Moibay Privacy Policy

Effective: 2026-08-13

1. Who we are

Moibay is operated by Moisei Smolianski as a sole proprietor in Ontario, Canada. Contact: [email protected].

2. What we collect

Shop account data

• Shop name, owner name, email address
• Hashed password (we never see your plaintext password)
• PIN code (hashed) for in-shop user switching
• Subscription status and billing identifiers from Stripe

Customer data the Shop enters

• Customer name, email, phone, address
• Vehicle details (make, model, year, VIN)
• Work-order line items, parts, labor, totals
• Photos and files the Shop uploads (stored on AWS S3)
• Payment records (amounts, methods; full card numbers are never seen by Moibay)

Operational data

• Server logs (IP address, user agent, request paths, timestamps) for security and debugging
• Usage analytics via PostHog (anonymized event names, no PII content)
• Captcha tokens via Cloudflare Turnstile during signup/login

Cookies

• shopAuth - primary session cookie (HTTP-only, signed JWT)
• NextAuth session cookies - secondary user-identity cookie set by PIN sign-in
• adminAuth - internal admin session (not used by shop accounts)
• Clerk session cookies - primary identity provider cookies
• PostHog analytics cookie

3. How we use it

• Operate the Service (display your data back to you, process payments, send invoices)
• Send transactional email via Resend (receipts, password reset, ToS updates)
• Send transactional SMS via Telnyx (work-order status, customer portal links) - Shop opt-in
• Detect abuse, debug, and improve the Service
• Comply with legal obligations

We do not sell personal data. We do not use Shop or Customer data to train AI models. We do not run third-party ad networks on Moibay.

4. Mobile application

The Moibay iOS and Android apps are companions to your Moibay account. They access the same account data as the web app over an encrypted (HTTPS) connection. In addition:

• Camera - with your permission, the app uses the camera to scan vehicle VIN barcodes and plates, to photograph diagnostic scanner screens for trouble-code reading, and to attach photos to work orders and vehicles. Images you capture are handled the same way as photos uploaded on the web (stored on AWS S3). The app does not access your photo library.
• Push notifications - if you enable notifications, we register a device push token (via Expo's push service, which relays through Apple APNs on iOS and Firebase Cloud Messaging on Android) so we can alert shop staff to events such as customer payments, inbound customer texts, and work-order assignments. The token is tied to your account and is deleted when you sign out or disable notifications. Notification content is limited to operational shop events.
• On-device storage - authentication tokens are stored in the device's secure storage (iOS Keychain / Android Keystore) so you can stay signed in. Signing out removes them.
• Diagnostic trouble-code decoding ("Decode") - trouble codes you enter or scan, plus optional vehicle context, are sent to Google's Gemini API to generate an advisory interpretation. This is advisory only and is not used to train models.

Billing and subscriptions are managed on the Moibay website, not through the app stores. The apps do not process in-app purchases.

5. Sub-processors

We share data with the following service providers, each only to the extent necessary to operate the Service:

6. Where data is stored

Primary database is hosted on Railway (US region). Backups are encrypted at rest. Customer-uploaded files are stored on AWS S3 (US region). If you require data residency in Canada or the EU, contact us - this is not a default offering yet.

7. Retention

We retain Shop and Customer data for the lifetime of the Shop's active subscription plus 30 days after cancellation. Backup snapshots may retain data for up to 90 days. Billing records are retained for 7 years to meet Canadian tax obligations.

You may request earlier deletion by emailing [email protected]; we will comply unless a legal obligation requires us to retain specific records.

8. Your rights

Depending on where you live (PIPEDA, CCPA, GDPR), you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion
• Export your data in a machine-readable format
• Withdraw consent for non-essential processing
• File a complaint with your local data-protection authority (in Canada: the Office of the Privacy Commissioner)

To exercise any of these rights, including deleting your account and associated data, email [email protected]. We will respond within 30 days.

9. Security

We hash passwords with bcrypt (cost 12) and PINs with bcrypt. Session cookies are HTTP-only and Secure in production. Database connections use TLS. We do not log plaintext passwords or PINs. Despite these measures, no system is perfectly secure - notify us immediately if you suspect a breach affecting your account.

10. Children

The Service is intended for businesses. We do not knowingly collect personal data from anyone under 13. If you believe a child has provided us data, contact us and we will delete it.

11. Changes

We may update this policy. Material changes will require you to re-accept the updated policy on next sign-in. The "Effective" date at the top reflects the current version.

12. Contact

Email: [email protected]