Back to Home

Privacy Policy

Effective Date: August 16, 2026  ·  Last Updated: August 16, 2026

1. Who We Are and Who This Policy Covers

This Privacy Policy explains how BigshopAI Inc. ("BigshopAI," "we," "us," or "our"), a company based in the State of Illinois, United States, collects, uses, shares, and protects information in connection with our website (bigshopai.com), our web and mobile applications, and related services (together, the "Service").

This Policy applies to:

• Visitors to our website and people who contact us or request a demo;
• Shops — the repair businesses that subscribe to the Service — and their Authorized Users (owners, service advisors, technicians, and other staff who log in);
• People whose information a Shop enters into the Service, such as the Shop's customers, vehicle owners, fleet contacts, employees, and vendors ("Shop Data").

1.1 Two Roles: Our Data and Your Shop's Data

We handle information in two distinct roles, and it matters which one applies:

• For website and account information (for example, the name, email, and billing details of the person who signs up), BigshopAI decides how the information is used and is responsible for it under this Policy.
• For Shop Data (the customer, vehicle, work order, invoice, inventory, employee, and time-and-attendance records a Shop enters or uploads), the Shop owns and controls the data. BigshopAI acts as the Shop's service provider and processes Shop Data only to provide the Service to the Shop, on the Shop's instructions, and as described in this Policy. The Shop is responsible for having the right to enter that data and for providing any notices or obtaining any consents required from its customers and employees.

2. Information We Collect

2.1 Information You Provide

• Account and Contact Information: Name, email address, phone number, job role, shop name and address, and login credentials.
• Billing Information: Subscription plan and billing contact details. Payment card numbers are entered directly with our payment processor on their secure, hosted payment page and are never stored on our systems; we receive only a confirmation, the card brand, and the last four digits.
• Shop Data: Customer and vehicle records (including VINs, license plates, and contact details), estimates, work orders, invoices, payments and balances, inspections, parts and inventory, purchase orders and vendor invoices, labor and pricing settings, employee profiles, schedules, time-and-attendance punches, pay rates and commission settings, and any notes, messages, and documents you add.
• Uploaded Content: Photos, scanned documents, PDFs, and — when you use voice features — short audio recordings you choose to make.
• Communications: Messages you send through the Service, support requests, demo requests, survey answers, and feedback.

2.2 Information Collected Automatically

• Usage Data: Features used, pages viewed, actions taken, and time spent, so we can operate, secure, and improve the Service.
• Device and Connection Data: IP address, browser and operating system, device type and identifiers, app version, and language settings.
• Log and Audit Data: Server logs, error reports, performance metrics, and an activity trail of significant actions taken in your account (who created, changed, or deleted a record, and when).
• Approximate Location: A general location (city or region) inferred from your IP address.
• Precise Location (mobile app, only when your Shop enables on-site clock-in): If your Shop turns on location-verified clock-in, the BigshopAI mobile app reads your device's location at the moment you clock in or out and uses it to confirm you are at the shop. We do not track your location continuously or in the background. You can decline the location permission; if you do, location-verified clock-in will not be available and your Shop can offer an alternative method. Your Shop decides whether to enable this feature and is responsible for giving you any written notice of workplace location verification or electronic monitoring that the law where you work requires.

2.3 Mobile App Permissions

The BigshopAI mobile app asks for the following device permissions, each only when you use the related feature. You can change these at any time in your device settings:

• Camera: To scan VINs and part numbers and to take photos for work orders and inspections.
• Photo Library: To attach existing photos to work orders and inspections.
• Microphone: To dictate notes and to talk to the AI assistant. Audio is recorded only while you hold or tap the microphone control.
• Location: For location-verified clock-in, as described above.
• Notifications: To send you push notifications about work orders, approvals, and other activity you have chosen to receive.
• Device Unlock (Face ID / Touch ID / fingerprint): If you turn on biometric unlock for the app, the check is performed entirely by your device's operating system. We never receive or store this biometric data. (This is separate from the optional Face ID clock-in feature, which is governed by our Biometric Information Privacy Policy.)

2.4 Information from Other Sources

• Services Your Shop Connects: If your Shop links accounting software, a payment processor, a parts supplier, a telematics or fleet system, a messaging channel, or another integration, we receive the data those services send us (for example, synced customer and invoice records, payment confirmations, or vehicle data). From a connected telematics system this can include vehicle identifiers, odometer and engine-hour readings, fault codes, and — if the telematics provider sends it — vehicle location. Telematics data is collected by your Shop's telematics provider under your Shop's agreement with them; your Shop is responsible for any driver notices that agreement or the law requires.
• Public and Licensed Data Sources: Vehicle specifications decoded from a VIN, industry labor-time data, and carrier and compliance lookups from public sources.
• Website Analytics: Aggregate statistics about how visitors use our marketing website.

3. How We Use Information

• Provide and operate the Service: Create and maintain accounts, process work orders, estimates, invoices, payments, inventory, scheduling, time and attendance, and reports, and deliver the AI-powered features described in Section 4.
• Communicate with you: Send service messages, security alerts, billing notices, support responses, and — if you opt in — product updates and marketing about BigshopAI. You can opt out of marketing at any time.
• Send communications on your Shop's behalf: Deliver the emails, text messages, and notifications your Shop chooses to send to its customers (for example, estimate approvals and payment links). Text messaging is subject to our SMS Terms.
• Improve the Service: Understand how features are used, fix bugs, test changes, and develop new features.
• Security and fraud prevention: Authenticate users, enforce permissions, detect and prevent abuse, and protect our systems and other customers.
• Legal compliance: Comply with applicable law, respond to lawful requests, and enforce our agreements.

4. Artificial Intelligence (AI) Features

4.1 What the AI Features Are

Depending on your plan and settings, AI features may include:

• AI Assistant (chat and voice): Answers questions about your shop and, when you ask it to, performs tasks such as looking up customers, vehicles, and stock; drafting or creating estimates and work orders; adding services, labor, and parts; assigning technicians; recording expenses; adjusting punch times; and sending customer notifications. When you use voice, your speech is transcribed to text and the reply may be read aloud to you.
• Document Processing: Reading vendor invoices, statements, and other documents you upload (photo or PDF) to extract line items, prices, taxes, and vendor details into your records.
• Labor Estimating: Suggesting labor hours for a service based on the vehicle and the repair described.
• Part Fitment Checks: Flagging parts that may not fit the selected vehicle.
• Vehicle and Data Matching: Decoding VINs, matching imported records to existing customers or vehicles, and finding similar past services.
• Image Analysis: Recognizing text and objects in inspection and part photos (for example, reading a part number or noting visible damage).
• Invoice Accuracy Checks: Flagging possible duplicates, price discrepancies, or missing items before an invoice goes out.
• Reports and Digests: Producing plain-language summaries of your shop's numbers, such as a daily or weekly briefing emailed to recipients your Shop selects.
• Face ID Clock-In: Optional facial verification for time and attendance, governed by our Biometric Information Privacy Policy.

4.2 What Information AI Features Process

Only the information needed for the specific feature is sent for AI processing. Depending on the feature, this can include: work order and service descriptions; vehicle details and VINs; part numbers and descriptions; the text of documents and images you upload; your typed messages to the assistant and your voice recordings; and, for reports and digests, your shop's business metrics. Because you may ask the assistant about a customer or a job, the information processed may include personal information contained in your Shop Data (such as a customer's name and contact details).

4.3 Our AI Commitments

• We do not train our own AI models on your data. We may use aggregated, de-identified information (for example, how often a feature is used or how accurate a suggestion was) to evaluate and improve the Service, but that information does not identify you, your Shop, or your customers.
• AI providers are service providers only. We engage third-party AI providers under business terms that limit them to processing your information to provide the feature to us and that prohibit them from using it for their own purposes, including training their general models or advertising. Where a Shop connects its own AI provider account to the Service, that provider's terms apply to the processing performed under that account.
• People stay in control. AI features make suggestions or carry out the specific task a user asks for, within that user's permissions. The assistant does not delete records. AI features do not, on their own, make decisions about employment, pay, credit, or pricing — a person at your Shop reviews and decides.
• AI can be wrong. AI-generated content (extracted invoice lines, labor estimates, fitment flags, summaries, and assistant answers) is produced automatically and may be incomplete or inaccurate. Please review it before relying on it. It is not legal, financial, tax, or professional advice.
• You control which AI features are on. Several AI features are off by default (for example, digests and Face ID clock-in), and features such as labor estimating, fitment checks, and digests can be turned on or off by your Shop's administrators in Settings. Other AI features run only when a user chooses to use them — for example, by uploading a document or opening the assistant. Voice and dictation only listen while you activate the microphone.
• Retention. Voice recordings are used to produce a transcript and are not kept by us afterward. Content the AI helps create (such as parsed invoices, estimates, and digests) becomes part of your Shop's records and is retained like any other record. The assistant may keep conversation context and learned preferences inside your Shop's account so it can be more helpful over time.

5. How We Share Information

We share information only in these limited circumstances:

5.1 Service Providers Working on Our Behalf

We use carefully selected companies to help us run the Service. They may access information only to perform services for us, are bound by confidentiality and data-protection obligations, and may not use it for their own purposes. Categories include:

• Cloud infrastructure and storage (hosting, databases, file storage, and backups, located in the United States);
• AI processing providers (language, vision, document, and speech models, as described in Section 4);
• Payment processing (subscription billing and, where your Shop uses it, card payments from your Shop's customers);
• Communications delivery (email, text-message, push-notification, and messaging-channel providers);
• Website analytics and anti-spam tools used on our marketing website and contact forms; and
• Customer support and internal operations tools.

5.2 Services Your Shop Chooses to Connect

When your Shop connects an integration (for example, accounting software, a payment processor, a parts supplier, a telematics system, or a messaging channel), we send that service the data needed for the integration to work. Those services are governed by their own privacy policies, and your Shop can disconnect them at any time.

5.3 Within Your Shop

Information in a Shop's account is visible to that Shop's Authorized Users according to the roles and permissions the Shop configures. Employees' time-and-attendance records, including whether a clock-in was location-verified, are visible to the Shop's administrators.

5.4 Business Transfers

If BigshopAI is involved in a merger, acquisition, financing, or sale of all or part of its business, information may be transferred as part of that transaction, subject to commitments at least as protective as this Policy. We will notify you of any change in ownership or in how your information is handled.

5.5 Legal Requirements and Protection

We may disclose information when we believe in good faith it is required by law, subpoena, court order, or other legal process, or to protect the rights, property, or safety of BigshopAI, our customers, or others. Where lawful and practical, we will notify the affected Shop before disclosing Shop Data.

5.6 With Your Direction or Consent

We share information when you ask us to or otherwise consent — for example, when you send a customer an estimate or payment link.

6. Data Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect your information, including:

• Encryption of data in transit (TLS) and at rest;
• Isolated shop environments — each Shop's data is logically separated from every other Shop's, and every request is checked against the requesting Shop;
• Role-based permissions that let your Shop control what each user can see and do, and optional multi-factor authentication for logins;
• Activity and access logging, monitoring, and alerting;
• Backups and disaster recovery, as described in Section 7; and
• Restricted internal access — only personnel who need access to operate, secure, or support the Service have it, and that access is logged.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn of a security incident that affects your personal information, we will notify you and any applicable authorities as required by law and without undue delay. You play a part too: keep your credentials confidential, use strong unique passwords and multi-factor authentication where available, and promptly remove access for users who leave your Shop.

7. Data Retention and Backups

• Account and Shop Data: Retained while your account is active. After an account is closed, we retain the data for a limited period (currently thirty (30) days) so you can export it, and then delete it from our active systems within a reasonable period, except where we must keep it to comply with law, resolve disputes, or enforce our agreements. Backup copies age out on the schedule above.
• Deletion requests: When you delete a record or ask us to delete data, it is removed from our live systems; copies in backups are not individually erased but expire with the backup, and are not restored to live systems except in a disaster-recovery event.
• Technical logs: Activity, access, system, and diagnostic logs are kept for a limited period based on what is needed for security, troubleshooting, and legal compliance — generally no longer than one (1) year. The change history attached to a business record (for example, edits to a work order) is kept with that record.
• Voice recordings: Not retained after transcription (see Section 4.3).
• Biometric data: Governed by the retention and destruction schedule in our Biometric Information Privacy Policy.
• Website inquiries: Demo and contact requests are kept for as long as needed to respond and follow up.

8. Your Choices and Rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and receive a copy;
• Correct inaccurate information (most account and Shop Data can be edited directly in the Service);
• Delete your personal information, subject to legal retention requirements;
• Export your data in a commonly used format;
• Opt out of marketing emails (use the unsubscribe link) and text messages (reply STOP);
• Close your account and have your data handled as described in Section 7; and
• Not be discriminated against for exercising any of these rights.

To exercise these rights, email us at support@bigshopai.com with the subject line "Privacy Request," or use the contact form on our website. We will verify your identity (for example, by confirming control of the email address on the account) before acting on a request, and we will respond within the time required by applicable law. You may authorize an agent to make a request on your behalf; we may ask the agent for proof of authorization.

If your information was entered by a Shop (you are the shop's customer or employee), please direct your request to that Shop; we will assist the Shop in responding.

9. United States State Privacy Rights

Residents of certain U.S. states — including California, Colorado, Connecticut, Texas, Virginia, Oregon, and others with comprehensive privacy laws — have specific rights over their personal information. Where these laws apply to you, you have the rights listed in Section 8, and you may appeal a decision we make about your request by replying to our response.

9.1 California Notice at Collection

In the preceding twelve months we have collected the following categories of personal information, for the business purposes described in Section 3, from the sources described in Section 2: identifiers (such as name, email, phone, IP address); commercial information (such as subscription and transaction records); internet or network activity (such as usage and log data); geolocation data (approximate, and — for location-verified clock-in — precise, at the moment of a punch); audio and visual information (voice recordings you choose to make and photos you upload); professional or employment-related information (job role, and Shop-entered employee records); and, for employees of Shops that enable Face ID clock-in, biometric information (see our Biometric Information Privacy Policy). We retain each category as described in Section 7.

We do not sell personal information and we do not share it for cross-context behavioral advertising, and we have not done so in the preceding twelve months. We use sensitive personal information (such as precise geolocation, account credentials, and biometric information) only to provide the Service you or your Shop requested and for security, not to infer characteristics about you. Because we do not sell or share personal information, there is no sale or sharing to opt out of.

For Shop Data, we act as a "service provider" to the Shop; the Shop is the "business" responsible for that data under California law.

10. Where We Operate and Store Data

BigshopAI is based in the United States and offers the Service to businesses located in the United States. Your information is stored and processed in the United States by us and by the service providers described in Section 5. The Service is not directed to individuals outside the United States. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those of your country.

11. Children's Privacy

The Service is intended for businesses and their personnel and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have done so, contact us and we will delete it.

12. Cookies and Similar Technologies

The Service uses cookies and similar technologies (such as browser local storage) that are essential to keep you signed in, remember your preferences, and protect your account. Our marketing website also uses a third-party analytics service to understand how visitors use the site, and an anti-spam (CAPTCHA) service on our contact forms. We do not use advertising cookies and do not track you across other websites. You can control cookies through your browser settings, but the Service may not work properly if essential cookies are disabled. Because we do not sell or share personal information, we do not currently respond differently to browser "Do Not Track" signals.

13. Third-Party Links and Services

The Service may link to third-party websites or work with third-party services your Shop connects. This Policy does not cover those third parties; please review their privacy policies.

14. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will notify you by email to your registered address and/or by a notice in the Service, and we will update the "Effective Date" and "Last Updated" dates above. Your continued use of the Service after a change takes effect means you accept the updated Policy.

15. Contact Us

Questions, concerns, or requests about this Policy or our privacy practices:

Related documents: Biometric Information Privacy Policy  ·  SMS Terms  ·  End-User License Agreement