Privacy Policy

Garage Ghost Ltd ('we', 'us', 'our') is committed to protecting the privacy of our website visitors, customers, and individuals whose calls are handled through our precision garage intake services.

This Privacy Policy explains how we collect, process, and retain personal data in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and relevant platform policies.

Garage Ghost Ltd is registered with the Information Commissioner's Office (ICO) under reference ZC199049. Company Number 17140314. Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

We collect only what is strictly necessary to answer workshop telephone calls and schedule appointments: caller name, contact telephone number, vehicle registration number, and described mechanical or service requirements.

When garage owners apply for a trial or create an account, we collect garage name, contact name, workshop telephone, email address, postcode, opening hours, and capacity limits.

When a garage connects a Google account, we access calendar event information strictly to coordinate workshop appointments as detailed below.

Garage Ghost offers an optional integration with Google Calendar to synchronize workshop bookings. When you authorize Garage Ghost to connect to your Google account, our application accesses Google API data under the scopes https://www.googleapis.com/auth/calendar.events and https://www.googleapis.com/auth/calendar.readonly.

Data Accessed: We access calendar identifiers, event titles, descriptions, scheduled start and end times, and event status from your connected Google Calendar.

Purpose of Processing: We process this data solely to: (1) synchronize confirmed workshop appointments between Garage Ghost and your Google Calendar; (2) detect existing diary commitments to prevent double-booking; (3) parse appointment descriptions for customer contact numbers, vehicle registrations, and service types to automatically create workshop booking records; and (4) push appointments created in GarageGhost back to your calendar.

Storage & Security: Google OAuth access and refresh tokens are encrypted at rest and in transit. Event data is partitioned strictly per garage tenant and stored securely on UK/EU infrastructure. We do not store Google account passwords.

Sharing & Third Parties: We do not sell, rent, or transfer your Google user data to data brokers, advertising networks, or third parties. Data is never shared except as strictly necessary to host our database infrastructure or comply with applicable legal obligations.

No Advertising: Google user data is never used or transferred for serving advertisements, retargeting, personalized advertising, or credit assessment.

AI and Machine Learning: We do not use Google user data to train, retrain, or improve generalized or foundational artificial intelligence (AI) and/or machine learning (ML) models. While AI services (such as Google Gemini) are used ephemerally to classify and extract appointment fields from calendar event text, this data is processed per-request and is never retained for model training.

Human Access: No humans read or view your Google Calendar data unless: (a) you have provided explicit consent for technical troubleshooting; (b) it is required for security investigation of system abuse; or (c) it is required to comply with applicable law.

Revocation and Deletion: You can disconnect Google Calendar at any time from your Garage Ghost Settings dashboard, or revoke access directly in your Google Account Security Settings. Upon disconnection or account termination, stored Google OAuth tokens and synced calendar records are deleted from our systems.

Limited Use Policy Compliance: Garage Ghost's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We process caller and workshop data under the lawful basis of legitimate interests (delivering the service requested by the caller to book an appointment with their chosen garage) and contractual necessity for registered garage administrators.

We never sell, rent, or pool customer or garage data across garages or with third parties.

Data is encrypted in transit and at rest using modern encryption standards. Call records, transcripts, and diary entries are retained for the duration of the garage's account or until deletion is requested.

Garage owners may delete any customer profile or call record directly from their dashboard at any time.

Under UK data protection law, individuals have rights including access, rectification, erasure, and restriction of processing. To exercise these rights, email team@garageghost.co.uk.