_Last updated: September 13, 2026_
DetailingManager ("we", "the platform") is a web-based SaaS platform for managing auto detailing studios. We process personal data solely for the purpose of providing our services, in compliance with Regulation (EU) 2016/679 (GDPR) and applicable data protection laws.
1. Data Controller
The controller of the DetailingManager platform is:
- Name: Radoslav Moshev
- Address: Sofia, ul. Pirin, Bulgaria
- Email: admin@detailingmanager.com
For questions about your personal data, write to the same address with the subject "GDPR / Data Protection".
When a detailing studio stores its own customers in the platform, the studio is the controller of that customer data and we act as a processor. That relationship is described in our Data Processing Agreement.
2. What Data We Collect
2.1 Account Data
When you create an account via an invitation from your company, we collect:
- First and last name
- Email address
- Role within the company (administrator, manager, or employee)
- Hashed password (we do not store passwords in readable form)
2.2 Company Data
When a company registers on the platform, we store:
- Company name
- Logo (optional)
- URL slug
- VAT settings (if applicable)
- Custom text for PDF documents
- VIN sharing and other feature flags
2.3 Client Data (entered by companies)
Companies using the platform enter data about their clients:
- Client's first and last name
- Phone number
- Email address
- Address and city (optional)
- Date of birth (optional β for reminders and greetings)
- Marketing consent (explicit opt-in)
- Firm memberships (M:N links, including primary firm and discounts)
- Vehicle information (make, model, year, plate number, VIN)
This data belongs to the respective company. We act as a data processor on behalf of the company (the data controller). See the DPA.
2.4 Task, Reminder, and Document Data
The platform stores information about performed services:
- Type of service, price, and payment method
- Task date/time and assigned employee
- Before/after photos (optional), checklist items, and notes
- Reminders (automatic or manual) and related email sends
- Generated PDF documents (offers / work orders)
2.5 Demo and Contact Requests
When you submit a demo form on the public website, we collect:
- Name, email, company name, country, and message
- Confirmation of consent to data processing
- UTM / traffic source (only if you granted marketing consent)
2.6 Automatically Collected Data
When using the platform, we may automatically log:
- IP address (for security purposes and rate limiting)
- Browser and device information
- Access time and session duration
- Cookies and local storage (see Section 9)
- Anonymous page-view events (only with analytics consent)
3. How We Use Data
| Purpose | Legal Basis |
|---|---|
| Account creation and management | Contract performance |
| Providing platform services | Contract performance |
| Technical support and troubleshooting | Legitimate interest |
| Platform improvement (anonymous analytics) | Consent |
| Fraud and abuse prevention | Legitimate interest |
| Sending marketing communications to studio clients | Consent (explicit opt-in) |
| Marketing pixels and campaign attribution | Consent |
| Processing demo requests | Consent / pre-contractual steps |
| AI assistant (optional) | Consent (studio admin opt-in) |
4. Data Sharing with Third Parties
We use the following providers to operate the platform. Customer data stays in the EU except where stated below.
4.1 Supabase (database, authentication, file storage)
PostgreSQL database, user authentication, and file storage (logos, task photos). Hosted in the EU: Ireland (AWS eu-west-1). SOC 2 certified and GDPR compliant.
4.2 Hetzner / Coolify (application hosting)
The application runs on dedicated infrastructure at Hetzner in Nuremberg, Germany, managed via Coolify. Database backups are stored on the same Hetzner server in Nuremberg, kept for up to 7 days, then overwritten (see Section 6). Hetzner is ISO 27001 certified and GDPR compliant.
4.3 Resend (email delivery)
Transactional and marketing emails (campaigns, reminders, demo notifications) are sent via Resend from the Ireland (eu-west-1) region. Only the data required to deliver the email is shared.
4.4 Upstash Redis (rate limiting)
Used in production to limit abusive traffic. Stores short-lived request counters and IP addresses in Belgium (GCP europe-west1). Not used for customer records.
4.5 VIN decode (db.vin and NHTSA)
When a user looks up a VIN, the 17-character VIN may be sent to:
- db.vin β primary decoder
- NHTSA vPIC (United States) β fallback decoder; the VIN only, no name, phone, or email
4.6 OpenAI (AI assistant)
The in-app AI assistant is off by default. Once a studio admin enables it and confirms the notice, the questions studio staff type β and the records needed to answer them, which can include client names, vehicles, jobs, reminders, and amounts β are sent to OpenAI Ireland Limited. OpenAI processes EEA data under its Data Processing Addendum and transfers it outside the EEA only under Standard Contractual Clauses. API inputs and outputs are not used to train OpenAI's models; OpenAI keeps abuse-monitoring logs that may contain them for up to 30 days. Chat history stays in our database for up to 14 days and is then purged automatically.
4.7 Analytics and marketing (optional)
- First-party: anonymous page-view logs in our database when you grant analytics consent
- Google Analytics 4 and Meta Pixel: loaded and fired only with marketing consent (may involve transfers outside the EU)
4.8 We do NOT sell, rent, or share personal data with third parties for marketing purposes beyond what is described above.
5. VIN Sharing Between Studios
The platform offers a VIN-based vehicle history sharing feature:
- Default: your clients' VIN data is visible only to your company
- Sharing enabled: other studios can see what services were performed on a vehicle and your studio name
- Sharing disabled: performed services are anonymous (services visible, performer hidden)
- Each company admin controls this setting via Settings β VIN Search Sharing
6. Data Retention Periods
Two records are deleted automatically: the company audit log (7, 14, or 30 days, chosen by the studio) and the AI assistant chat history (up to 14 days). We do not automatically delete other records.
| Data Type | Retention Period |
|---|---|
| Account data | While the account is active, or until deletion is requested |
| Company data | While the company uses the platform, or until deletion is requested |
| Client and vehicle data | While the company stores them, or until the company deletes them |
| Task, reminder, and document data | While the company stores them, or until the company deletes them |
| Demo requests | Until you ask us to delete them |
| Analytics page-view logs | Until you withdraw consent or ask us to delete them |
| Audit log | 7, 14, or 30 days (studio setting; default 7; purged automatically) |
| AI assistant chat history | Up to 14 days, then purged automatically |
| Cookies / local storage | See Section 9 |
6.1 Deleting a studio client
When a studio admin deletes a client, we wipe that person's name, phone, email, and similar contact data. The vehicle record and completed jobs stay for service history and statistics, without the person's name, phone, or email. VIN and licence plate stay on the vehicle. Unfinished jobs (open / in progress) are removed so they are not inherited by a later owner. A short copy of the deleted contact data may remain in the studio audit log until that log expires (see above).
6.2 Closing an account or company
After we confirm a deletion request, live database rows and files in storage are removed immediately. Database backups on the same Hetzner server in Nuremberg are kept for up to 7 days and then overwritten. If a backup is restored during that window, the deletion is applied again.
7. Your Rights (GDPR)
Under GDPR, you have the following rights regarding your personal data:
| Right | Description |
|---|---|
| Access (Art. 15) | Obtain a copy of your personal data |
| Rectification (Art. 16) | Request correction of inaccurate data |
| Erasure (Art. 17) | Request deletion of your data ("right to be forgotten") |
| Restriction (Art. 18) | Request restriction of processing |
| Portability (Art. 20) | Receive your data in a machine-readable format |
| Objection (Art. 21) | Object to the processing of your data |
| Withdraw consent (Art. 7) | Withdraw your consent at any time |
To exercise your rights, contact us at admin@detailingmanager.com. We will respond within 30 days.
If you are a customer of a detailing studio (not a platform user), please contact that studio first β they are the controller of your record. We will help the studio fulfil the request under the DPA. Studios can export their client list as CSV from the platform.
You have the right to lodge a complaint with the Commission for Personal Data Protection (www.cpdp.bg) or your national data protection authority.
Cookie preferences can be changed at any time via the "Cookie Settings" control in the platform.
8. Data Security
We implement appropriate technical and organizational measures:
- Encryption: all data in transit (TLS 1.3) and at rest (AES-256)
- Row-Level Security (RLS): each user sees only their company's data
- Two-factor authentication: available via Supabase Auth
- Session security: automatic logout on inactivity (if configured by the company admin)
- Least privilege: employees see only information necessary for their work
9. Cookies and Local Storage
Consent is opt-in. Optional categories default to off. "Reject all" is presented with equal prominence to "Accept all".
9.1 Strictly Necessary (cannot be disabled)
| Name | Purpose | Duration |
|---|---|---|
| sb-access-token | Session authentication | 1 hour |
| sb-refresh-token | Session refresh | 30 days |
| cookie-consent | Records your cookie preferences | 1 year |
| locale | Stores language preference | 1 year |
| session-activity | Tracks inactivity for automatic logout | Per company settings |
| sidebar-state | Stores sidebar menu state | 1 year |
These cookies are set regardless of consent because the platform cannot function without them.
9.2 Analytics (optional)
| Name | Purpose | Duration |
|---|---|---|
| analytics_session_id | Anonymous session identifier (localStorage) for page-view analytics | Until cleared / consent withdrawn |
Activated only after analytics consent. The identifier is deleted when consent is withdrawn.
9.3 Marketing (optional)
| Name | Purpose | Duration |
|---|---|---|
| dm_utm_params | First-touch UTM parameters (sessionStorage) for attribution | Session |
With marketing consent, Google Analytics 4 and Meta Pixel may also load and set their own cookies under those providers' policies. Without consent, those scripts do not run.
10. Policy Changes
This policy may be updated periodically. Material changes will be communicated via:
- An in-platform banner on next login
- A request to reconfirm cookie preferences
The last updated date is displayed at the top of this page.
11. Contact
If you have questions about this Privacy Policy or our data processing:
- Email: admin@detailingmanager.com
- Subject: GDPR / Data Protection