Privacy Policy

1. Introduction

Lane Pilot LLC ("we," "our," or "us") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our diagnostic platform (the "Service"). This policy applies to all users worldwide, including residents of the European Economic Area (EEA) and California.

2. Information We Collect

We collect the following categories of personal information:

• Account Information: Email address, display name, and authentication credentials collected during sign-up via our authentication provider. If you join a shop team, we also store your assigned role (technician, foreman, owner).
• Shop Trial Details: If you start a Shop trial, the shop name and business phone number you enter. We use the phone number to allow one trial per shop and to contact you about getting started, and for nothing else. It is also saved as your shop's phone number in your account.
• Billing Information: Payment method details, processed and stored exclusively by Stripe, Inc. We receive only a transaction confirmation and subscription status — we never see or store your credit card number, CVV, or full card details.
• Diagnostic Inputs: Text queries, fault codes (DTCs), vehicle identification data (make, model, VIN), symptoms, and CAN-bus log data you submit to the diagnostic engine.
• Vehicle Identification & Telemetry: When you use the OBD-II Web Scanner or manually enter vehicle data we collect Vehicle Identification Numbers (VINs), stored and pending Diagnostic Trouble Codes (DTCs), live OBD-II PID telemetry (engine RPM, coolant temperature, fuel trims, and similar), and OBD-II communication protocol identifiers. We do not use this data to track vehicle location, driving behavior, or vehicle owner identity.
• Uploaded Media: Diagnostic photos and files you upload (engine bays, connectors, scan tool screens) are stored in encrypted cloud storage and processed for visual component identification. You are responsible for ensuring uploaded photos do not contain personally identifiable information such as license plates, customer IDs, or financial documents.
• Voice Dictation: Lane Pilot offers optional voice-to-text input for diagnostic notes using your browser's built-in Web Speech API. When you activate dictation, your browser sends audio to its vendor's speech-to-text service (for example Google for Chrome, Apple for Safari) for transcription. Lane Pilot never receives, stores, or processes raw audio. Only the resulting transcribed text is transmitted to our servers as part of your diagnostic session data. Voice dictation is entirely opt-in.
• Automatically Collected Data: IP address, browser type and version, device type, operating system, referring URL, pages visited, session duration, and approximate geographic location derived from IP address.
• Aggregate Sensor Statistics: When a scan completes, the numeric sensor readings it captured (fuel trims, temperatures, pressures and similar live parameters) are contributed to a shared baseline library together with the vehicle's make, model and year. This contribution carries no VIN, no shop identifier, no user identifier and no repair-order data; the VIN is used only to derive a one-way hash that prevents the same scan being counted twice. No statistic is reported back to anyone until at least 30 independent samples exist for that platform.

3. How We Collect Data

• Directly from you: Account registration forms, diagnostic chat input, image uploads, and support inquiries.
• Automatically: Via server logs, browser cookies, and analytics when you access the Service.
• From third parties: Our authentication provider (login events), our payment processor (payment confirmations), and NHTSA (public vehicle recall data correlated with your queries).

4. Purpose of Collection

• Service Delivery: To authenticate your account, process diagnostic queries, generate repair analysis, and display session history.
• Payment Processing: To manage subscriptions, meter usage, process payments, and handle billing disputes.
• Service Improvement: To analyze usage patterns, improve diagnostic accuracy, and optimize performance.
• Aggregate Diagnostics: To aggregate anonymized diagnostic patterns (for example, "P0016 on a 2018 Audi A4 is most commonly caused by a VVT solenoid failure") to improve diagnostic accuracy for all users. Individual session data is never shared in identifiable form.
• Security & Fraud Prevention: To detect abuse, enforce rate limits, and protect against unauthorized access.
• Advertising Measurement: To measure the effectiveness of our advertising, as described in Cookies & Tracking.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.

5. We Do Not Sell Your Data

Lane Pilot does not sell, rent, or trade your personal information, diagnostic data, uploaded imagery, vehicle telemetry, or session content to any third party for commercial, marketing, or advertising purposes.

We do not participate in data broker networks. Your diagnostic sessions are yours.

6. Data Sharing & Third Parties

We share data only with the following categories of service providers, and only to the extent necessary to operate the Service. The provider currently used in each category is named.

• Cloud Infrastructure & Database — Supabase (hosted on AWS): Secure storage, authentication, and Row Level Security enforcement.
• Payment Processing — Stripe, Inc.: A PCI DSS Level 1 compliant processor handles all subscription billing and payment card operations. We never receive, transmit, or store your full payment card details.
• Diagnostic Engine — Google (Gemini): Diagnostic queries are processed to generate technical responses. Queries are sent without your name or email — only technical content (DTC codes, symptoms, vehicle data) is transmitted. We select providers that do not use your data to train their models.
• Hosting & CDN — Netlify: Frontend hosting and content delivery.
• Advertising Measurement — Meta Platforms, Inc.: Website events and completed purchases are reported to Meta to measure advertising performance. See Cookies & Tracking for what is sent and how to opt out.
• Public Safety Databases — NHTSA: We query publicly available government vehicle safety databases to enrich diagnostic results with recall and complaint data. No personal information is shared with these sources.

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

7. DMS Integration Data Sharing

If you enable a third-party Shop Management System ("DMS") integration (for example Shopmonkey or Tekmetric), the following data may be transmitted to your DMS Provider when you initiate a push:

DMS integrations are opt-in only and require you to configure your DMS API credentials in Shop Settings. No data is transmitted to any DMS Provider unless you explicitly enable and activate the integration. Your DMS API credentials are stored encrypted at rest.

Once data reaches your DMS Provider, it is governed by that provider's own Privacy Policy and Terms of Service. Lane Pilot is the data processor; your shop is the data controller.

• Diagnostic summary and root cause analysis text
• Recommended repair actions and safety warnings
• Digital Vehicle Inspection (DVI) status items (pass / fail / monitor)
• Exported diagnostic chart images (PNG)

8. Cookies & Tracking

We use the following types of cookies and similar technologies:

• Essential Cookies: Required for authentication and session management (auth tokens). These cannot be disabled without breaking core functionality.
• Functional Cookies: Store your preferences (for example selected vehicle, UI state) to improve your experience.
• Advertising & Measurement — Meta Pixel: We load the Meta (Facebook) Pixel and it sets cookies, including _fbp and _fbc. It reports page views, account registrations, Shop trial starts, checkout starts and completed purchases to Meta so we can measure advertising performance and build audiences. We do not send Meta your diagnostic data, VINs, uploaded images, or repair orders. We do not use Google Analytics.
• Server-Side Usage Logging: We log feature usage on our own servers to understand adoption.

Opt-Out: you can clear or block cookies via your browser settings at any time, and browser-level tracking protection or an ad blocker will prevent the Meta Pixel from loading. Disabling essential cookies will require you to re-authenticate on each visit.

9. Your Rights (All Users)

Regardless of your location, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request permanent deletion of your account and all associated data via our Account Deletion Page.
• Data Export / Portability: Request your data in a portable, machine-readable format, or export your diagnostic session history at any time from within the Service.
• Marketing Opt-Out: Unsubscribe from marketing communications at any time via the link in the email.

To exercise any of these rights, visit our Account Deletion Page or email service@lanepilot.io. We will respond within 30 days.

10. Additional Rights for EEA Residents (GDPR)

If you are located in the European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR):

• Right to Restrict Processing: You may request that we limit how we process your data.
• Right to Object: You may object to processing based on our legitimate interests.
• Right to Portability: You may request your data be transferred to another service provider.
• Right to Lodge a Complaint: You have the right to file a complaint with your local Data Protection Authority.

Legal Basis for Processing: we process your data based on (a) your consent (account creation and advertising cookies), (b) contractual necessity (providing the Service), and (c) legitimate interests (security, fraud prevention, service improvement).

11. Additional Rights for California Residents (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:

• Right to Know: You may request the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale: We do not sell your personal information. If this changes, we will provide a "Do Not Sell My Personal Information" link.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights (for example by charging different prices or providing a different service level).

12. Data Retention

• Account Data: Retained for the duration of your active account, plus 30 days after a deletion request for processing. Upon account deletion, all associated data (sessions, images, telemetry, feedback) is permanently purged within 30 days.
• Diagnostic Sessions: Session records (text, DTCs, responses, and the live PID snapshots stored within them) are retained for the duration of your subscription and deleted within 90 days of account termination.
• Uploaded Images: Retained for 12 months after upload, then permanently deleted from cloud storage.
• After a Shop Trial: When a Shop trial ends, the account continues on the free plan. Ending a trial does not delete anything: the shop's vehicle history, session records, and reports are kept under the rules above, and you can request a copy or deletion at any time. We keep a record of each trial (shop name, business phone number, dates, and sessions used) for as long as the account exists, to allow one trial per shop.
• Billing Records: Retained for 7 years as required by U.S. tax and financial regulations.
• Server Logs: Automatically purged after 90 days.

13. Security Measures

• Encryption in Transit: All data is transmitted over TLS 1.2+ (HTTPS). No unencrypted connections are accepted.
• Encryption at Rest: Database records and stored files are encrypted at rest using AES-256 via our cloud infrastructure provider.
• Row Level Security: Every database table enforces PostgreSQL Row Level Security (RLS) policies, ensuring users can only access data belonging to their own account or shop.
• Authentication: Passwords are hashed using industry-standard cryptographic algorithms. We support secure session tokens with automatic expiry.
• API Key Storage: Third-party DMS API credentials are stored encrypted and are never exposed in API responses or client-side code.
• Incident Response: In the event of a data breach, we will notify affected users within 72 hours (GDPR requirement) and report to relevant authorities as required by law.

No method of transmission over the Internet is 100% secure. While we use industry-standard protections, we cannot guarantee absolute security.

14. Children's Privacy

The Service is intended for use by certified automotive professionals and is not directed at individuals under the age of 16 (or 13 in jurisdictions governed by COPPA). We do not knowingly collect personal information from children. If we learn that we have collected data from a child, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at service@lanepilot.io.

15. International Data Transfers

Your data may be processed in the United States, where our servers and service providers are located. If you are accessing the Service from the EEA or other regions with data transfer restrictions, you consent to the transfer of your data to the United States. We rely on Standard Contractual Clauses (SCCs) where required by law.

16. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a prominent notice on the Service prior to the change becoming effective. Your continued use of the Service after the effective date constitutes your acceptance of the updated policy.

17. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at: service@lanepilot.io