Privacy Policy

1. Who we are

Autoentic LLC is a Texas-registered limited liability company. We build and operate the Autoentic vehicle paint thickness verification system, used by paint protection film (PPF) shops, dealerships, auction houses, and vehicle owners to produce tamper-evident inspection records.

For any privacy question, email [email protected]. We have not designated a formal Data Protection Officer; privacy requests are handled directly by the Autoentic team at the same address.

2. Scope

This policy covers three surfaces, which we collectively call the "Service":

• The marketing and partner site at autoentic.com
• The Autoentic Android app, used by inspectors and PPF shop technicians
• The backend API at api.autoentic.com

3. Information we collect

We collect only what we need to operate the Service. The categories below cover everything we collect across the website, the app, and the backend.

• Organization and manager information. Business name, business address, business phone number, manager email, manager role (partner or admin), and billing details for organization-level billing handled by Stripe.
• Vehicle owner information. When a vehicle owner books a service through autoentic.com, we collect contact details and billing information for the booking, processed through Stripe.
• Technician information. Self-declared first and last name and a personal mobile phone number used exclusively for SMS one-time passcodes at session submission. Technician phone numbers are visible to the PPF shop manager who employs the technician inside their organization dashboard. When a technician is invited by a partner organization, the organization may take account-affecting actions, including revoking the technician's access, viewing all of the technician's session submissions, and removing the technician from the organization.
• Authentication data. Email addresses for partner and admin login, login timestamps, and one-time passcode delivery logs.
• Probe and device data. DeFelsko PosiTector probe serial number, model, and firmware revision paired over Bluetooth, plus the Android device model, OS version, and app version.
• Vehicle data. The Vehicle Identification Number (VIN) entered manually or scanned via OCR, and decoded vehicle metadata (year, make, model, trim, body style, factory paint code).
• Measurement data. Paint thickness readings in microns per body panel, panel sequencing, raw gauge readings, and the calculated Factory Originality Confidence Score (FOCS).
• Optional VIN images. Photographs of the VIN plate uploaded for OCR. These are processed transiently and are not stored on Autoentic infrastructure.
• Location. Android FINE and COARSE location captured at session start as audit context for the inspection record. We disclose this in our Google Play Data safety section and request the runtime permission in-app.
• Bluetooth and camera permissions. Bluetooth scan and connect permissions to pair with the DeFelsko probe, and camera permission to capture VIN photos for OCR. We do not request access to the device photo library.
• Diagnostic data (Sentry). Stack traces; breadcrumbs covering Bluetooth events, API calls, and in-app navigation; device model, OS version, app version, and an app session identifier. We do not send measurement values or VIN images to Sentry.
• Server logs. Request timestamps, request paths, response codes, and user-agent strings from autoentic.com and api.autoentic.com. IP addresses are hashed before being stored in our application database. Raw IP addresses appear only in the reverse-proxy access logs maintained by Coolify and the underlying Docker log driver, where they are subject to that platform's default log rotation.
• Cookies on autoentic.com. Our complete cookie inventory: (1) better-auth.session_token — first-party, HTTP-only, session-bound, set by Better Auth on partner and admin login; (2) __cf_bm, cf_clearance, and _cfuvid— Cloudflare Turnstile bot-protection cookies set only on the Request Access form, persistent for up to 30 minutes, used solely for fraud prevention. We use Plausible Analytics for traffic measurement; Plausible does not set cookies and does not collect personal data. We use no other cookies. We do not deploy advertising or behavioral-tracking cookies in the Autoentic Android app, in api.autoentic.com, or in the partner and admin dashboard surfaces of autoentic.com. We do not respond to browser Do Not Track signals because we do not engage in cross-site behavioral tracking.

4. How we use information

• Operate the Service. Pair probes to organizations, collect measurements, generate FOCS scores, and produce certification artifacts.
• Maintain the audit trail. Location, timestamp, probe serial number, technician identity, and panel sequence form the legally significant record produced by an inspection. Inspection records are sealed with a hash chain so that any modification after submission is detectable.
• Verify identity. SMS one-time passcodes to technicians at session submission; email one-time passcodes to partner managers and admins at login.
• Detect fraud and protect data integrity. We analyze panel sequencing, device motion patterns, and inspection timing to detect anomalies indicative of fraudulent or non-compliant inspections. This processing is workplace-quality monitoring conducted on behalf of the partner organization that employs the technician, under the organization-level consent established in our Terms of Service. Motion data is not used to identify any individual biometrically. Anomaly flags trigger human review by Autoentic personnel; they do not, by themselves, suspend, terminate, or otherwise take legally significant action against any technician.
• Provide customer support. Respond to inquiries sent to [email protected].
• Bill for the Service. Invoice partners for platform usage and vehicle owners for bookings, processed through Stripe.
• Maintain reliability. Use Sentry for crash and error monitoring and review server logs for debugging and incident response.
• Comply with the law. Respond to lawful subpoenas, court orders, and regulatory requests, including, where lawfully compelled, by producing inspection records, audit-trail data, and certification-artifact metadata in response to a subpoena, court order, or other valid legal process.
• Improve the Service through aggregated insights. We may use aggregated and de-identified data — that cannot reasonably be linked to any individual, vehicle, vehicle owner, or organization — for service improvement, scoring-model development, and product analytics. Aggregated and de-identified data is not subject to the rights described in Section 10. We do not train AI or machine-learning models on identifiable user data, VIN images, or organization-specific records; model development uses only aggregated and de-identified data as described above.

5. Legal bases for processing

Autoentic is a B2B service primarily serving United States customers, but the backend runs on EU-hosted infrastructure, so EU technicians may use the Service in the field. Where European data protection law applies, we rely on:

• Performance of contract — operating the Service for partners and vehicle owners.
• Legitimate interests — maintaining the audit trail, preventing fraud, and keeping the Service reliable.
• Legal obligation — retaining records and responding to lawful requests.
• Consent — for any optional feature where you actively opt in.

We will formalize EU-specific representation, Standard Contractual Clauses across all subprocessors, and a complete GDPR rights workflow before our formal launch in the European Union.

6. Third-party processors

A subprocessor is a third-party vendor that helps us run the Service. Each vendor below receives only the data needed for its specific role.

• Hetzner. EU-based virtual private servers that host the backend, the database, the website, and our self-hosted services.
• Coolify. Self-hosted deployment platform running on Hetzner; orchestrates our Docker containers and TLS certificates.
• Cloudflare. CDN, DNS, and TLS termination for autoentic.com static assets, plus Turnstile bot protection on the public Request Access form. Sees request metadata (IP, user agent, request path) for traffic that passes through the edge.
• Twilio. Sends transactional SMS one-time passcodes to technicians for identity verification.
• Resend. Sends transactional email, including login one-time passcodes, partner approval notifications, and account messages.
• Sentry. Collects mobile and web crash reports, error events, and breadcrumbs for debugging.
• n8n. Self-hosted workflow automation that runs the VIN decode webhook end to end.
• Marketcheck. VIN-to-vehicle metadata lookup. We send only the VIN string and receive vehicle attributes back.
• Google Gemini Vision. Image OCR for VIN photos, called from inside the n8n VIN decode workflow. We use the paid Gemini API, under which Google does not use submitted content to train its models.
• Stripe. Payment processing for organization-level partner billing and for vehicle owner bookings.

When we add or change a subprocessor, we update this page. A Data Processing Addendum is available to partner organizations on request to [email protected].

7. International transfers

Our backend, database, and primary application infrastructure are hosted on Hetzner servers in Germany. autoentic.com static assets and CDN routing pass through Cloudflare's global edge network. Personal data is processed in the following jurisdictions:

• Germany— primary application infrastructure (Hetzner).
• United States— Twilio, Resend, Sentry, Stripe, Marketcheck, Google Gemini Vision, and Cloudflare.
• Ireland and other EU regions — some Resend infrastructure regions.

For transfers from the European Economic Area, the United Kingdom, or Switzerland to the United States, we rely on (a) the EU-US Data Privacy Framework, the UK Extension to the EU-US DPF, and the Swiss-US DPF certifications maintained by our subprocessors that participate in those programs (including Twilio, Resend, Sentry, Stripe, and Google), and (b) Standard Contractual Clauses with supplementary measures where DPF coverage does not apply. Autoentic LLC itself is not currently DPF-certified; we will evaluate certification before our formal EU launch.

8. Retention

Inspection records, FOCS scores, and certification-artifact metadata are designed to remain independently verifiable years after the original inspection. Buyers, sellers, lenders, insurers, auction houses, and regulators may rely on a Certification Artifact long after the partner organization that produced it has closed its account. The retention windows below reflect what is needed to keep these artifacts validatable, not a default of holding data forever.

We keep different categories of data for different periods, based on what each category is used for and what we are legally obligated to retain.

• Inspection sessions and measurement data. Retained for as long as the partner organization's account is active, and up to 7 years after account closure to support the evidentiary purpose of the FOCS certification artifact.
• Technician phone numbers. Retained while the technician is associated with an active partner organization. Deleted when the organization removes the technician or closes its account.
• Sentry crash data. 90 days.
• Server access logs. Retained at the reverse proxy according to the default Coolify and Docker log-rotation settings. We do not maintain a long-term archive of raw access logs.
• Email and SMS one-time passcode challenges. Stored on Autoentic systems for the lifetime of the challenge (typically a few minutes) and deleted on use or expiry. Delivery metadata held by Resend (email) and Twilio (SMS) is retained according to those vendors' own retention policies.
• VIN OCR images. Discarded immediately after the decode response is returned. The n8n workflow may retain images briefly in execution history for short-term troubleshooting.
• Post-termination data export. Following the closure of a partner organization's account, the organization may request a portable copy of its measurement and inspection data within 30 days of closure, in a structured, commonly used, machine-readable format. Send the request to [email protected].

9. Security

• Encryption in transit. TLS 1.2 or higher between the Android app, autoentic.com, and api.autoentic.com.
• Encryption at rest. Database backups are encrypted at rest. Each backup file is encrypted with a key derived from a master key held only by Autoentic, so the backup file is unreadable without that key. Live database volumes on Hetzner are not yet encrypted at the disk layer; full disk encryption is on our security roadmap.
• Tamper-evident inspection records. Every inspection session and panel result is sealed with a hash chain so that any modification after submission is cryptographically detectable.
• Authentication. Email and SMS one-time passcodes for human users; static API keys with per-request authentication for the backend API.
• Breach notification. If we confirm a breach affecting personal data, we will notify affected users within 72 hours of confirmation.

10. Your rights

You may request to access, correct, delete, or receive a portable copy of the personal data we hold about you, and to object to or restrict certain processing. To request deletion of your account and associated personal data, visit our Account Deletion page. For all other privacy requests, email [email protected]. Some inspection records cannot be deleted while they remain part of an active certification artifact; we will explain the constraint when it applies. You may designate an authorized agent to submit privacy requests on your behalf. We accept the agent's authority on the basis of any one of: (a) direct confirmation of authority from you to Autoentic, (b) a written power of attorney granting the agent authority under the law of your jurisdiction, or (c) any other proof prescribed by applicable privacy law. If we deny a request, we will explain the basis for the denial; where applicable state law provides an appeal right, we will also describe how to appeal that decision.

We respond to verifiable consumer requests within 45 days of receipt. If we need additional time we will inform you in writing; the response window may be extended once by up to 45 additional days. Access and data-portability requests are limited to twice within any 12-month period.

Where Autoentic processes personal data of a technician or other authorized user on behalf of a partner organization — for example, a technician's name, phone number, or session activity — Autoentic acts as a service provider under the CCPA and as a processor under GDPR-style frameworks. The partner organization is the controller of that data. If a technician submits a privacy request to Autoentic for organization-controlled data, we will direct the technician to contact their employing organization, and we will support the organization in fulfilling the request as required by applicable law.

California (CCPA / CPRA). California residents have the rights described above plus the right to know what categories of personal information we collect. Some of the information we collect — precise geolocation captured at session start and payment information processed through Stripe — is Sensitive Personal Informationunder the CPRA. Autoentic uses Sensitive Personal Information only for the purposes described in Section 4 and does not use it to infer characteristics about you. You may request that we limit the use and disclosure of Sensitive Personal Information by emailing [email protected]. Autoentic does not sell personal information and does not share it for cross-context behavioral advertising. Where you have enabled a legally recognized browser-based opt-out preference signal — such as Global Privacy Control (GPC) — we recognize and apply your preference in accordance with applicable law. GPC operates as an opt-out of the sale and sharing of personal information; because we do not sell or share, applying the signal has no operational effect, but we record the preference to confirm our practice.

Virginia (VCDPA). Virginia residents have the rights described above plus the right to opt out of profiling that produces legally significant decisions. Autoentic does not engage in such profiling.

Texas. The Texas Data Privacy and Security Act (Tex. Bus. & Com. Code Ch. 541) applies to non-small-businesses. Autoentic operates as a small business under the United States Small Business Administration size standards and is therefore presently outside the general consumer-rights regime of TDPSA Subchapter B, except that Autoentic does not engage in the sale of sensitive personal data (Tex. Bus. & Com. Code § 541.107). We honor the access, correction, deletion, and portability rights described above for Texas residents on the same terms regardless of TDPSA's threshold applicability.

Nevada. Under Nevada Revised Statutes Chapter 603A, Nevada residents have the right to opt out of the sale of personal information. Autoentic does not sell personal information; if this changes, Nevada residents may exercise the opt-out by emailing [email protected].

European Union. Until our formal EU launch, EU users may exercise the rights above via [email protected], including the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Where we use automated analysis — such as the anomaly detection described in Section 4 — affected individuals may request human review. Full GDPR rights infrastructure will be in place at launch.

11. Children

The Service is a B2B inspection tool for licensed professionals and is not directed to anyone under 13. We do not knowingly collect personal information from children under 13. If we learn we have collected such information, we will delete it promptly.

12. SMS and mobile communications

When you provide your mobile phone number during registration, we use it solely to deliver transactional SMS messages, including one-time passcodes (OTP) for identity verification. Your phone number is never shared with third parties for marketing purposes, and we do not use your number to send promotional or marketing messages. Mobile opt-in data and consent are never sold, transferred, or shared with any third party.

You may opt out of SMS messages at any time by replying STOP to any message. Opting out may limit your ability to complete verification steps within the platform. To request help, reply HELP to any message or contact [email protected]. Standard message and data rates may apply based on your carrier plan.

13. Changes to this policy

We update this page when our practices change. For material changes, we email partner administrators before the change takes effect. For minor edits we update the "Last updated" date at the top.

If Autoentic is involved in a merger, acquisition, financing, reorganization, or sale of substantially all of its assets, personal data may be transferred to the successor entity as part of that transaction. We will notify partner administrators by email before the transfer takes effect, and the successor will be bound to honor the commitments in this Privacy Policy with respect to the transferred data.

14. Contact and jurisdiction

Questions about this policy or about data we hold:

This Privacy Policy is governed by the laws of the State of Texas, USA. Any disputes will be resolved in the state or federal courts located in Texas.