Privacy Policy

1. Introduction

Allen Wrench is a customer relationship management (CRM) platform built for auto repair shops, operated by Allen Wrench LLC. We help shops send Google review requests after service, follow up on declined work to recover revenue, and send maintenance reminders to bring customers back. This Privacy Policy describes how we collect, use, store, and share information when you use our platform.

In this policy, "we," "our," and "us" refer to Allen Wrench LLC, which operates the Allen Wrench platform. "You" refers to any shop owner, operator, or authorized user of the Allen Wrench platform. "End customers" refers to the customers of your auto repair shop whose information you manage through our platform.

For end customer information, your shop is the data controller and Allen Wrench acts as a service provider that processes that information on your behalf, solely to provide the platform and only as described in this policy and your instructions. You are responsible for having a legal basis and any required consent to collect and message your end customers.

2. Information We Collect

We collect the following categories of information:

Shop Owner Account Information

• Name and email address (collected when we create your account)
• Shop name, phone number, and business details
• QuickBooks Online connection tokens (for syncing customer and invoice data)

Google Business Profile Data (When You Connect Google)

• Business account and location identifiers, shop name, and address used to select a profile you are authorized to manage
• Review identifiers, ratings, text, timestamps, reviewer names and profile photo links, existing owner replies and their status, and Google's review count and average rating
• Google authorization tokens, stored encrypted, that allow us to refresh reviews while your shop is connected; we do not receive your Google password
• Review read status and records of reply submissions, including the submitting Allen Wrench user

End Customer Data (Synced from QuickBooks)

• Customer names
• Phone numbers and email addresses
• Vehicle information (year, make, model, VIN, mileage), parsed from QuickBooks customer notes
• Service records and invoice data, including line items and amounts
• Declined service records from QuickBooks estimates marked as rejected or closed

SMS Message Data

• Message content, timestamps, and delivery status
• Workflow type (review request, declined service follow-up, maintenance reminder)
• Message direction (inbound or outbound) and approval status

Payment and Billing Information

• Subscription and billing details are processed by Stripe. We do not store full credit card numbers on our servers.

Automatically Collected Information

• IP address and browser type
• Device information and operating system
• Usage data (pages visited, features used, timestamps)

3. How We Use Your Information

We use the information we collect to:

• Sync customer records, invoices, and estimates from your QuickBooks account
• Send SMS messages on your shop's behalf, including Google review requests, declined service follow-ups, and service reminders
• Display and refresh reviews for your connected Google Business Profile, and send public owner replies or edits to Google when an authorized shop user explicitly submits them
• Process your subscription payments
• Provide customer management features (customer profiles, vehicle tracking, service history)
• Generate message templates personalized with customer and vehicle information
• Debug issues and provide technical support
• Improve our platform and develop new features
• Comply with legal obligations

We use Google Business Profile data to provide the connected review features and operate them securely. We do not sell that data or use it to train AI models. Replies submitted through Allen Wrench are sent to Google for publication on your business profile and are subject to Google's policies and review process.

To operate this connection, we send authorization tokens and business/review identifiers to Google with API requests, along with any reply text you explicitly submit. Google handles data on its services under its Privacy Policy.

4. Third-Party Services

We share data with the following third-party service providers to operate Allen Wrench. We do not sell your personal information.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with, sold to, or purchased by any third party. The service providers listed below act only as subcontractors supporting the delivery of the services described in this policy (for example, transmitting the text messages you consented to receive).

5. SMS and TCPA Compliance

Allen Wrench sends text messages to your end customers on your shop's behalf. As the shop owner using our platform, you are responsible for complying with the Telephone Consumer Protection Act (TCPA) and all applicable messaging regulations.

Types of Messages and Consent Requirements

• Google review requests: These are marketing messages and require prior express written consent (PEWC) from the customer before sending.
• Declined service follow-ups: These are marketing messages and require prior express written consent (PEWC) from the customer before sending.
• Maintenance reminders: These are informational messages and require prior express consent (PEC) from the customer.

Opt-Out

End customers can opt out of receiving text messages at any time by replying STOP to any message. We honor all opt-out requests immediately and maintain opt-out records. Once a customer opts out, no further messages will be sent to that number unless the customer re-consents.

Message Logging

We log all SMS messages, including content, timestamps, delivery status, and opt-out requests, for compliance and audit purposes.

6. Data Retention

We retain your data for as long as your account is active and as needed to provide our services. When you delete your account:

• Your shop profile, customer records, vehicle data, service records, and message history are permanently deleted within 30 days.
• QuickBooks connection tokens are revoked and deleted immediately.
• Anonymized transaction records may be retained for up to 7 years for tax and legal compliance.
• Security and audit logs may be retained for up to 1 year after account deletion.

Google Review Cache and Disconnection

Google review content and business display details use a temporary cache to keep the review inbox responsive. Cached content expires seven days after retrieval; refreshing the connection can replace it with a fresh copy from Google. Expired content is no longer displayed and is removed during scheduled cleanup. This shorter retention applies instead of the general account-lifetime retention described above. Connection identifiers and encrypted authorization tokens are retained while the shop is connected.

Disconnecting Google in the shop's Reviews page removes that shop's stored connection credentials and cached reviews and stops its review sync. It does not revoke the Google account's entire Allen Wrench authorization, which may also serve other connected shops. To revoke that authorization, remove Allen Wrench in your Google account connections, then disconnect the affected shops in Allen Wrench. Disconnecting does not delete reviews or replies already published on Google. Reply-submission audit records do not contain review or reply text and follow the audit-log retention described above.

For more details, see our Data Deletion Policy.

7. Data Security

We implement appropriate technical and organizational measures to protect your data:

• All data is transmitted over HTTPS/TLS encrypted connections
• Data is encrypted at rest in our database (hosted on Neon)
• Authentication is email and password. Passwords are stored only as salted cryptographic hashes; we never store or transmit them in readable form.
• QuickBooks integration uses OAuth 2.0 with automatic token refresh. We never access your QuickBooks password.
• Access to production systems is restricted to authorized personnel

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

8. Your Rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your account and associated data
• Export your data in a portable format
• Object to certain processing of your data

To exercise any of these rights, contact us at support@allenwrench.us.

9. California Privacy Rights (CCPA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request that we delete your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale: We do not sell personal information. If this changes, we will provide a "Do Not Sell My Personal Information" link.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To submit a CCPA request, contact us at support@allenwrench.us. We will verify your identity before processing your request and respond within 45 days.

10. Children's Privacy

Allen Wrench is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us at support@allenwrench.us and we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email at the address associated with your account. Your continued use of Allen Wrench after such notification constitutes acceptance of the updated policy.

12. Governing Law

This Privacy Policy is governed by the laws of the State of Oklahoma, without regard to its conflict of law provisions.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at: