Privacy Policy
This policy explains how the operator of Workshop Story ("Workshop Story", "we", "us") handles personal information. We handle it in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).
1. Two kinds of information
Account information is about the people who use Workshop Story: the business name, and each staff member's name, email address and password. We decide how this is used, as described below.
Workshop records are what a workshop or dealership enters about its jobs: invoice or repair order numbers, vehicle registration and details, job lines, technicians' names and notes, invoice wording, findings and follow-up notes. Workshop Story does not ask for customers' phone numbers or addresses, and workshops should not type them into notes. The one place it asks for a customer's surname is the Collection board, described below. We hold and process these records on the workshop's behalf, only to provide the service.
2. What we collect and why
- Account information, to create and secure logins and to contact account owners about the service.
- Workshop records, to produce invoice wording, gradings, service checklists and follow-up lists for that workshop.
- Technical information such as the internet address used to sign in, to keep accounts secure and to limit misuse.
- Payment details are collected and held by our payment provider when a subscription is taken out. We do not store card numbers.
We do not sell personal information and we do not use workshop records for advertising.
3. Who can see workshop records
Each workshop's records are visible only to the logins on that workshop's account. A small number of our own staff can access records when that is needed to keep the service running, fix a fault or answer a support request.
4. Other companies that process information for us
| Purpose | Provider | Where |
|---|---|---|
| Hosting the application and database | Fly.io | Sydney, Australia |
| Preparing draft wording and service checklists from the notes and vehicle details entered | Anthropic | United States |
| Card payments, when a subscription is taken out | Stripe | United States and Australia |
| Sending account emails such as password resets | Resend | United States |
| Backup copies of the database | Microsoft OneDrive | Australia and overseas |
The vehicle details, job lines and technicians' notes for a job are sent to the wording provider, with each technician's name so their notes can be told apart. Because Workshop Story does not collect customers' names or contact details, none are sent, provided workshops keep them out of the notes.
The Warranty helper keeps what is entered for a warranty claim: the repair order number, the vehicle's make, model, VIN and odometer reading, the technician's description and answers, the name of the person who entered them, and the photos, videos and printouts attached as evidence. It also keeps the manufacturer documents an account uploads, such as warranty manuals and code lists. When a claim's evidence list is built or the claim is prepared, the typed details of that claim and the text of the few document pages that match it are sent to the wording provider. Photos attached as the VIN, the odometer or the part number label are also sent to it, so they can be read back and checked; other photos are not. Photos can show number plates and anything else in frame, so keep people and customers' belongings out of them. An account is responsible for having the right to upload the documents it adds.
The Collection board keeps, for each repair order, the repair order number, the customer's surname, the day and time they are collecting the vehicle, the work being done, any short note, and the name of the staff member who made each change. It is seen only by that account's owner, service advisers and workshop controllers; a technician sees only the collection time of the RO they have open. It is never sent to the wording provider. An entry is deleted, with the surname, 30 days after it is marked collected or taken off.
The wording library keeps, for each account, the routine sentences and fault descriptions its stories have used, with the technician's shorthand they came from. Unless the owner switches sharing off under Account, those that contain no figure are also added to a library shared by every account that shares, recorded against the account that added them but shown to others without any account name. Wording offered while typing is kept the same way. The library never holds repair order numbers, vehicles, registrations, customers' details or prices.
The team chat keeps each message, who wrote it and when, who a task was passed to, and who ticked it off. Everyone with a login on the account can read it. Messages are deleted after 30 days; a task is kept until 30 days after it is ticked off. Chat is never sent to the wording provider. Keep customers' contact details out of it.
Workshop Story keeps an activity record for each account: the name of the person, the repair order number, what they did (for example sent a story, priced parts, lodged a claim, removed a login) and when. The account owner can read it. If the owner leaves email alerts switched on, emails about waiting claims, lodging dates, parts ready to be thrown away and the week's figures are sent to the email addresses of that account's own staff. The fonts and scripts the site uses are served by Workshop Story itself, so opening it does not contact any other company.
Because some of these providers are overseas, information may be processed outside Australia. We take reasonable steps to make sure it is handled consistently with the Australian Privacy Principles.
5. How we protect information
- Connections to Workshop Story are encrypted.
- The database is stored on an encrypted disk and is backed up daily.
- Passwords are stored in a scrambled form that cannot be read back.
- Staff logins can be limited to the access each person needs. Technicians' QR codes open only their own notes screen and can be cancelled at any time.
No system is perfectly secure. If a data breach is likely to cause serious harm, we will notify the affected account owners and the Office of the Australian Information Commissioner as the law requires.
6. How long we keep information
Workshop records are kept while the account is open so the workshop's job history and follow-up list remain available. An account owner can download the records at any time and can ask us to delete them when the account is closed. Backup copies are overwritten on a rolling basis.
7. Access, correction and complaints
- Account holders can see and correct their own details from within the application, or by contacting us.
- If you are a customer of a workshop that uses Workshop Story, contact that workshop first. It decides what is recorded about you and can correct or remove it. We will help the workshop respond.
- If you have a complaint about how we have handled personal information, contact us and we will respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
8. Changes to this policy
We may update this policy. The date at the top shows the latest version, and we will tell account owners about significant changes.
9. Contact
Privacy questions and requests can be sent to the contact details published on workshopstory.com.