Privacy Policy

1. Introduction

Lane Pilot LLC ("we," "our," or "us") respects your privacy. This Privacy Policy explains how we collect, use, store, and protect your information when you use our multimodal diagnostic platform (the "Service").

2. Information We Collect

2.1 Account Information

When you sign up, we collect your email address, display name, and authentication credentials via our identity provider (Supabase Auth). If you join a shop team, we also store your assigned role (technician, foreman, owner).

2.2 Billing Information

Payments are processed by Stripe. We do not store your credit card number, CVV, or full card details on our servers. Stripe processes payment data in accordance with PCI-DSS and their own privacy policy.

2.3 Diagnostic Session Data

We collect the text inputs, fault codes (DTCs), vehicle make/model/year, and symptom descriptions you submit during diagnostic sessions. This data is used to generate diagnostic responses and improve the accuracy of the Service.

2.4 Vehicle Identification & Telemetry

When you use the OBD-II Web Scanner or manually enter vehicle data, we collect:

• Vehicle Identification Numbers (VINs)
• Stored and pending Diagnostic Trouble Codes (DTCs)
• Live OBD-II PID telemetry (engine RPM, coolant temperature, fuel trims, etc.)
• OBD-II communication protocol identifiers

We do not use this data to track vehicle location, driving behavior, or vehicle owner identity.

2.5 Uploaded Photos & Files

When you upload diagnostic photos (engine bays, connectors, scan tool screens, etc.), these images are stored in encrypted cloud storage and processed for visual component identification. You are responsible for ensuring uploaded photos do not contain personally identifiable information such as license plates, customer IDs, or financial documents.

2.6 Voice Dictation

Lane Pilot offers optional voice-to-text input for diagnostic notes using your browser's built-in Web Speech API (webkitSpeechRecognition). When you activate dictation, your browser sends audio to its vendor's speech-to-text service (e.g., Google for Chrome, Apple for Safari) for transcription. Lane Pilot never receives, stores, or processes raw audio. Only the resulting transcribed text is transmitted to our servers as part of your diagnostic session data. Voice dictation is entirely opt-in and can be used without enabling it.

3. How We Use Your Data

• To provide, maintain, and improve the diagnostic functionality of the Service.
• To process transactions and manage user subscriptions via secure third-party payment processors.
• To generate automated diagnostic insights using machine learning models hosted by trusted third-party infrastructure providers.
• To detect, prevent, and address technical issues, fraud, or abuse.
• To aggregate anonymized diagnostic patterns (e.g., "P0016 on 2018 Audi A4 is most commonly caused by a VVT solenoid failure") to improve diagnostic accuracy for all users. Individual session data is never shared in identifiable form.

4. We Do Not Sell Your Data

Lane Pilot does not sell, rent, or trade your personal information, diagnostic data, uploaded imagery, vehicle telemetry, or session content to any third party for commercial, marketing, or advertising purposes.

We do not participate in data broker networks. Your diagnostic sessions are yours.

5. Third-Party Service Providers

We share data with trusted third-party service providers strictly as necessary to operate the Service:

• Cloud Infrastructure & Database: Supabase (hosted on AWS) for secure storage, authentication, and Row Level Security enforcement.
• Payment Processing: Stripe for billing, subscription management, and transaction processing.
• Diagnostic Engine: Google (Gemini) for processing diagnostic queries and generating technical responses. Queries are sent without your name or email — only technical content (DTC codes, symptoms, vehicle data) is transmitted.
• Hosting & CDN: Netlify for frontend hosting and content delivery.

6. DMS Integration Data Sharing

If you enable a third-party Shop Management System ("DMS") integration (e.g., Shopmonkey, Tekmetric), the following data may be transmitted to your DMS Provider when you initiate a push:

• Diagnostic summary and root cause analysis text
• Recommended repair actions and safety warnings
• Digital Vehicle Inspection (DVI) status items (pass / fail / monitor)
• Exported diagnostic chart images (PNG)

DMS integrations are opt-in only and require you to configure your DMS API credentials in Shop Settings. No data is transmitted to any DMS Provider unless you explicitly enable and activate the integration. Your DMS API credentials are stored encrypted at rest.

Once data reaches your DMS Provider, it is governed by that provider's own Privacy Policy and Terms of Service. Lane Pilot is the data processor; your shop is the data controller.

7. Data Retention

• Diagnostic Sessions: Session records (text, DTCs, responses) are retained for the duration of your active subscription plus 30 days after account cancellation.
• Uploaded Images: Diagnostic photos are retained for a maximum of 90 days from the date of upload, after which they are permanently deleted. Shop Foreman-tier subscribers may opt to retain images attached to saved work orders for up to 1 year.
• OBD-II Telemetry: Live PID snapshots are retained within the session record and follow the same retention policy as diagnostic sessions.
• Account Data: Upon account deletion request, all associated data (sessions, images, telemetry, feedback) is permanently purged within 30 days.

8. Data Security

• Encryption in Transit: All data is transmitted over TLS 1.3 encrypted connections.
• Encryption at Rest: Database records and stored files are encrypted at rest using AES-256 via our cloud infrastructure provider.
• Row Level Security: Every database table enforces PostgreSQL Row Level Security (RLS) policies, ensuring users can only access data belonging to their own account or shop.
• API Key Storage: Third-party DMS API credentials are stored encrypted and are never exposed in API responses or client-side code.

9. Your Rights

• Access: You may request a copy of all data we hold about you by contacting support.
• Deletion: You may request permanent deletion of your account and all associated data at any time via our Account Deletion Page or by contacting service@lanepilot.io.
• Portability: You may export your diagnostic session history at any time from within the Service.
• Marketing Opt-Out: You may unsubscribe from marketing emails via the link in any email we send.

10. Children's Privacy

The Service is intended for professional automotive technicians and is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last Updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.