Autoovy · Privacy policy

Autoovy handles two categories of data that are not subject to the same rules. Confusing them would be the first mistake in this document.

Collected at sign-up and during use of the service, to identify you, bill the subscription and provide support.

This is your professional data. We store it so the software can operate, and we access it only at your request — an incident, a support question — or when a legal obligation requires us to.

• Your customers — name, legal name, address, phone, email, SIRET, VAT number, and the notes you write about them.
• Your commercial documents — quotes, invoices, credit notes, payments, delivery notes, repair orders, till receipts.
• Your vehicles and jobs — see the next section.
• Your attachments — photos, signed documents, exports.

A registration number indirectly identifies a person: it should be treated separately, not buried in a list.

Autoovy stores the plates and VIN numbers you record, and links them to your customer records and their jobs. Plate search queries a vehicle identification service to retrieve technical characteristics and compatible parts.

That query does not transmit your customer’s identity: only the vehicle identifier is sent. The technical parts catalogue we consult receives no personal data — only vehicle and part references.

The three months after termination exist for a precise reason: a termination may be accidental, an unpaid invoice may be settled, and a return to activity should not hit an irreversible deletion. After that period, deletion is final. You can export your data at any time, including during this period.

We use providers for functions we do not perform ourselves. Each accesses only what its function requires, and none is authorised to use this data for its own purposes.

Transfers to Stripe and Google outside the European Union rely on the European Commission’s standard contractual clauses. We sell no data, and we transmit none to any broker; Google receives only the measurement of our own ads, and only with your consent.

Autoovy’s application servers and database are hosted in France, with OVHcloud. Documents and attachments are also stored in France, in Amazon Web Services region eu-west-3.

Database backups remain in the same geographic zone as the original data.

• Encryption in transit — all exchanges with the service go through HTTPS.
• Isolation between customers — each request checks that the data belongs to your company before responding. A resource that is not yours is treated as non-existent, including in error messages: nothing reveals that it exists.
• Passwords — never stored in plaintext, nor readable by our team. The response to a login attempt never distinguishes an unknown email from a wrong password, so accounts cannot be enumerated.
• Two-factor authentication — available on every account.
• Third-party secrets encrypted at rest — credentials for your technical data and e-invoicing providers are encrypted in the database, with distinct keys per domain.
• Restricted internal access — access to production data is limited to people who need it for operations, and is logged.

On the Autoovy application, only the cookies required for it to operate are set: those that keep your session open and secure authentication. Because these cookies are essential to the service, refusing them would mean you cannot sign in.

On the autoovy.com website, and only if you accept advertising cookies in the consent banner, we use the Google tag (Google Ads) to measure how well our ads perform, for example a click on “Try for free” after an ad. It sets _gcl_* cookies (including _gcl_au), kept for 3 months. If you refuse, none of these cookies is set and the tag is not loaded. You can change your mind at any time with the “Manage cookies” link at the bottom of the page.

Over your account data, for which we are the controller, you have rights of access, rectification, erasure, restriction, objection and portability.

Much of this can be exercised directly in the software: you correct your information, manage your users and export your data without contacting us. For the rest, write to contact@autoovy.com. We reply within one month, and we may ask you to prove your identity if there is reasonable doubt.

If the data concerns our customers’ customers, contact the company that entered it: it is accountable. We will relay the request if you write to us by mistake.

You may also lodge a complaint with the Commission nationale de l’informatique et des libertés — 3 place de Fontenoy, 75007 Paris.

Autoovy evolves, and this document with it. Any substantial change — a new purpose, a new provider, a longer retention period — will be notified by email or in the software before it takes effect.

The last-update date appears below. Previous versions remain available on request.