Privacy Policy

This Privacy Policy explains how STRONGFORGE LLC (“GTS PDR”, “we”, “us”, or “our”) collects, uses, discloses, and protects personal information when you use the GTS PDR application and related websites and services (the “Service”). GTS PDR is a business tool for paintless dent removal (PDR) companies to manage vehicles, technicians, jobs, goals, and reporting.

We act as the data controller for account and service data we determine the purposes of. Where a PDR company deploys GTS PDR to manage its own workforce, that company may also be a controller of its employees’ work data, and we process such data on the terms of this Policy. If you do not agree with this Policy, please do not use the Service.

1. Information We Collect

1.1 Information you provide

• Account & identity: full name, email address, phone number, account password (stored only as a salted hash by our authentication provider), and your role (e.g., technician, admin).
• Profile photo (face image): if you add a profile picture, we store that image. A facial photograph may be considered sensitive personal data in some jurisdictions; we use it solely to identify you within your organization’s workspace.
• Sign-in with Google (optional): if you authenticate with Google, we receive your basic Google profile (name, email address, and profile picture) to create or link your account.
• Vehicle & work data: Vehicle Identification Numbers (VINs), vehicle make/model/year, photographs of vehicles and dents you capture, job records, crew assignments and hand-offs, work notes and in-app chat messages, and related timestamps.
• Financial data: job payment and payout records, amounts, and configured rates used to calculate technician earnings and company figures. We do not collect or process payment-card numbers: the company subscription is billed by our payment processor (Stripe), which receives the card details directly.
• Payout details (optional): if a technician or an administrator adds them, the account holder’s name and document number and the bank/payment details used to pay the technician (for example IBAN, SWIFT/BIC, branch and account number, routing number, or PIX key).
• Identity and work documents (optional): files such as passports, IDs, or licenses that your organization chooses to keep for a technician, with their type, dates, and notes.
• Communications: messages you send us for support or inquiries.

1.2 Information collected automatically

• Device & technical data: IP address, browser and device type, operating system, and similar technical identifiers.
• Usage & log data: actions taken in the Service, access times, and error/diagnostic logs.
• Scanner diagnostics: when the VIN scanner ends without a reading or the camera fails, we record technical details of that session (camera permission state, error type, timing) and up to three still frames of what the camera was showing, so your organization can diagnose the problem.
• Push notification tokens: if you enable notifications, a device/browser push token so we can deliver alerts.
• Cookies: strictly necessary cookies for authentication (session) and to remember your selected project. See “Cookies” below.

1.3 Camera and photos

With your permission, the Service uses your device’s camera to scan VIN barcodes/labels and to take photographs of vehicles and dents. Images and the text read from them are used to register and document jobs. To recognize VINs, vehicle images and/or extracted text may be sent to third-party optical character recognition (OCR) providers (see “How We Share”). In the iOS app, we ask for your explicit permission before the first image is sent to these providers; without it, you can still type the VIN manually. The camera is never used for any purpose other than the features you invoke, and we do not access your camera in the background.

1.4 What we do NOT collect

We do not collect precise geolocation, payment-card data, biometric templates for identification, advertising identifiers, and we do not use third-party advertising or cross-app tracking technologies.

2. How We Use Information

• Provide, operate, maintain, and secure the Service.
• Authenticate you and manage your account, roles, and permissions.
• Register vehicles, manage jobs, crews, hand-offs, goals, notes, and reporting.
• Calculate and display earnings, payouts, and business figures to authorized users.
• Send transactional emails and (if enabled) push notifications.
• Prevent fraud and abuse, enforce rate limits, and protect the security and integrity of the Service.
• Provide support and respond to your requests.
• Comply with legal obligations and enforce our Terms.

3. Legal Bases for Processing

Where the GDPR (EU/UK), LGPD (Brazil), or similar laws apply, we rely on: performance of a contract (to provide the Service you or your employer requested); legitimate interests (to secure, improve, and operate the Service, and to prevent fraud); consent (e.g., camera access and push notifications, which you can withdraw at any time via your device settings); and compliance with legal obligations.

4. How We Share Information

We do not sell your personal information. We share it only as described here:

• Within your organization: your employer’s administrators and, where relevant, crew members can see work data and your basic profile (name and photo) needed to coordinate jobs.
• Service providers (sub-processors) that operate the Service on our behalf under contractual confidentiality and security obligations, including: hosting, database, authentication and file storage (Supabase); application hosting and content delivery (Vercel); transactional email delivery (Resend); VIN/OCR recognition (Google Cloud Vision, OpenAI, and Google Gemini); rate-limiting and abuse prevention (Upstash); sign-in (Google); subscription billing and payments (Stripe); and push notification delivery (Apple Push Notification service, Google Firebase Cloud Messaging, and/or web-push services).
• Legal & safety: when required by law, legal process, or to protect the rights, property, or safety of users, the public, or us.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

5. International Data Transfers

GTS PDR is offered globally and our providers may process and store data in countries other than yours, including the United States and the European Union. Where required, we use appropriate safeguards for international transfers (such as the European Commission’s Standard Contractual Clauses) and select providers that maintain recognized security and privacy standards.

6. Data Retention

We retain personal data for as long as your account is active and as needed to provide the Service. When an account is removed, we delete the associated profile (face) photo, payout details, and stored documents, and replace direct contact identifiers with non-identifying tombstone values; certain work records (e.g., jobs and financial entries) are retained as legitimate business and accounting records, or as required by law. We delete or anonymize data when it is no longer needed for these purposes.

7. Security

We use technical and organizational measures to protect personal data, including encryption in transit (HTTPS/TLS), row-level access controls so users only access data they are authorized to see, private file storage served through authenticated proxies, hashed passwords, rate-limiting, and least-privilege access to production systems. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. Your Rights

Depending on where you live, you may have some or all of the following rights. To exercise them, contact us at contact@strongforgesolutions.com; we will respond as required by applicable law and may need to verify your identity.

• EU/UK (GDPR): access, rectification, erasure, restriction, portability, objection, the right to withdraw consent, and the right to lodge a complaint with your data protection authority.
• Brazil (LGPD): confirmation of processing, access, correction, anonymization or deletion, portability, information about sharing, and the right to revoke consent. You may also contact the Brazilian National Data Protection Authority (ANPD).
• California (CCPA/CPRA): the right to know, delete, and correct personal information, to opt out of “sale” or “sharing” (we do not sell or share personal information for cross-context behavioral advertising), and to non-discrimination for exercising your rights.
• Mexico (LFPDPPP): ARCO rights — Access, Rectification, Cancellation, and Opposition — and the right to revoke consent and limit the use or disclosure of your data.

Some work data is controlled by your employer; if we process it on their behalf, we may direct your request to them or assist them in responding.

9. Children’s Privacy

The Service is a workplace tool intended for users who are 18 years or older. It is not directed to children, and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

10. Cookies

We use only strictly necessary cookies: an authentication/session cookie to keep you signed in, and a cookie that remembers your selected project. We do not use advertising, analytics-profiling, or cross-site-tracking cookies. Blocking essential cookies will prevent the Service from functioning.

11. Changes to This Policy

We may update this Policy from time to time. We will revise the “Last updated” date above and, for material changes, provide a more prominent notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

12. Contact Us

For privacy questions or to exercise your rights, contact STRONGFORGE LLC at contact@strongforgesolutions.com, 5900 Balcones Dr Ste 100, Austin, TX 78731, USA.