Privacy and your data

#Where it's kept

The database is in Sydney, Australia (Supabase). The apps run on Vercel in the United States, so data is processed there while you use them. Emails go through Resend. The full list of providers, and what each handles, is on each app's privacy page.

#Who sees what

• Every business's data is walled off from every other, checked by the app and again by the database on every request.
• Roles decide what each person sees: see Roles.
• Credentials for Shopify, Lightspeed, Podium and WhatsApp are encrypted, and no browser can read them back.

#Workshop: the access log

Workshop records who saw or processed customers' personal details, and when: the board or calendar listing jobs with customer names, a job's name, phone and email being opened, and privacy requests passed on by Shopify. Owners read it in Settings → Privacy. Nobody can edit or delete an entry. Entries are kept for 12 months.

#Customers' privacy requests (Shopify)

When a store is connected, Shopify passes on its customers' requests:

• Erase me: the customer's name, phone, email and booking-form answers are removed from their jobs. The jobs stay (dates, item, work done) as your service record, with nobody identifiable in them.
• What do you hold on me: you're emailed what Workshop holds, because you answer the customer.

#Getting your data out

#Deleting data

• Service: Settings → Delete all data removes every customer, vehicle and service record, and keeps the account and subscription.
• Calendar: Settings → delete every event, task and preference. Your account stays, because it's shared with the other apps.
• Other apps: email support@notjust.com.au.

#Cookies

Only what's needed to keep you signed in and remember your language and theme. No tracking cookies.