The Pitlane Privacy Promise
These are our own promises, not a checklist someone made us write. They apply to everyone whose data we touch, wherever you live.
These rights belong to everyone whose data we handle. How you use them depends on whose data it is:
Ask us what we hold about you and how we use it. Shop owners can also pull a full copy from account settings anytime.
Fix anything that is wrong. Shops can edit records directly in the product. For our own account or marketing data, email us and we will correct it.
Shop owners can download the whole workspace as CSV files from Settings, in one click, in a format you can carry to another tool. For data we hold as controller, email us for a copy.
Shop owners can close the account themselves, which removes the organization's records from our database right away. Shops can also delete an individual contact. Ask us to remove anything else we control.
Stop marketing messages whenever you want. Reply STOP to any text, or use the one-click unsubscribe in any marketing email. Both take effect immediately.
Change your mind about texts or marketing email at any time using STOP or unsubscribe, or email us and we will handle it.
Some of these are self-serve in the product today. Where a request needs a hand, a person handles it over email, and we aim to respond within 30 days. We do not charge for this, and we will not treat you differently for asking.
Pitlane ("we," "our," or "us") is a cloud platform for independent auto repair shops, operated by Auto Shift Media LLC, an Ohio limited liability company. This policy explains what information we handle, how we use it, who we share it with, and the choices you have. Reach us anytime at support@usepitlane.com. This policy is part of our Terms of Service.
We handle data in two different roles, and your rights depend on which one applies:
Here is the full picture, category by category. For most records, "how long" comes down to a simple rule: we keep it while your account is active and remove it when you delete the record or close the account.
We do not sell your personal information, we do not share it for cross-site or targeted advertising, and we do not use your business data, your customer data, or your AI prompts to train any AI model.
We do not sell your data. We share it only as needed to run the platform, and only with vetted providers, each bound to protect what they handle:
The full table, with the exact data each provider handles and where, is on our Sub-processors page. Every provider processes data in the United States. Before we add or replace a provider that handles customer data, we post the change there and give notice by email or in the app. We may also disclose information if required by law or legal process, in connection with a merger or sale of the business, or to protect the rights, property, or safety of Pitlane, our users, or the public.
When a Pitlane-using shop collects your phone number (given to the shop in person at the time of service, after the shop asks and you agree) and texts you through the platform, extra protections apply. The full opt-in disclosure, sample messages, frequency, and opt-out instructions are at usepitlane.com/sms.
PitCrew uses large language models from Anthropic (Claude) to draft suggested text. The same provider powers our public website-audit tool. When you trigger an AI action, the following may be sent to Anthropic over an encrypted connection:
We do not deliberately send structured fields like full customer phone numbers, mailing addresses, email addresses, or payment identifiers, and we do not send full contact lists or unrelated business data. Because some fields are free text (a typed concern, a note, a review), it is possible for something you type there to be included. Do not enter data you would not want processed by our AI provider.
Under Anthropic's commercial terms, data sent through its API is not used to train Anthropic's models. Pitlane does not store the content of your prompts or PitCrew's responses; we keep only token-count metadata for metering and abuse prevention. You can turn off the optional morning briefing in settings, and on-demand suggestions run only when you or your staff trigger them, so if you do not use those features, nothing is sent for them. Our public demo returns canned responses and does not call the AI provider.
We keep your data while your account is active. Message text, contacts, vehicles, and service records stay until you delete them or close your account, except where we must keep something longer to meet a legal obligation, resolve a dispute, or enforce our agreements. The category list above notes the two operational logs that purge on their own schedules (pageview records within 180 days, internal app-event logs within 60 days).
Account owners can delete the account anytime from settings. Deletion removes your organization's records from our primary database right away, through a type-to-confirm flow, with no grace period. Some copies may persist briefly in encrypted backups and in our providers' delivery logs (for example Stripe billing records and Twilio or Resend message logs) until their routine purges complete; those are kept under each provider's own schedule. If you want us to remove any remaining copies we control, email us and we will handle it. We may keep anonymized, aggregated metrics that do not identify anyone.
We use a range of safeguards: TLS/HTTPS encryption in transit (enforced with HSTS), a strict nonce-based Content Security Policy, rate limiting on sensitive endpoints, signature checks on third-party webhooks (Stripe and Twilio), and AES-256-GCM encryption at rest for sensitive credentials such as per-shop SMS tokens. Each shop's data is isolated: the application automatically scopes every query to your organization, backed by deny-all database rules against anonymous access as a second layer. Sign-in, sessions, and password handling are provided by our authentication provider. Tax identifiers submitted for SMS registration are sent to Twilio but not stored in our database. Pitlane runs on infrastructure that follows recognized security standards; we are not ourselves independently audited or certified against one. No system is perfectly secure, but we take reasonable precautions and review our posture regularly. More detail is on our Security page.
Essential cookies. We set cookies to keep you signed in, remember your active shop, and protect against cross-site request forgery. These are required for the platform to work.
Analytics. We use Vercel Analytics and Speed Insights for aggregate web-vitals reporting (cookieless), and a first-party pageview measurement that records the page path, external referrer, coarse location (country, region, city), device type, and a daily-rotating hashed visitor identifier, not a raw IP. We also load Google Analytics to understand traffic; Google Analytics sets first-party cookies. We run no advertising, retargeting, or cross-site tracking, and we opt out of Google's interest-cohort tracking.
Global Privacy Control. If your browser sends a Sec-GPC: 1 signal (automatic in some browsers, an extension in others), we do not load Google Analytics for your visit. It is honored on the server, not just described here. Our cookieless first-party measurement still runs.
No cookie banner. We do not show a cookie consent popup. We set only the essential cookies the platform needs plus first-party analytics cookies, we honor Global Privacy Control, and we run no advertising or cross-site tracking. You can also opt out of Google Analytics with the official opt-out browser add-on or your browser's tracking-protection settings.
Pitlane is operated from the United States and stores and processes data on infrastructure in the United States. If you use the Service from another country, your information is transferred to and processed in the United States, where data-protection rules may differ from your own. We do not move your data outside the United States; if that ever changes, we will update this policy and the platform together.
If we confirm a security breach that affects your personal information, we investigate right away and notify affected users without undue delay and within 72 hours of confirming a breach that affects their data. This is our own commitment. Where Pitlane acts as a processor for a shop, we notify the shop so it can tell its own customers, and we support the shop in doing so.
Pitlane is a business tool. It is not directed to children and is not intended for anyone under 16. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will remove it.
Our public demo uses shared credentials and is for evaluation only. Anything you enter may be visible to other demo visitors and may be reset or deleted at any time. Outbound actions (messages, AI calls, payments) are stubbed in the demo and do not reach real customers. Do not enter real customer information, payment details, or anything confidential into the demo.
We may update this policy over time. We will post the updated policy with a new "Last updated" date and, for significant changes, tell you by email or with a notice in the platform. Continued use after changes take effect means you accept the updated policy.
Questions, or want to use a right above? Email Auto Shift Media LLC, an Ohio limited liability company operating Pitlane, at support@usepitlane.com. A person reads every message.
Last updated: July 28, 2026
Terms of Service · Data Processing Terms · Sub-processors · Back to Pitlane