send us by email or through the contact form on our website (name, email address, subject, team size and message).

Technical data: when you use the website, the dashboard or the app, our servers and Cloudflare process your IP address and basic request details, such as the browser or app making the request, to deliver the Service and protect it against abuse. When an account is created, the internal notice we receive also states the browser or device it was created from.

We do not show advertising, we do not use your data or your customers' data for advertising, and we do not sell or rent personal data.

We do not track you across other companies' apps or websites, and we use no advertising identifiers and no advertising cookies.

The mobile app contains no analytics and no crash reporting. At the moment the website and the dashboard run no analytics either. If that changes, we will update this policy first.

The app connects only to our servers (app.auto128.com), to Firebase Authentication for sign-in, to our photo storage (media.auto128.com), to Expo's update service and, on iOS, to the App Store for purchases.

Photos: when you add a logo, a cover image, gallery photos or another picture, the app opens your device's photo picker and uploads only the photos you choose. The app does not use the camera or the microphone.

The app does not ask for your location, contacts or calendar, and it sends no push notifications: alerts about bookings reach you by email.

Updates: when it starts, the app asks Expo's update service whether a newer version is available. The request carries a random identifier created for that installation, the app version and the platform. This identifier is not linked to your account.

Plans can be bought in the app only on iOS, through Apple's In-App Purchase. On Android the app sells nothing.

auto128.com sets one cookie, which remembers the language you are reading. It uses no advertising cookies and, at the moment, no analytics.

If you arrive through a link with campaign parameters or from another website, the site keeps that information (campaign, referring website, landing page) in your browser for 90 days and adds it to the sign-up link, so that a new account records where it came from. The details are in our Cookie Policy.

The public page of a workshop (auto128.com/name-of-the-workshop) sends what you enter in its booking form to that workshop, through our servers.

To provide the Service you signed up for (performance of a contract): your account and sign-in, the calendar, bookings, customer and vehicle records, the public booking page, reviews, the waitlist, automations, emails and your plan.

To send service emails (contract and legitimate interest): booking confirmations and reminders, team invitations, password resets, the notifications you choose in your settings, a welcome email when you sign up and, after you delete your account, one short email asking what was missing.

To keep the Service secure and working (legitimate interest): limits on repeated attempts, protection against abuse, backups and troubleshooting.

To understand which campaigns bring new accounts (legitimate interest): the source saved with a new account and the internal notices we receive when an account is created or deleted.

To answer your messages and requests (legitimate interest, or the contract if you use the Service).

To meet our legal obligations (legal obligation): for example accounting and tax records of payments, or a lawful request from a public authority.

Where the GDPR applies, these are the legal bases of its Article 6(1)(b), (c) and (f). We do not rely on consent for any of the processing described here; if we ever ask for it, you will be able to withdraw it at any time.

A workshop that uses Auto128 decides what it records about its customers and their vehicles, and why. For that data the workshop is the controller and we are its processor: we process it only to provide the Service to that workshop, on its instructions, and never for our own purposes.

We do not contact a workshop's customers on our own behalf. The emails they receive (booking confirmations and reminders, review requests, waitlist offers, marketing campaigns) are sent by the Service for the workshop. Every marketing email carries an unsubscribe link; booking reminders still arrive, because they are part of the service the customer asked for.

Reviews a customer leaves appear on the workshop's public page with the name the customer gave.

The workshop is responsible for having a lawful basis for its customers' data and for informing them. A customer who wants to see, correct or delete their data should contact the workshop; if that is not possible, write to us and we will help.

We share personal data only with the providers that run parts of the Service for us, under their data processing terms, and only as far as each one needs:

Hetzner Online GmbH (Germany): the servers in Germany that run the website, the dashboard, the API and the database.

Cloudflare, Inc.: the network that delivers auto128.com and app.auto128.com and protects them against attacks, and Cloudflare R2, which stores the photos and our encrypted backups.

Google (Google Ireland Limited and Google LLC): Firebase Authentication for sign-in, and Google Workspace for our mailbox, [email protected].

Brevo (Sendinblue SAS, France): sends the emails of the Service and of our contact form.

Expo (650 Industries, Inc., United States): delivers updates of the mobile app.

Stripe: processes the payment of plans bought on the website.

Apple and Google distribute the app through the App Store and Google Play, under their own privacy policies. On iOS, Apple also processes the payment of plans bought in the app.

We may also disclose data when the law requires it, for example on a valid order from a court or a public authority, or to protect the rights and safety of our users or of Auto128. If Auto128 is ever sold or merged, your data would pass to the new operator under this policy, and we would inform you.

The servers and the database of the Service are in Germany, in the European Union. TOPFED WEB S.R.L. itself is established in the Republic of Moldova.

Some of the providers above are based in the United States or may process data outside the European Economic Area, such as Cloudflare, Google, Expo, Stripe and Apple. For these transfers we rely on the safeguards in their data processing terms, such as the Standard Contractual Clauses of the European Commission, or on the EU-U.S. Data Privacy Framework where the provider is certified under it.

Account, workshop, customer, vehicle and booking data: for as long as the account exists. When the account is deleted, this data is removed from our database immediately and the photos are removed from our storage.

Backups: our database backups are encrypted and kept as a rotating set of the last 7 daily copies, so deleted data disappears from them within about a week.

Record of emails sent: the recipient's address, the type of email and the date (not its content), for up to 90 days.

Messages you send us, and the internal notices of new and deleted accounts: in our mailbox, for as long as we need them to answer you and to handle any follow-up. You can ask us to delete them.

Payment records: for as long as tax and accounting law requires.

Technical logs: for a limited time, for security and troubleshooting. Web server access logs are deleted after 14 days.

The source of a visit that our website keeps in your browser expires after 90 days.

All connections to our website, dashboard, app server and photo storage are encrypted (HTTPS). Passwords are handled by Firebase Authentication and never reach our servers, and our backups are encrypted.

No system is completely secure. If a breach affects your rights, we will inform you and the competent authorities as the law requires.

You can ask us for access to your personal data, to correct or delete it, to restrict or object to its processing, and for a copy in a structured, machine-readable format. You can correct most of your data yourself in the dashboard or the app.

To exercise a right, write to [email protected] from the email address of your account, or tell us how we can confirm that the account is yours. We answer within one month.

You can also complain to the data protection authority of the country where you live or work, or, in the Republic of Moldova, to the National Center for Personal Data Protection.

The owner of a workshop can delete it in the app (“More” → “Profile” → “Delete account”, at the bottom) or on the web (app.auto128.com → “Profile & Settings” → “Profile” → “Delete my account”). This deletes the whole workshop: its public page, customers and vehicles, bookings, reviews, photos and the accounts of the whole team.

A technician can delete their own account in the app (“More” → “Delete account”). Their bookings stay with the workshop and pass to the owner.

You can also write to [email protected] and we will delete the account for you within 30 days. Deleting the app from your phone does not delete the account, and deleting the account does not cancel a subscription paid through the App Store: cancel it in your iPhone settings.

The steps, and what is deleted and what is kept, are on the page Delete your account.

Auto128 is a professional tool for businesses: you must be at least 18 years old to create an account. It is not directed at children and we do not knowingly collect their personal data. If you believe a child has given us personal data, write to us and we will delete it.

We may update this policy when the Service, our providers or the law change. The date at the top of this page shows the current version and, where appropriate, we will tell account holders about significant changes by email or in the dashboard.

For any question about this policy or about your data, write to [email protected]. Our company details are below.