Privacy Policy

1. Introduction

Welcome to GarageHub, operated by Dabanny LTD (Дабани ООД), a company registered in Bulgaria (EIK: 205476845, VAT: BG205476845), with registered address at Nikola Petkov 7, 2100 Elin Pelin, Bulgaria, represented by Daniel Georgiev ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and related services.

By using GarageHub, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

We may collect the following types of information:

• Account Information: Email address, name, and authentication credentials when you create an account.
• Vehicle Data: Information about vehicles you add to your garage, including make, model, year, VIN, and maintenance records.
• Parts Inventory: Details of parts you track, including purchase history and usage.
• Usage Data: How you interact with the app, including features used and frequency of use.
• Device Information: Device type, operating system, and app version.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Process and manage your account
• Send you updates and notifications about your vehicles and maintenance schedules
• Respond to your comments, questions, and support requests
• Monitor and analyze trends, usage, and activities in connection with our services
• Detect, investigate, and prevent fraudulent transactions and other illegal activities

4. Data Storage and Security

Your data is stored on secure servers located in the European Union. We use industry-standard security measures to protect your personal information, including encryption in transit and at rest.

While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

5. Data Retention

We will retain your personal information for as long as your account is active or as needed to provide you services. You may request deletion of your account and associated data at any time.

6. Your Rights (GDPR)

If you are a resident of the European Economic Area (EEA), you have certain data protection rights:

• Right to Access: You have the right to request copies of your personal data.
• Right to Rectification: You can request that we correct any information you believe is inaccurate.
• Right to Erasure: You can request that we erase your personal data ("right to be forgotten").
• Right to Restrict Processing: You can request that we restrict the processing of your data.
• Right to Data Portability: You can request that we transfer your data to another organization.
• Right to Object: You can object to our processing of your personal data.

To exercise any of these rights, please contact us at.

7. Cookies and Tracking

We use cookies and similar tracking technologies to track the activity on our service and hold certain information. Cookies are files with small amounts of data which may include an anonymous unique identifier.

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our service.

8. Third-Party Services

We use a small number of third-party services as subprocessors. They receive only the data needed to perform their function and are bound by their own published privacy policies:

Subprocessors we currently use:

• Cloudflare (CDN, WAF, DDoS protection) — routes HTTPS traffic to our servers.
• Hetzner Online GmbH (hosting provider, Germany) — hosts our application and PostgreSQL database in the European Union.
• Sentry (error monitoring) — collects crash reports and performance traces; excludes request/response bodies.
• PostHog (product analytics) — anonymized usage events. You can opt out in Settings.
• Meta Pixel (ads attribution) — only loads on the public website, never inside the app.
• OpenRouter / Anthropic / Google AI (AI features) — when you use Rev (the in-app AI mechanic), ask the AI to research a repair, generate an inspection report, or connect an MCP client such as Claude Desktop, your prompts and the relevant vehicle/maintenance context are sent to one of these providers to compute the response. Your content is not used to train their models. See each provider's API privacy policy for details.
• Cloudflare R2 (object storage) — stores photos you upload.
• RevenueCat + Stripe (billing) — process subscription payments.

We are not responsible for the privacy practices of these subprocessors. We review them before onboarding and encourage you to review their privacy policies. A fuller subprocessor list is available on request at support@getgaragehub.com.

9. Children's Privacy

Our service is not intended for use by children under the age of 16. We do not knowingly collect personally identifiable information from children under 16.

10. Changes to This Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

We encourage you to review this Privacy Policy periodically for any changes.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us at:

Dabanny LTD (Дабани ООД)
Nikola Petkov 7, 2100 Elin Pelin, Bulgaria
EIK: 205476845 | VAT: BG205476845
Managing Director: Daniel Georgiev

Email:
Website:https://getgaragehub.com/

12. MCP Connections and Third-Party AI Clients

GarageHub publishes a Model Context Protocol (MCP) server at https://mcp.getgaragehub.com. When you authorize an external AI client (for example, Claude Desktop's Custom Connector feature), that client can read and — with your per-action approval — modify data in your garage within the scopes you granted (read or read + write).

Data flowing to the connected client is the same data you already see in the GarageHub app: your vehicles, maintenance logs, issues, parts, schedule, saved research, and profile. We never share other users' data, and the connection is scoped to your account via an OAuth 2.1 access token.

Once data leaves our server through the MCP endpoint, its handling is governed by the connected AI client's own privacy policy. We cannot guarantee how Anthropic, OpenAI, or any other third-party MCP client stores or uses the data it receives.

You can review every active connection and revoke any of them at any time fromSettings → Access & connections → Connected appsin the web app. Revocation takes effect immediately.