Privacy Policy

MechanicX provides hosted garage management software to UK workshops. For data about our own account holders (garage owners, staff who sign in, people who contact us), MechanicX is the data controller. For data a garage enters about its own customers and vehicles, the garage is the controller and MechanicX acts as a processor on their instructions.

• Account data — name, work email, phone, role, company details, and authentication data (password hash, MFA enrolment status).
• Billing data — plan, billing/accounts email, invoice history. Card details are handled by Stripe; we never store full card numbers.
• Workspace data — the records a garage creates: customers, vehicles, bookings, job cards, estimates, invoices, stock, photos and documents.
• Technical data — sign-in events, audit log entries, IP address and user agent, and error diagnostics needed to keep the service secure and working.
• Support and feedback — messages you send us in-app or by email.

• Contract — to provide the app, your workspace, billing and support.
• Legitimate interests — securing the service, preventing abuse, audit logging, product improvement, and service-related messages.
• Legal obligation — keeping accounting and tax records.
• Consent — optional marketing email, where applicable. You can withdraw consent at any time via the unsubscribe link.

We do not sell personal data. We share it only with the service providers needed to run MechanicX — hosting, database, email, SMS, payments and vehicle data lookups — and where the law requires. The current list is on the Subprocessors page. Optional integrations only receive data if a garage enables them.

The application database and file storage are hosted in the EU (Ireland). Some providers (for example payment and AI processing) may process data outside the UK/EEA under the provider's own transfer safeguards, such as UK International Data Transfer Agreement clauses.

Workspace data is retained while the garage's account is active. After a subscription ends, the account enters a grace period, then is frozen, and personal data is erased 90 days after the account becomes inactive. Statutory billing and accounting records are retained for six years, as required by UK tax law. Audit and security logs are retained for a limited period proportionate to their security purpose.

Access requires an authenticated account, workspace data is isolated per garage with row-level database policies, traffic is encrypted in transit, and administrative actions are audit-logged. Multi-factor authentication is available to all users and enforced for platform owner accounts. More detail is on the Trust & Security page.

Under UK GDPR you can request access, correction, erasure, restriction, portability, or object to processing. If your data was entered by a garage using MechanicX, contact that garage first — they control those records; we will help them respond. Otherwise email admin@mechanicx.co.uk and we will respond within one month. You can also complain to the UK Information Commissioner's Office (ico.org.uk).

MechanicX uses a small number of strictly necessary cookies and local storage items. See the Cookie Policy.

We may update this policy as the product changes. Material changes will be notified in-app or by email to account administrators.