Legal

Privacy policy

Last updated: September 05, 2026.

This policy describes the processing of personal data carried out as part of the Garatools service, published by Hugo Mastandrea (contact.garatools@gmail.com).

Two distinct roles

For garage accounts (name, email, password, garage details), the publisher is the data controller.
For a garage's customer data (name, email, vehicles), the garage is the controller and the publisher acts as a processor, solely on the garage's instructions.

Data collected and purposes

Account: name, email address, password (stored hashed with bcrypt), garage name, address and contact details — to create and secure access to the service and, where applicable, to issue its invoices.
Garage customers: name, email address and, if the garage invoices, postal address — to tell the customer their vehicle is ready and to issue a compliant invoice.
Vehicles: plate, make, model, status and status change dates — for workshop tracking.
Notifications: message content, recipient, channel, delivery status — to prove a customer was notified and to diagnose failures.
Activity log: actions taken in the account, with their author — for traceability and security.
Session: one strictly necessary cookie (atelier_session) containing a random token. No advertising cookie, no third-party analytics tracker — the details are in our cookie policy.

Legal bases

Performance of the contract, for providing the service and billing.
Legitimate interest, for the security of the service and abuse prevention.
Legal obligations, for retaining accounting records.

Retention periods

Account and garage data: for the whole duration of the subscription.
After an account is deleted: the associated data is deleted (cascading deletes apply to every table belonging to the garage).
Expired sessions: purged automatically.
Activity log and notification history: 12 months.
Invoices: 10 years, in line with accounting obligations.

Recipients and processors

Data is neither sold nor transferred. It is processed by the following processors, solely for the purposes of the service:

Vercel Inc. — Application hosting (European Union (cdg1 region, Paris)).
Neon Inc. — Database hosting (European Union).
Brevo (Sendinblue SAS) — Sending notification emails (France).
Stripe Payments Europe, Ltd. — Subscription payments (Ireland).

All processors handle the data within the European Union. No transfer outside the European Economic Area takes place as part of the service.

Security

Traffic encrypted over HTTPS, with HSTS.
Passwords hashed (bcrypt), never stored in plain text.
Session tokens stored hashed (SHA-256): a copy of the database does not allow a session to be impersonated.
Strict separation between garages: every query is filtered by garage identifier, and that separation is verified by automated tests.

Your rights

You have the right of access, rectification, erasure, restriction, objection and portability. To exercise it, write to contact.garatools@gmail.com. If you are a garage's customer, address your request directly to that garage, which decides how your data is used; the publisher will pass the request on where appropriate.

You may also lodge a complaint with the Data Protection Authority (APD), the competent supervisory authority in Belgium — www.autoriteprotectiondonnees.be. A person residing in another Member State may contact the supervisory authority of their own country, or of their place of work.