Lugvento Privacy Policy

Last updated November 6, 2026.

Lugvento LLC ("Lugvento", "we") makes shop management software for vehicle repair businesses ("Shops"). This policy explains what personal information we handle, why, who sees it, and your choices. It covers lugvento.com, the Lugvento app, and the pages Shops' customers open from links.

Two different roles

When we act for a Shop. Shops use Lugvento to keep records about their customers and staff. The Shop decides what goes in and why, and we handle it on the Shop's behalf under our Data Processing Addendum. If you are a repair shop's customer, that shop is your first contact about your information. If you contact us, we pass your request to the shop and help it answer.

When we act for ourselves. We decide how to handle information about Shop owners and staff who hold accounts, people who apply for the pilot, visitors to lugvento.com, and anyone who contacts us.

What we collect

People who apply for the pilot or sign up: name, email, phone, shop name, city and state, how the shop works, the plan chosen, and whether a card is on file. It comes from you.
Shop owners and staff: name, email or username, role, sign-in and device records, time punches, work recorded under your login, certificates you upload (such as EPA 609), and support requests you send. It comes from you or your Shop.
A Shop's customers: name, phone, email, billing and service addresses, vehicles, VIN, plate, mileage, repair history, estimates, invoices, payments recorded, photos, typed names and drawn signatures approving work or acknowledging a walk-around, appointment requests, and tax-exemption certificates. It comes from the Shop, or from you when you answer an estimate, sign a walk-around, request an appointment or pay an invoice.
Payments: Stripe's reference ids, payment status, the last four digits and expiry that Stripe reports for a saved card, and the dated agreement to keep a card on file. Card numbers go to Stripe, never to us. It comes from Stripe and you.
Technical: browser and device type, the app version, crash reports (the error, the screen, and shop and staff ids, not names), a one-way hash of the network address on public forms to stop flooding, notification addresses, and details of VIN barcode scans (camera and timing, never the picture). It comes from your device.

We don't use the phone's location, advertising trackers or third-party analytics. The app keeps your sign-in, recently opened records and work waiting to be sent on your device so it works with no signal; signing out removes them. The sign-up, sign-in and password pages use Cloudflare's bot check, which sees your network address and browser details.

Why we use it

To provide the Service: run the app, send the emails and notifications a Shop asks for, and take payments.
To manage accounts, billing and tax.
To support Shops, including help importing their old records when they ask.
To keep the Service secure, stop abuse and fix faults.
To improve the Service, using information that doesn't identify anyone.
To follow the law and protect our rights.

Who we share it with

We do not sell personal information or share it for advertising. We share it only as follows.

Supabase runs our database, sign-in, file storage and server functions, in Amazon's US East (Northern Virginia) region. It holds everything stored in the Service.
Stripe handles Lugvento's subscriptions, and each Shop's own customer payments. It sees card details, amounts, billing addresses and email addresses.
Resend sends our email. It sees the address and the email's contents.
Cloudflare hosts the website, and checks for bots on sign-up and sign-in. It sees your network address and browser details.
Sentry receives crash reports: the error, the screen, and shop and staff ids.
NHTSA (US government) decodes VINs. It gets the VIN, sent straight from the phone.
Apple, Google and Mozilla push services deliver notifications. They see the notification's contents.
GitHub runs our scheduled jobs, such as reminders and reports, and shop setup. It sees a shop owner's name and email when we set up a shop for them.
Anthropic powers optional AI helpers, only if turned on: the in-app assistant, import help, reading a VIN or vendor invoice from a photo. It sees the question, photo or rows sent to it.

We may also share information to follow the law, to protect people or our rights, or as part of a sale or merger of the business, under this policy. Inside a Shop, each person sees what their role allows, and the Shop's owner controls that. Shops can't see each other's data.

How long we keep it

We keep Shop records while the Shop has an account. After a Shop leaves, it has 30 days to export its data; we delete the data within 90 days after that, and it leaves our backups as they expire, currently within 7 days. We keep billing and tax records as long as the law requires. A pilot application that isn't accepted is deleted after 12 months. Crash reports are kept for 90 days.

Security

Data is encrypted in transit and at rest, and stored with our service providers in the United States. Database rules keep each Shop's data apart, and automated tests check them on every change. Each person's access depends on their role; owners can require two-step sign-in and choose how long devices stay signed in; each login works on one device at a time. Photos and documents open through links that expire. No system is perfectly secure. If a breach affects your information, we will tell the Shop or you as the law requires.

Your choices and rights

Depending on where you live, including in Connecticut, you may have the right to confirm whether we hold personal information about you, to see, correct or delete it, to get a copy, and to opt out of sale, targeted advertising and profiling. We do none of those three.

Customers of a repair shop: ask the shop first. It holds your records, and we act on its instructions. If you contact us, we pass your request on.
Everyone else: email [email protected]. We may need to confirm who you are. We answer within 45 days. If we say no, you may appeal by replying, and we answer within 60 days; if you're still not satisfied, you may contact the Connecticut Attorney General. We won't treat you differently for asking.
Email: messages about your account, invoices and the work you asked for are part of the Service. We don't send marketing email today; if we ever do, every message will carry an unsubscribe link.

Children

Lugvento is for businesses and isn't meant for anyone under 18. We don't knowingly collect information from them.

Where data is handled

Lugvento is run from the United States and stores data there. We don't offer the Service outside the United States.

Changes

We will post changes here and update the date above. For a material change, we'll tell account owners by email or in the app before it takes effect.

Contact

Lugvento LLC, 3750 Mountain Rd, West Suffield, CT 06093, [email protected].