1. About this statement
Repairflow is software for repair shops. Shops use it to keep track of their repairs, customers, point of sale, invoices and calendar. This statement explains which personal data we process, why, for how long and which rights you have.
There are two roles:
- For the data of the shops themselves (the account, the employees, the invoicing of the subscription) we are the controller. Articles 2 to 6 inclusive and 8 to 10 inclusive deal with this.
- For the data that a shop puts into Repairflow about its own customers the shop is the controller and we are the processor. Article 7 deals with this, as does the data processing agreement that forms part of our terms and conditions.
Are you a customer of a repair shop that uses Repairflow? Then that shop is your point of contact for questions about your data. Article 7 explains what we do on behalf of the shop.
2. Which data we process about shops
Account data. When an account is created: the name of the shop, the name of the owner, email address, telephone number and password. After that, if the shop fills them in: address, website, logo, Chamber of Commerce (KvK) number, VAT number, IBAN and opening hours. These data appear on the receipts, invoices and emails that the shop sends from Repairflow.
Employees. Name, email address, telephone number, role and password of the employees the shop invites. The shop decides whom it invites and which rights someone receives.
Subscription and payment. Which subscription the shop has, its status and the invoice history. The payment itself runs through Stripe; we do not store card or account numbers.
Usage and security. An activity log per shop (who did what and when, with IP address and browser details), technical logs of the servers (time, path, status and duration), and records to counter abuse, such as the number of failed login attempts per address.
Contact. Emails you send to us and our reply to them.
Portal accounts. The email address and the login requests of a customer who logs in through the customer portal. Such an account is not tied to one shop and therefore falls under our own responsibility; what the customer sees in a shop’s portal falls under article 7.
3. For what purpose and on what basis
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the service: logging in, making the app work, sending receipts and emails on behalf of the shop | Account, employees | Performance of the contract |
| Invoicing and collecting the subscription | Subscription and payment | Performance of the contract, statutory retention obligation |
| Securing the service, tracing faults, countering abuse | Usage and security | Legitimate interest: a secure and working service |
| Answering questions and providing support | Contact | Performance of the contract, legitimate interest |
| Sending important messages about the service, such as a change to the terms or an outage | Account data | Performance of the contract |
We do not use the data of shops for advertising and we do not sell them on. We do not send newsletters unless you have asked for them.
4. How long we keep data
- Account and employees: for as long as the contract runs. After the end of the contract we delete the shop’s data no later than 60 days afterwards (for the first 30 days you can still request a copy), unless a law obliges us to keep something for longer.
- Invoices for the subscription: seven years, the tax retention obligation.
- Technical logs of the servers: 90 days.
- Activity log and security records: for as long as the account exists; they belong to the shop’s data and are included in the deletion above.
- Backups: we make a backup of the database every night. A backup is automatically deleted after 30 days. Data that have been deleted from the app may therefore remain in a backup for up to 30 days.
- Emails to support: for as long as needed to help you, up to a maximum of two years.
5. Who has access to data
Only those who need it for their work: the developers and administrators of Repairflow, and the service providers below. We share data with no one else, unless a law or a court obliges us to do so.
| Service provider | What | Where |
|---|---|---|
| Amazon Web Services (AWS) | Servers, file storage for photos and logos, backups, logs and sending email | Ireland (region eu-west-1) |
| MongoDB Atlas | The database | European Union |
| Stripe | Payment of the subscription | Ireland, with transfer to the United States under the EU-US Data Privacy Framework |
| OpenAI | The AI features: improving a text in a repair, the help chat in the app and the public help chatbot on the page where customers follow a repair. Only the text entered for that purpose; conversations are not stored. OpenAI does not use these data to train models and keeps them for a maximum of 30 days. | United States, under the European Commission’s standard contractual clauses |
In addition, a shop can connect its own services to Repairflow, such as a Mollie account for payment links or a wholesaler account for parts. The shop concludes those agreements itself; we only store the encrypted connection.
6. Your rights as a shop
You can ask us for access to your data, to correct, delete or transfer them, and to restrict a processing operation or to object to it. You can view and change most data yourself in the settings of the app. For the rest, email us; we respond within one month.
Do you disagree with how we handle your data? Let us know. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
7. Data of shops’ customers
A shop puts data about its customers into Repairflow: name, address, telephone number, email address, sometimes a date of birth or business details, the device with serial number or IMEI and any access code, photos of the device, signatures, repair history, receipts, invoices, payments and appointments. If the shop switches on the customer portal, a customer can log in there and see their own repairs, documents and data.
For all these data:
- The shop decides which data it records, how long it keeps them and who gets to see them. The shop is the controller.
- We only process them on behalf of the shop in order to provide the service: storing them, showing them in the app, sending the emails the shop sets up, backups and security. We do not look at these data, except when a shop asks us to in a support request, and we never use them for our own purposes.
- The arrangements on this are set out in the data processing agreement, which forms part of our terms and conditions. It also lists the service providers from article 5, the security measures and what happens in the event of a personal data breach.
- Do you, as a customer of a shop, wish to access your data, or have them corrected or deleted? Contact the shop. If a request reaches us directly, we forward it to the shop.
8. Security
Connections to Repairflow are encrypted (TLS). We store passwords only in hashed form. We store connections with other services encrypted. We make a backup every night, monitor the service with alarms and keep logs to detect abuse. Access to production data is limited to those who need it.
Should a breach nevertheless occur, we will inform the shops concerned without undue delay and help them with any notification to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
9. Cookies and local storage
This website uses no cookies and no analytics software. If you close the “Try for free” bar on your phone, your browser only remembers that (in local storage) so it does not come back; that never leaves your device.
The app and the customer portal use only what is needed to work: a login token, your language and theme choice, a few display preferences and a temporary copy of the receipt you are making at the point of sale. These are stored in the user’s browser. The app loads fonts and icons from Google Fonts, cdnjs, jsDelivr and Font Awesome; those services see the user’s IP address in the process, nothing else. There are no tracking cookies, no advertising cookies and no third-party statistics. A cookie banner is therefore not needed.
10. Changes
If we change this statement, we will put the new version on this page with a new effective date. In the case of a change that matters to shops, we will send an email to the account address in advance.