Privacy Policy

This explains what the company that operates FlagHour (“FlagHour”, “we”) stores, why, who else handles it, how long we keep it, and how to get a copy or have it deleted. It covers mechanics who use FlagHour and the customers they text through it. Contact: help@flaghour.com.

What we store

About mechanics (our users): email address and password (the password only as a secure hash, held by our login provider), business name, business phone, logo, time zone, country, prices and hold settings, subscription status, and the ID of your Stripe account. If you cancel, the answers you give in the short exit survey.

About your customers (entered by the mechanic): name, phone number, optional email and notes, vehicles (year, make, model, plate, VIN, mileage), job addresses and times, estimates, invoices, service history, the texts and emails sent to them and their replies, and whether they asked to stop receiving texts.

About payments: amounts, dates, status, the card brand and last 4 digits, and Stripe’s reference IDs. We never see or store full card numbers, expiry dates or security codes — customers type those into Stripe’s secure form, which sends them straight to Stripe.

Technical data: sign-in session cookies (needed to keep you signed in), error reports (which contain account IDs, not names or numbers), and anonymous page-view counts for our public pages (no cookies, no IP addresses, nothing that identifies you). Recordings made with “Describe the work” are sent for transcription and not kept by us.

Why

To run the service you signed up for: schedule and protect jobs, send the texts and emails you trigger, take and record payments, bill your subscription, keep the service secure, and fix problems. We don’t sell personal information, share it for advertising, or use your customers’ details for anything but your business with them.

Who else handles it

• Stripe — card holds, payments, payouts, and our subscription billing (Stripe’s own privacy policy applies to card data).
• Twilio — sends and receives text messages (the customer’s number and the message).
• Supabase — our database, login and file storage (United States, AWS us-east-1).
• Google Cloud — hosts the app (United States).
• Resend — sends email.
• OpenAI — turns voice recordings into draft invoices. Under OpenAI’s API terms, data sent this way isn’t used to train their models.
• Sentry — error reports (IDs only).

Each only gets what it needs for its job. We may also disclose information if the law requires it.

Text messages (SMS)

Customers of mechanics who use FlagHour receive text messages about their own appointment and payment: booking confirmations and card-hold links, appointment reminders, “on my way” and “arrived” updates, receipts and payment links, payment reminders, and an occasional review request or service-due reminder. A customer agrees to these when they give their mobile number to the mechanic for their appointment, and every first message names the business and says how to opt out. Message frequency varies, typically 3–8 messages per appointment. Message and data rates may apply. Reply STOP to stop receiving texts, or HELP for help; you can also contact us at help@flaghour.com.

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third parties. Phone numbers are passed only to Twilio, which delivers the messages.

On your phone

To survive a lost signal, FlagHour keeps unsaved forms and the last copy of your Today screen on your own phone. They’re deleted when the form is saved or when you sign out.

How long we keep it

• While your account is open: everything, so your records and history are complete.
• After you cancel your subscription: view-only for 90 days, then locked. The data is kept so you can come back, until you ask us to delete it.
• After “Delete my account”: locked immediately, then permanently deleted 90 days later — every job, invoice, customer, vehicle, message record, payment record, your logo and your login.
• Stripe and Twilio keep their own records of payments and messages under their own policies and legal obligations.

Your choices

• Get a copy: Settings → Export your data → download jobs, invoices, customers and service records as CSV files (they open in Excel or Google Sheets).
• Delete: Settings → Delete my account, or email help@flaghour.com.
• Correct: edit anything in the app, or ask us.
• Customers of a mechanic: your information belongs to the business you dealt with — ask them first to see, change or delete it. Reply STOP to any text to stop texts. You can also email us and we’ll pass your request to the business and help. See Holds, refunds & disputes.

Depending on where you live (for example California or Canada) you may have further rights; email us and we’ll honour them.

Security

Everything travels over encrypted connections. Each mechanic’s data is walled off from every other account at the database level. Access by our team is limited to fixing problems you report or that our monitoring finds.

Changes

If we change this policy in a way that matters, we’ll email mechanics before it takes effect and update the date at the top.