A subprocessor is a company that Andrew Bertran, doing business as Auto Shop App ("we"), engages to process personal information on our behalf in providing Auto Shop App. We give shops at least 30 days' notice before adding one that processes Shop Personal Information. How we handle personal information is described in our Privacy Policy.
| Subprocessor | Purpose | Data it processes | Location | Contract terms we rely on |
|---|---|---|---|---|
| Amazon Web Services, Inc. | Hosting: application servers (ECS Fargate), database (RDS PostgreSQL), photo and document storage (S3), logs (CloudWatch), secrets (Secrets Manager), content delivery (CloudFront), DNS (Route 53) | All Shop Data and Account Data | United States: us-west-2 (Oregon) for the application, database and files; us-east-1 (N. Virginia) for the website, the web application's static files, and content delivery | AWS Customer Agreement; the AWS Data Processing Addendum and the AWS CCPA Terms, incorporated into the AWS Service Terms |
| Amazon Web Services, Inc.: Amazon SES | Sending email (staff invitations, password resets, and the messages a shop sends its customers by email), bounce and complaint handling; receiving email addressed to @autoshopapp.com | Recipient address, message content, delivery events | United States: us-east-1 | As above |
| Twilio Inc. | Sending and receiving the text messages a shop sends its customers; delivery reports; STOP/HELP handling | Customer mobile number, message content, delivery status, opt-out events; the shop's business details for carrier registration | United States | Twilio Terms of Service with the Twilio Data Protection Addendum |
Status: email through Amazon SES is on. Texting through Twilio is built and is not yet switched on; it will be switched on once carrier registration clears.
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Stripe, Inc. | Billing shops for their Auto Shop App subscription: hosted checkout, card storage, invoices, the hosted billing portal | Billing contact's name and email, shop name, plan, and card details entered on Stripe's own page. Card numbers never reach our servers. | United States |
| Google LLC (Gmail) | Mail sent to info@autoshopapp.com and other addresses at the domain is received by Amazon SES and forwarded to our Gmail mailbox | Whatever a sender writes, which can include personal information a shop or a member of the public emails to us | Google's data centres; Google does not commit to a storage location for Gmail |
Amazon Web Services, Twilio and Stripe process personal information for us under the data processing terms listed above. Our Gmail mailbox is held under Google's standard terms, without a separate data processing agreement, so please do not email us a shop's customer records.
These are listed so nobody has to guess.
| Service | Why it is not on the lists above |
|---|---|
| Square (Block, Inc.) | The shop's own payment processor, under the shop's own contract with Square. When a shop connects its Square account, we send Square the invoice amount and reference so Square can take the payment; the customer enters card details on Square's page or terminal; money settles to the shop. |
| Stripe, as a shop's payment processor | The shop's own Stripe account, under the shop's own contract with Stripe. When a shop connects its Stripe account, we ask Stripe to open a payment page for the invoice; the customer enters card details on Stripe's page; money settles to the shop. This is separate from Stripe billing shops for their subscription, listed above. |
| CCC Intelligent Solutions | The shop's own estimating system. Where a shop chooses, it exports an estimate from CCC ONE and imports the file into Auto Shop App. We have no connection to CCC. |
| ADP and other payroll providers | We produce a file the shop downloads and uploads to its own provider. We send ADP nothing. |
| GitHub, Inc. | Hosts our source code and runs our build and test pipeline. No Shop Data is stored there: tests run against synthetic fixtures. Deploys use short-lived federated AWS credentials; no AWS access keys are stored there. |
| Google Fonts | The marketing site autoshopapp.com loads its fonts from Google, which receives visitors' IP addresses and browser details. The staff web application does not. No shop data is involved. |
| Anthropic, OpenAI or any other AI model provider | Not used. Automotive Intelligence drafting runs on our own servers. A third-party model provider will be added to the list above, with notice, before any Shop Data is sent to one. |
| Error monitoring services such as Sentry | Not enabled. Would be added here, with notice, before being switched on. |
Questions about this list: email info@autoshopapp.com.