Privacy Policy

Last updated: 1 November 2026

AutoFlow ("we", "us") provides booking and customer-management software for auto-service businesses ("workshops"). This policy explains what information we collect, how we use it, and your choices. It applies to the AutoFlow app and website operated by AutoFlow ABN 73 291 530 072 (hello@auto-flow.com.au).

Information we collect

• Workshop account data: the name, email and password of the mechanic/staff who create an account.
• Customer booking data (entered by customers on a workshop's booking page, or by the workshop): name, phone number, email, vehicle details (make, model, year, rego, odometer) and the service/issue description.
• Messages & calls: SMS and email sent or received through the app, and voice-call recordings/transcripts where a workshop enables that feature.
• Team & payroll data (only if a workshop uses the team features): team members' names, emails and phone numbers; rosters and time off; clock-on, clock-off and break times; job timer logs; hourly labour costs set by the owner; and payslip details (pay, tax withheld, deductions, superannuation and super fund name). The workshop, as the employer, decides what is recorded.
• Usage & device data: basic technical logs and, on the mobile app, a push-notification token so we can send booking alerts.

How we use it

• To create and manage bookings, quotes and invoices.
• To send appointment confirmations, reminders and review requests by SMS/email.
• To send push notifications about new bookings (mobile app only).
• To run rosters, timesheets and payslips for a workshop's team, and to let the workshop's owner and managers know about things like someone clocking on without a rostered shift.
• To provide, secure, and improve the service.

Service providers

We share data only with providers that help us run the service:

• Vercel (application hosting) and Neon (database).
• Twilio (SMS/voice), Resend (email delivery), Google (Calendar sync and Business Profile reviews), Stripe (payments/subscriptions), and Anthropic (AI summaries of phone-call voicemail transcripts where a workshop enables that, and the in-app help assistant).

AI is used for two things only: summarising phone-call voicemail transcripts, and answering questions in the in-app help assistant, which sees only the question typed into it, the name of the screen it was asked from, and AutoFlow's own help guide. We do not send Google user data to any AI/ML service, and no Google user data is ever used to develop, train, or improve AI/ML models. Our AI provider (Anthropic) does not train its models on data submitted through its API.

Some of these providers store or process data overseas (primarily in the United States). By using the Service you consent to this overseas disclosure. We take reasonable steps to ensure they handle personal information consistently with the Australian Privacy Principles.

We do not sell personal information.

Google Calendar access

When a workshop connects its Google account, AutoFlow requests permission to manage Google Calendar events (the calendar.events scope) and to read the account's email address (so we can show which account is connected). We use this access only to:

• add a calendar event when a booking is made, and update or remove it when the booking is changed or cancelled; and
• read your calendar's free/busy times so AutoFlow can avoid double-booking.

AutoFlow's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google Calendar data for advertising, we do not sell it, and we do not transfer it to others except as needed to provide the calendar feature or as required by law. We do not transfer Google user data to any artificial-intelligence or machine-learning service, and we never use it to develop, train, or improve AI/ML models. We do not allow humans to read your Google Calendar data unless you give explicit consent, it is necessary for security or to comply with the law, or the data has been aggregated and anonymised. You can disconnect Google at any time in Settings, which immediately stops all further access.

Google Business Profile access

When a workshop owner connects their Google Business Profile, AutoFlow requests permission to manage the business listings on that Google account (the business.manage scope) and to read the account's email address (so we can show which account is connected). We use this access only to:

• list the Business Profile locations the account manages, so the owner can choose their workshop;
• show that location's Google reviews on the workshop's Reviews page in AutoFlow: the reviewer's name as shown on Google, the star rating, the review text, its date and any reply; and
• post, change or remove the workshop's own reply to a review, only when the workshop's owner or a manager writes or clears that reply in AutoFlow.

AutoFlow never changes the listing itself (such as its name, address, phone number, opening hours or photos), never posts or removes reviews, never replies automatically, and reads nothing else from the Google account. The reviews are shown only to the workshop's owner and managers in AutoFlow.

AutoFlow's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google Business Profile data for advertising, we do not sell it, and we do not transfer it to others except as needed to provide the reviews feature or as required by law. We do not transfer it to any artificial-intelligence or machine-learning service, and we never use it to develop, train, or improve AI/ML models. AutoFlow staff do not read it unless the workshop asks us to (for example, for help setting up or fixing the connection), it is necessary for security or to comply with the law, or the data has been aggregated and anonymised.

Alongside the reviews we keep the connected Google account's email address, the chosen location's name and the access token Google issues (encrypted). Reviews and the location's name are refreshed from Google every day. Anything that can't be refreshed within 30 days (for example because access was removed in the Google account) is deleted from AutoFlow, and disconnecting the Business Profile on the Reviews page deletes the workshop's Google reviews from AutoFlow straight away and stops all further access. Nothing changes on Google itself. You can also remove AutoFlow's access at any time at myaccount.google.com/permissions.

Data retention

We keep booking and customer records for as long as a workshop's account is active, or as needed to comply with legal obligations. You can request deletion (see below).

Team, timesheet and payslip records are kept while the workshop's account is active and are deleted when the account is closed. Australian employers must keep employee time and wages records for 7 years, so workshops can download them at any time (Settings → Team → Download employee records) and should keep their own copies.

Your choices & rights

Depending on your location, you may have rights to access, correct, or delete your personal information, or to object to certain processing. To make a request, contact us at hello@auto-flow.com.au. Customers should note that their information is controlled by the workshop they booked with; we act as a processor on the workshop's behalf.

If you're a workshop's customer and want a copy of your information, ask the workshop: they can download your main records (your details, cars, bookings, invoices, quotes, messages and call summaries) from your customer page in AutoFlow and send it to you. You can also ask them for anything else they hold about you, such as call recordings, photos or their notes. If they can't help, contact us and we'll work with them on it.

Security

Data is transmitted over HTTPS and stored with access controls. No system is perfectly secure, but we take reasonable measures to protect your information.

If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

Complaints

If you believe we have mishandled your personal information, contact us at hello@auto-flow.com.au and we will investigate and respond. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Children

AutoFlow is not directed to children under 16 and we do not knowingly collect their data.

Changes

We may update this policy; material changes will be reflected by the "Last updated" date above.

Contact

AutoFlow — hello@auto-flow.com.au