Privacy Policy

1. Scope and accountability

Lema Frontier Inc., operating as WrenchFinder, is responsible for personal information under its custody or control. This policy applies to the WrenchFinder marketplace, driver accounts and Garage, service requests, Shop OS, hosted shop pages, and related support.

Participating shops are independent organizations. A shop is responsible for its own collection and use of customer information for diagnosis, estimates, repairs, warranties, accounting, and other shop operations. Its privacy practices may also apply after it receives a request.

Our privacy program is designed to support applicable Canadian privacy requirements, including Alberta's Personal Information Protection Act and, where applicable, the Personal Information Protection and Electronic Documents Act. This is not a certification or guarantee of legal compliance.

2. Information the current service handles

• Driver account: full name, email address, authentication identifier, account role, and any phone number or city later saved to the profile. Password authentication and email verification are handled by the authentication provider; WrenchFinder application tables do not store the password.
• Garage vehicle: year, make, model, optional trim, full VIN, optional licence plate and province, odometer, ownership identifier, and timestamps.
• Service request: customer name, required phone number, optional email, selected shop and service, preferred date and time, expected duration, displayed starting price, optional notes, request status, source, reference, and a vehicle snapshot.
• Shop and team: business identity, address and contact details, marketplace profile, services and displayed starting prices, website/domain configuration and content, team member email, access role, and status.
• Shop customer and service records: customer identity and contact details, linked vehicles, relationship and consent notes, service date and odometer, and technician notes or recommendations where an authorized shop user creates them.
• Technical and support: session and consent records, timestamps, request source, security events, error metadata, support correspondence, and IP, browser, device, or network information that WrenchFinder or its infrastructure providers may generate when operating and securing the service.
• Location: city or postal-code text entered for search and, only after Functional consent and a separate browser permission, device location used by the interactive map.

The current service does not provide public review submission, customer-to-shop chat, vehicle-sale listings, platform payment checkout, or advertising tracking. Internal booking or technician notes are records, not a chat service.

3. VIN handling

• Garage: an authenticated driver's full VIN is stored with the vehicle and is restricted to that owner through application and database access controls.
• Booking snapshot: a request linked to a Garage vehicle stores the vehicle description and only the last six VIN characters, not another full VIN copy.
• Guest or manual request: if a full VIN is entered, it passes through the request endpoint so the service can derive the last six characters. The booking record rejects and does not persist the full VIN.
• Shop CRM: an authorized shop user may separately record a full VIN for a customer vehicle in that shop's organization-scoped customer workspace.

An authenticated user may choose to send a VIN to the U.S. National Highway Traffic Safety Administration vPIC service for decoding. WrenchFinder does not put the VIN in its decoder error logs.

4. How information is collected

We collect information directly from drivers and shop users, from shops that create or maintain business and customer records, automatically from the browser and service infrastructure, and from the authentication provider. Shop listing information may be supplied or approved by the listed business. The map and VIN decoder return data only when those features are used.

5. Purposes and consent

We collect, use, and disclose information only for reasonable, identified purposes, including to:

• create, verify, secure, and support accounts and role-based access;
• maintain a driver's Garage and decode a VIN at the driver's request;
• provide city/service marketplace search and optional map functionality;
• send and maintain service requests, let the selected shop respond outside or through the supported request workflow, and show request history;
• provide participating shops with customer, vehicle, service-record, team, profile, and website tools;
• detect misuse, investigate security events, resolve disputes, enforce agreements, and comply with legal obligations; and
• improve the service using necessary operational information or optional technologies where the required consent has been given.

Consent may be express or implied where permitted, taking account of sensitivity and reasonable expectations. Optional purposes are separate from core functions. You may withdraw consent subject to legal or contractual restrictions and reasonable notice; a related optional feature may then stop working. WrenchFinder does not currently operate an analytics, advertising, SMS, or marketing-email system.

6. Sharing and disclosure

We may disclose personal information:

• to the automotive business you select, limited to information reasonably needed to assess and respond to your request;
• within a shop's organization to authenticated team members whose role permits access to booking or customer records;
• to providers that operate database, authentication, application hosting, maps, VIN decoding, security, and account-email infrastructure on our behalf;
• to professional advisers or a business transaction counterparty under appropriate confidentiality measures where reasonably necessary; or
• where required or permitted by law, including to respond to lawful process, protect safety and rights, investigate fraud, or manage a privacy incident.

We do not sell personal information and do not distribute a service request to unrelated listed shops.

7. Providers and processing locations

Confirmed providers used by the current code and configuration are Supabase for database and authentication services, Mapbox for the consent-gated interactive map, and NHTSA vPIC for user-initiated VIN decoding. The primary Supabase database is configured in a Canadian region. The specific application-hosting and account-email providers must be confirmed in launch configuration before this policy is made effective.

Even where primary storage is in Canada, providers and their subprocessors may process support, security, network, map, or VIN-decoding information in the United States or other countries. Information processed elsewhere may be accessible to courts, law enforcement, or national-security authorities under the laws of that jurisdiction. Contact the Privacy Officer for information about our service-provider practices.

8. Cookies and similar technologies

Essential cookies and browser storage support authentication, security, consent choices, and a tab-scoped booking confirmation. Mapbox is classified as Functional and its code and map resources remain off until Functional consent is given. No analytics or advertising technology is currently active. See the Cookie Policy or use Cookie Preferences in the site footer to change optional choices.

9. Retention

No complete operational retention schedule is currently implemented. Until one is approved and enforced, records are retained only as long as reasonably necessary to provide and secure the service, prevent fraud, maintain legally required business records, resolve disputes, and establish or defend legal claims. Information no longer reasonably required should be securely deleted, destroyed, or anonymized, subject to backup cycles and lawful preservation duties.

A deletion request may not require deletion of information that must be kept for one of those purposes. The missing operational schedule and deletion workflow are pre-launch actions, not fixed periods invented by this policy.

10. Safeguards and incidents

WrenchFinder uses safeguards intended to be appropriate to the sensitivity of the information, including authentication, server-side authorization, organization and owner scoping, row-level database policies, restricted database privileges, protected transport, and PII-minimized application logging. No online system is risk-free.

Suspected incidents will be assessed and notices will be made to regulators and affected individuals where required by applicable law, including Alberta PIPA requirements for a breach presenting a real risk of significant harm.

11. Access, correction, deletion, and complaints

You may ask for access to personal information WrenchFinder holds about you, information about its use or disclosure, correction of inaccurate information, withdrawal of consent, or deletion where applicable. We may verify identity, apply lawful exceptions, preserve information where required, and explain a refusal and available review process.

Send a request or complaint to the published Privacy Officer channel: Privacy Officer contact pending launch verification. If that verified channel is not displayed, this policy remains a pre-launch draft and requests cannot yet be reliably accepted through it. You may also contact the Office of the Information and Privacy Commissioner of Alberta or, where PIPEDA applies, the Office of the Privacy Commissioner of Canada.

12. Children

WrenchFinder is not directed to children under 13. A person must be capable of understanding the nature and consequences of a privacy choice, or an authorized parent or guardian must act for them.

13. Changes

We may update this policy prospectively when the product, providers, or legal requirements change. We will update the document metadata and provide additional notice or obtain fresh consent where required. A new feature is not covered merely because it appears in a future plan.