Privacy Policy

Who we are

Gearboxed ("we") operates the fleet shop management platform available at gearboxed.ai and app.gearboxed.ai. This policy describes what information we collect, why we collect it, how we protect it and the rights you have.

For any question about this policy, write to us at support@gearboxed.ai.

Person responsible for the protection of personal information

The person responsible for the protection of personal information at Gearboxed is its founder. You can reach them at support@gearboxed.ai for any question or request regarding your personal information.

Information we collect

Account information: your name, email address and sign-in credentials (or your Google profile if you sign in with Google).

Shop data: the invoices, parts, inventory, work orders, vehicles, warranties, fuel data and other information your organization records in the platform. This data may contain personal information (for example, an employee's name on a work order).

Usage data: usage metrics (pages visited, actions taken) used to improve the product, along with the communications you send us for support.

Email and telematics connections

To find your invoices, an administrator can connect an email mailbox: a Gmail account through Google, or another provider over IMAP. To keep odometers current, you can connect a Geotab telematics account. We access a connected mailbox for a single purpose, finding and extracting supplier invoices, and a connected telematics account only to read odometer and engine-hour readings.

The credentials or access tokens for these connections are encrypted, and we use them only for the purpose above. You can disconnect any connection at any time in your organization settings; for a Gmail connection you can also remove our access from your Google account (myaccount.google.com/permissions). Disconnecting immediately stops any new access.

Your role and ours

Your organization decides what shop data goes into Gearboxed and is responsible for it under privacy law, including any personal information about your employees or others (a name on a work order, for example). We process that data only on your organization's behalf and under its instructions, to provide the service. For your account information and the usage data described above, we are the responsible party.

Google user data

If an administrator connects a Gmail mailbox to Gearboxed, we access, with their explicit consent, the emails and attachments in that mailbox for a single purpose: finding supplier invoices and extracting their content (line items, parts, quantities, prices, warranty terms).

We do not read emails for any other purpose. We do not use this data for advertising. We do not sell it to anyone. No human accesses it except with your explicit permission (for example, for technical support), for security purposes, or when required by law.

We never use data obtained through Google APIs to train generalized artificial intelligence models. AI is used only to process each invoice, at your organization's request, to extract its content.

Google access tokens and extracted data are encrypted at rest. You can revoke access at any time: disconnect the connection in your organization settings, or remove Gearboxed's access from your Google account security settings (myaccount.google.com/permissions). Revocation immediately stops any new access.

Gearboxed's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we use your information

Only to provide the service: extracting your invoices, keeping your inventory, tracking your warranties, computing your costs, sending transactional email (team invitations and warranty alerts, for example) and providing support.

We do not show ads and we do not sell any personal information.

Automated processing

Gearboxed uses AI to read and extract the content of your invoices and to compute warranty status. It does not make decisions that produce legal or similarly significant effects about an individual based solely on automated processing: a person in your organization reviews and approves the results before they are relied on. If you have questions about this processing, write to us at support@gearboxed.ai.

Subprocessors and hosting

We rely on infrastructure providers to run the service: Google Cloud (storage, invoice text recognition and AI extraction), Vercel (hosting), Resend (transactional email) and PostHog (usage metrics). Each acts as a processor under our instructions and is bound by confidentiality obligations.

Some of these providers store or process data outside Quebec and Canada, notably in the United States. By using the service, you consent to your information being communicated outside Quebec, where it benefits from equivalent contractual protections.

We may add or change sub-processors as the service evolves. We keep this section current and, where a change materially affects how your data is handled, we give administrators reasonable notice.

Security

Data is encrypted in transit (TLS) and at rest. Secrets (access tokens, mailbox credentials) are encrypted at the application level. Data access is isolated per organization and limited by role.

In the event of a confidentiality incident presenting a risk of serious injury, we will notify the affected persons and the Commission d'accès à l'information du Québec, as required by law.

Retention and deletion

We keep your information for as long as your account is active, then for the time needed to meet our legal obligations. At your organization's request, we delete its data within 30 days.

Disconnecting a Gmail connection immediately stops any new access to the mailbox. Already extracted invoices remain in your account, since they are part of your shop records; your organization can request their deletion at any time.

Your rights

In accordance with applicable Quebec and Canadian laws, you may request access to your personal information, its correction, its deletion or its portability, and you may withdraw your consent at any time. Write to us at support@gearboxed.ai and we will follow up promptly.

You may also file a complaint with the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.

Cookies

We use essential cookies for sign-in and your preferences (such as language), plus PostHog to measure product usage. No advertising cookies, no third-party marketing tracking. You can limit cookies in your browser settings; essential cookies are required for the service to work.

Changes

If this policy changes materially, we will indicate it on this page and, where appropriate, notify administrators by email. The update date appears at the top of the page.