Privacy Policy
This policy explains what personal data Servaro Repair collects, why, who helps us process it, how long we keep it and what rights you have.
1. Who we are
Servaro Repair is run by Maistor Zhichko Ltd., company ID (ЕИК) 208309634, registered address Leshten, Bulgaria ("we", "us").
For anything about your data, write to [hello@maistor-zhichko.com].
2. Our two roles
For your account and your use of our website, we are the controller. This covers shop owners and team members who use Servaro Repair, and visitors to our website.
For the data a repair shop keeps about its customers, the shop is the controller and we are its processor. If you are a customer of a repair shop that uses Servaro Repair (for example, you left a device, booked an appointment or signed an offer), that shop decides how your data is used. Please contact the shop first; we will help it answer your request. Our obligations to the shops are set out in section 9 of the Terms.
3. What data we collect
- Account details: your name, email address, password (stored only in a form that can't be turned back into the password), profile photo if you add one, your role and the shop you belong to, and invitations to the team.
- Shop details: name, address, phone, email, website, VAT number, logo, colours, opening hours and settings.
- Billing details (paid plans): your plan, its status and dates, and the customer and subscription references Stripe gives us. Card details are handled only by Stripe.
- Usage data: the pages you open, what you click, how fast pages load, errors, and recordings of sessions in the app in which everything typed into fields is hidden. Recordings can show what was on the screen, which may include customer details shown in the app. Usage data is linked to your user ID, role and shop, not to your name or email. Record IDs and private links are removed from web addresses before they are sent.
- Technical data: IP address, browser and device type, and server logs, which we use to keep the service secure (for example, to limit repeated sign-in attempts) and to fix errors.
- Messages to us: bug reports (your description, a screenshot if you add one, and your name, email, role and shop) and emails you send us.
- Supplier connections: if you connect an account with a parts supplier, the account's name, email and addresses, and its access keys, which are stored encrypted.
The data shops enter about their customers (names, phone numbers, email addresses, devices, unlock codes, photos, signatures, appointments, offers and payments) is processed on the shops' behalf, as described in section 2.
4. Why we use it and on what legal basis
- Providing the service and your account, including service emails such as email confirmation, invitations, billing notices and important changes: to perform our contract with you (GDPR Article 6(1)(b)).
- Billing, accounting and tax: to perform the contract and to meet our legal obligations (Article 6(1)(c)).
- Security, preventing abuse and fixing errors: our legitimate interest in a safe and working service (Article 6(1)(f)).
- Usage analytics to improve the service: our legitimate interest in understanding how the service is used (Article 6(1)(f)). Analytics cookies are stored on your device only with your consent (Article 6(1)(a)).
- Answering your messages and bug reports: our legitimate interest in supporting our users (Article 6(1)(f)).
We don't sell personal data, don't use it for advertising and don't make decisions about you based only on automated processing.
5. Who processes the data for us
We use these providers (sub-processors). Each one receives only what it needs for its task and is bound by a data processing agreement:
- Vercel Inc. (USA): hosts the app on servers in Frankfurt, Germany; stores files such as ticket photos, signatures, intake receipts, offers and logos; and counts website visits without cookies.
- Prisma Inc. (Frankfurt): the database in which all the data in the app is stored.
- SMTP2GO (New Zealand): sends emails, both ours and the ones shops send to their customers.
- PostHog (servers in the EU, in Frankfurt): usage analytics, session recordings, error reports and server logs. Used only in the staff part of the app and on our website, never on customer pages or the booking widget.
Other recipients:
- Stripe sells our paid plans as the merchant of record and takes the payments. For payment data Stripe is a separate controller, under its own privacy policy.
- Suppliers you connect receive what is needed for searches and orders.
- Authorities, when the law requires it; our accountants and lawyers, who are bound to confidentiality; and a buyer or successor, if our business is sold or reorganised.
6. Transfers outside the EU
We keep data in the EU wherever we can. Vercel and Stripe are US companies, and PostHog is part of a US group even though our analytics are hosted in the EU, so data may be accessed from the USA, for example for support. These transfers are based on the EU–US Data Privacy Framework where the company is certified, or on the European Commission's standard contractual clauses. New Zealand, where SMTP2GO is based, is recognised by the European Commission as protecting personal data adequately.
7. How long we keep data
- Account and shop data: while the account exists. A shop that has become read-only is kept for 12 months, and its administrators are emailed 30 days and 7 days before it is deleted. If you ask us to close your account, we delete the data sooner.
- Unlock codes: erased automatically when the device is picked up.
- Links for confirming an email address or signing on a phone: expire after a short time.
- Usage analytics: up to 12 months; session recordings up to 30 days.
- Server logs: up to 30 days.
- Billing and accounting records: as long as accounting and tax laws require, in Bulgaria up to 10 years.
- Bug reports and emails: as long as needed to deal with them, and no longer than 2 years.
9. How we protect data
- All connections are encrypted (HTTPS).
- Passwords are stored in a form that can't be turned back into the password. Unlock codes and supplier access keys are encrypted.
- Ticket photos, signatures and documents are kept in private storage and shown only to the team of the shop they belong to.
- Each team member sees only what their role allows.
- Only the few people who run the service can reach the systems, and only when needed.
10. Your rights
You have the right to:
- get a copy of your data and information about how it is used;
- have incorrect data corrected;
- have your data deleted, or its use restricted;
- receive your data in a common machine-readable format and pass it on (data portability);
- object to processing based on our legitimate interest, including usage analytics;
- withdraw your consent at any time, without affecting what was done before.
Write to [hello@maistor-zhichko.com]. We reply within one month. We may ask you to confirm who you are.
You can also complain to the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg, or to the data protection authority in the country where you live or work.
11. Children
The service is for businesses and is not meant for anyone under 18. Repair shops may keep data about customers who are minors; in that case the shop is responsible for it as the controller.
12. Changes to this policy
We may update this policy. The date at the top shows when it was last changed. We tell shop administrators about important changes by email or in the app.
13. Contact
Maistor Zhichko Ltd., Leshten, Bulgaria. Email: [hello@maistor-zhichko.com].