Privacy Policy

Two roles: when we are responsible, and when your shop is

We collect some information for our own purposes (running the website, responding to inquiries, providing accounts). For that information we are the “controller” (the “business” under US state law), and this policy governs it.

Separately, when a shop uploads repair orders or insurer estimates, those documents may contain personal information about the shop's own customers (vehicle owners). We process that information only on the shop's instructions, as a “processor” / “service provider.” The shop is responsible for that data and for telling its customers about it. If you are a vehicle owner with a question about your data in a shop's account, please contact that shop. A Data Processing Addendum governing this relationship is available — see our DPA page.

Information we collect

Identifiers and contact details. When you request a demo or a free RO audit, or create an account, we collect your name, shop name, email address, and optionally your phone number, repair-order volume, estimating system, and anything you write in a message field.

Documents you provide. To run an audit or to operate the product, you may upload repair orders, estimates, and related files. These can contain information about your shop, your customers, the vehicles you repair (including VINs), and insurance details. We process these on your behalf, as described above.

Commercial and usage information. Which features you use, demo requests, and how you interact with the site.

Technical information. Standard server logs such as IP address, browser type, device, and pages visited. Our scheduling embed (Cal.com) and similar tools may set their own cookies; see “Cookies and tracking” below.

We do not seek to collect sensitive personal information (such as government ID numbers or financial account numbers) for our own purposes. If such information appears inside documents you upload, we handle it only as a processor, solely to provide the service, and we do not use it for any other purpose.

How we use information

• Respond to your inquiry and schedule demos
• Run the RO audit and produce your supplement and balance statements
• Provide, maintain, secure, and improve the product
• Communicate with you about the service, including billing and legal notices
• Detect and prevent fraud and abuse
• Comply with our legal, tax, and accounting obligations

How we share information, and who we never share it with

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

We never share your estimates, repair orders, or any document you send us with any insurance carrier. Selling to carriers is not our business model and never will be.

We use a small number of service providers (“sub-processors”) to run the company — for example, hosting and scheduling. They may process information only to provide those services to us, under contract. Our current sub-processors are listed on our DPA page.

We may disclose information if required by law, to enforce our agreements, or in connection with a merger, acquisition, or sale of assets (in which case we will require the recipient to honor this policy).

Your privacy rights

Depending on where you live, you may have some or all of the following rights regarding the personal information we hold as a controller:

• Know / access — what we have collected about you and how we use it
• Delete — ask us to delete your information (subject to legal exceptions)
• Correct — fix inaccurate information
• Portability — receive a copy in a usable format
• Opt out — of any sale, sharing, or profiling (note: we do none of these)
• Non-discrimination — we will not treat you differently for exercising a right
• Appeal — if we deny a request, you may ask us to reconsider

To exercise a right, email vraj@byeblindspot.com. We will respond within 45 days (extendable once by 45 days for complex requests). If we deny your request you may appeal by replying to our decision; if an appeal is denied you may contact your state Attorney General. You may use an authorized agent to submit a request on your behalf; we will ask for proof of authorization.

California disclosures

If you are a California resident, the rights above apply, and the following additional points are required by California law.

Categories collected. In the past 12 months we have collected identifiers, commercial information, internet/network activity, and professional information, and (as a processor, within uploaded documents) the categories your shop chooses to upload. Sources are: you directly, your use of the service, and automatic technical collection.

Sale/sharing. We have not sold or shared personal information as those terms are defined under the CCPA/CPRA. Because we do not sell or share, we do not currently provide a “Do Not Sell or Share” link; if that ever changes, we will add one and honor Global Privacy Control signals.

Financial incentives. We do not offer financial incentives in exchange for personal information.

Shine the Light. We do not disclose personal information to third parties for their own direct marketing. California residents may contact vraj@byeblindspot.com with questions.

For visitors in the European Economic Area, UK, and Switzerland

If you are in the EEA, UK, or Switzerland, we process your personal information on these legal bases: to take steps at your request and perform our contract with you (responding to inquiries, providing the service); our legitimate interests in operating and improving the business (balanced against your rights); your consent where required; and compliance with legal obligations.

You have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with your local supervisory authority. To exercise these, email us; we will respond within one month.

Where we transfer personal data to the United States, we rely on an appropriate transfer mechanism such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. A copy of the relevant safeguards is available on request.

Cookies and tracking

We use cookies and similar technologies that are strictly necessary to run the site, plus those set by our embedded scheduling tool (Cal.com). We do not currently use advertising or cross-site tracking cookies.

Do Not Track: our site does not currently respond to browser “Do Not Track” signals, because there is no industry-standard for honoring them. If we add tools that constitute “sharing” under California law, we will honor Global Privacy Control signals at that time.

How long we keep information

We keep personal information only as long as needed for the purposes described here and for reasonable business, tax, and legal records. Snippet working copies are automatically deleted after 30 days; claim metadata and the reconciliation ledger are retained while your account is active so your history and recovery metrics keep working. Under the accuracy program below, one copy of each claim's PDF pair and your correction events are retained while your account is active. You can ask us to delete your documents and contact details at any time by emailing vraj@byeblindspot.com.

Accuracy program

BlindSpot improves its line-matching and citation accuracy from real claims. Every shop takes part in the program under the Terms of Service you accepted at signup. We keep a copy of each claim's PDF pair and record the decisions you make on gap items, and our team may review them to correct the engine. Claim PDFs contain whatever your estimate contains, including customer name, VIN, address, and insurance details. Every number BlindSpot shows you stays deterministic and cited; this data is used to test and correct the engine, never to generate your documents. Participation is part of the service, and Settings has no option to leave it. Contact us to request full account deletion; that removes everything, including accuracy-program copies.

Security

We protect information in transit with encryption (HTTPS), limit access to the people who need it, and follow the practices described on our Security page. No method of transmission or storage is perfectly secure, but we work to protect your information and to notify affected customers promptly if a breach occurs.

Children

BlindSpot is a tool for businesses and is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has provided us information, email us and we will delete it.

Changes to this policy

If we make material changes, we will update the version and date at the top of this page and, where appropriate, notify you directly.

Contact

Questions, or want to exercise a right? Email vraj@byeblindspot.com.