Privacy Policy
Last updated: October 2026
Two different roles
MecánicOS processes personal data in two different roles. In Part A it acts as controller of the data of the people who use the service and of their relationship with us. In Part B it acts as processor of the data that each workshop enters about its own customers.
PART A — MecánicOS as controller
A1. Controller and contact
The controller is the provider identified in the Legal notice (trade name MecánicOS). Contact for any privacy matter: soporte@mecanicos.app.
A2. Data, purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Sign-up, account and provision of the service (including the trial) | Name, email, credentials, role, and workshop details (trade name, tax ID, address) | Performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR) |
| Subscription, invoicing and payment for the service | Billing and payment data; payment is handled by the payment provider | Contract and legal obligations (Art. 6(1)(b) and 6(1)(c)) |
| Support and communications about the service | Contact details and the content of your messages | Contract and legitimate interest (Art. 6(1)(b) and 6(1)(f)) |
| Security and abuse prevention, including anti-bot verification (Cloudflare Turnstile) | Technical logs (IP, browser, access events) and technical signals from the verification | Legitimate interest in the security of the service (Art. 6(1)(f)) |
| Error and performance monitoring | Technical error and performance data | Legitimate interest (Art. 6(1)(f)) |
| AI assistant inside the product (when you use it) | The text you write and the context the feature sends | Performance of a contract (Art. 6(1)(b)) |
| Usage analytics, advertising conversion measurement and support chat | Usage and technical data; name and email in the chat | Consent, which you can withdraw at any time (Art. 6(1)(a)) |
| Our own legal obligations (tax, responding to requests) | Whatever is required in each case | Legal obligation (Art. 6(1)(c)) |
A3. Providers and recipients
We use providers that process data on our behalf: Google (Firebase: authentication, database and files), Vercel (hosting and metrics), Cloudinary (images), Resend (service email), Anthropic (AI assistant), Sentry (errors, EU server) and Cloudflare (Turnstile). Stripe processes subscription payments. PostHog (EU server), Google Ads and Crisp are involved only with your consent. We do not sell your data.
Some providers may process data outside the European Economic Area (for example, in the US). In that case the transfer relies on an adequacy decision (such as the EU-US Data Privacy Framework if the provider is certified), on the European Commission's standard contractual clauses or on another safeguard under Chapter V GDPR.
A4. Retention
- Active or trial account: for as long as the relationship lasts.
- After cancellation: we stop using the data to provide the service and delete it within a reasonable period, unless a legal obligation requires keeping it (for example, billing data) or while it remains in our providers' backups under their own retention policies.
- Security and technical logs: for as long as needed for their purpose.
- Consents: until you withdraw them.
- Export: you can export your main data from Settings before cancelling.
A5. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent at any time, by writing to soporte@mecanicos.app. If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es).
A6. Cookies
See the Cookies to learn what is loaded and how to change your choice.
PART B — MecánicOS as processor
When a workshop enters into MecánicOS data about its customers, vehicles, orders, repairs, documents, photographs, contacts or any other business information referring to third parties, the workshop is the controller: it decides why and how that data is used. MecánicOS processes it on the workshop's behalf, only to provide the service and following its instructions.
That processing is governed by the DPA, which forms part of the Terms.
If you are a customer of a workshop and want to exercise your rights over that data, contact the workshop. If you write to us, we will forward your request to the workshop and assist it in accordance with the DPA.