Privacy Policy

Your account

Your name, email address and password — the password is stored hashed, so nobody here can read it. Signing in is by email and password today; if we add Google or Apple sign-in, we’ll say here what those send us.

Your business

Your business name and booking link, phone number, city and state, service area, logo, cover photo, bio, your service menu and prices, your working hours, and any photos and notes you add to your booking page.

Your customers and their jobs

Customer name, phone number and email if you have it; the vehicle; the service address, including any note about gate codes or where the keys are; and the job itself — service, price, date, status and history. Some of this you type in; the rest arrives when a customer books through your page.

Payments

Card numbers never reach our systems. Stripe’s payment form collects them directly, and what we keep is a reference to the Stripe record, the amounts, and — where a customer agreed to keep a card on file — that they agreed, when, and the IP address they agreed from. That last one exists so the consent can be proved if a payment is ever disputed.

To show you where a payout is going, we read the bank’s name and the last four digits of the account you connected. That is the whole of what we see of it — never the full number, and never enough to move money.

We also keep Stripe’s own notifications about your account and your payments, stored whole so a payment can be reconciled or replayed if something goes wrong. Those can include the account details Stripe holds for you, such as the state of its identity checks. We keep them for as long as we keep your payment records, and we don’t use them for anything but making payments work.

Technical

Sign-in sessions record the IP address and browser they came from. Our servers keep short-lived request logs. If the app or the site hits an error, a report goes to our error-monitoring service so we can fix it. If you turn on notifications in the app, we store the device token they’re sent to.

We use all of the above to:

• run your booking page and take bookings on it;
• show your calendar and jobs, and keep your available times honest;
• take payments, deposits and refunds through Stripe;
• send the messages the product depends on — booking confirmations, reminders, receipts, email verification and password resets;
• answer you when you ask for help, which sometimes means looking at your account;
• keep the service working, secure and free of abuse;
• bill you, and meet our tax and accounting obligations.

Where the law asks for a legal basis: most of this is performing our contract with you, some is our legitimate interest in a service that works and isn’t abused, and the rest is a legal obligation. Marketing email, if we ever send it, is consent — and you can withdraw it.

We don’t sell your information or your customers’ information, and we never have. We don’t share it with advertisers or data brokers, we don’t run ads, and we don’t build profiles for anyone else.

There are no analytics and no tracking pixels on this site or your booking page. Nothing follows a customer around after they leave. We’re also not in the business of reading your customer list — we look at your data when you ask us for help, when something is broken, or when the law requires it.

Only the cookies that keep you signed in: one holding your session and one short-lived copy of it that saves a database lookup on every page. Clear them and you get signed out. There are no advertising or analytics cookies to opt out of, which is why this site has no cookie banner.

Stripe sets its own cookies on the payment step, which it uses to spot fraud. That is Stripe’s, and their privacy policy covers it.

A handful of companies process data so the product can work. Each does one job, and each is bound to use the data only for it.

• Stripe — payments, payouts and card storage. Card details go straight to Stripe and are held there.
• Cloudflare — hosting, the network your pages are served over, storage for the photos you upload, and outbound email.
• PlanetScale — the database everything above is stored in.
• Google — address suggestions while typing, and turning a city into map coordinates so service-area checks work. It receives the address being typed and, when one is picked, an identifier for it. Separately, if a customer taps “Add to calendar” after booking, that link hands Google the service, the time and the address — their choice, and only if they make it.
• Twilio — text messages, where those are switched on. It receives the phone number and the message.
• Expo — push notifications to the mobile app, if you turn them on.
• Sentry — error reports when something breaks, so we can find out what.

We also share information when the law requires it, when we have to in order to protect someone, and — if the business is ever sold or merged — with whoever takes it on, under this same policy. We’d tell you before that happened.

If you booked a detail through one of these pages, the detailer is the one who decides what happens to your information. We hold it for them and act on their instructions. That means:

• To see, correct or delete what’s held about you, ask the detailer you booked with — their contact details are on their booking page. If you can’t reach them, email us and we’ll act on it ourselves. If you paid for a job, your name stays on that record for as long as tax rules require; the rest goes.
• Texts about your booking come from the detailer’s business, not from us. Reply STOP to stop them.
• Your card details are held by Stripe, not by the detailer and not by us. If you agreed to keep a card on file, you can withdraw that at any time and the stored card stops being usable.

We don’t email you marketing, and we don’t use what you gave a detailer for anything except providing that detailer’s service.

Your account data stays while your account is open. There is no self-service delete button yet — to close an account, email us. Within 30 days of confirming it’s you, we take your booking page down, release your link, and remove your account, your business details and everything you put on your page.

Jobs that carry a payment are the exception, and we’d rather say so than promise otherwise: a paid job is a financial record, and it is kept — along with the customer name attached to it — for as long as tax and accounting rules require. Everything about those customers that isn’t part of the record, like phone numbers, addresses and notes, is removed with the rest. Jobs with no payment against them go entirely.

Backups roll off on their own schedule, usually within a further 30 days. Error reports and request logs are short-lived by design.

Short of closing the account, you can cancel a job, remove a saved card, and delete anything you put on your booking page from inside the product. Deleting a customer record outright is something to ask us for.

• See it. Most of what we hold is already visible in your dashboard. Ask us for the rest.
• Take it. There is no export button in the product yet. Ask us and we’ll send your customers, jobs and payment history in a format you can use somewhere else.
• Correct it. Your business details, service menu and booking page are all editable in the product.
• Delete it. Email us to close your account and it goes, as described above.
• Turn things off. Push notifications are a switch in the app and in your phone’s settings. Any marketing email carries an unsubscribe link. Messages we have to send to run your account — a receipt, a password reset — aren’t optional while the account is open.

Depending on where you live, you may also have the right to object to or restrict some processing, and to complain to your data protection authority. California residents: we don’t sell or share personal information as those terms are used in the CCPA, and we won’t treat you differently for exercising any of these rights. Email paul@madebyruntime.com for any of it — we’ll answer within 30 days, and may need to confirm who you are first.

Traffic is encrypted in transit, passwords are hashed, card numbers are held by Stripe rather than by us, and access to production data is limited to the people who need it to run the service.

No system is perfectly secure, and we won’t claim otherwise. If a breach ever affects your information, we’ll tell you and the relevant authorities as quickly as the facts allow.

Detail Call is for people running a business, and it isn’t intended for anyone under 18. We don’t knowingly collect information from children; if we find that we have, we delete it.

The service is run from the United States and our providers operate globally, so your information may be processed in countries other than your own. Where the law requires safeguards for that transfer, we rely on the standard contractual protections our providers offer.

When the product changes, this policy changes with it — that’s the whole reason it’s written from the code rather than from a template. The date at the top says when it last changed, and for anything material we’ll email you or tell you in the product before it takes effect.

The Terms of Service cover the rest of the relationship.