Privacy policy

Two kinds of information

A shop's own records. A shop that uses MCM Hub enters its business records: its customers (dealerships and people, with their names, phone numbers, emails and addresses), cars (VINs, stock numbers, makes and models), invoices, quotes, payments, and photos of the work. The shop decides what goes in and who on its team can see it. MCM Hub keeps these records for the shop and uses them only to provide MCM Hub to that shop.

If you're one of a shop's customers, that shop is responsible for your information. Ask the shop first; we'll help it answer.

About the people who use MCM Hub. To give someone a login we keep their name, email address, role (owner, admin or crew), the company they belong to, and whether their access is on. We also keep a record of what happened, for security and support: who made or changed an invoice and when, and which emails were sent to which addresses.

What we use it for

• Running MCM Hub: logging in, making and emailing invoices, quotes and statements, sending the overdue reminders a shop turns on, and reports.
• Keeping MCM Hub secure and working, including looking into problems and misuse.
• Answering emails to support.
• Billing a shop for paid add-ons.
• Seeing which screens are used, from page counts that don't identify anyone.

We don't sell information, use it for advertising, or share one shop's records with another.

Where it's stored

MCM Hub's database, its photos and the app itself run in Canada, in Montreal, with Supabase and Vercel. A few services we rely on work outside Canada, mainly in the United States, so information they handle can be subject to the laws there:

• Resend sends MCM Hub's emails: invoices, statements, reminders, and login and invite emails.
• Stripe takes payment for add-ons. Card details go to Stripe; MCM Hub never sees them.
• ImprovMX and Google (Gmail) receive emails sent to support@mcmhub.ca.
• When a full VIN that a shop hasn't worked on before is typed or scanned, MCM Hub asks the US government's free vehicle lookup (NHTSA) what car it is. Only the VIN is sent.
• Vercel counts page views: which screen, the country, and the kind of device. It uses no cookies, and invoice and customer numbers and searches are removed from page addresses first.

Cookies

MCM Hub uses only the cookies it needs to work:

• the login cookie that keeps you logged in;
• cookies that log you out after a while with nothing tapped, for as long as your company chooses;
• one that remembers you tapped Not now on the reminder to put MCM Hub on your home screen.

There are no advertising or tracking cookies.

Who can see it, and how it's protected

• Each company sees only its own records. The database itself keeps companies apart.
• Within a company, people can only do what their role allows. Crew see only the invoices they made, and never the company's totals.
• Connections are encrypted (HTTPS).
• Photos are private, and shown only through links that stop working within an hour.
• We look at a shop's records only when needed to support it, keep MCM Hub secure, or meet the law.

How long we keep it

• While a shop uses MCM Hub, its records stay until the shop changes them. Invoices are voided, never deleted, so invoice numbers have no gaps. Owners and admins can delete photos.
• When a shop stops using MCM Hub, it can download its invoices and customers first (Export to QuickBooks, and each invoice's PDF). 90 days after it stops, we delete its records, unless the law requires us to keep something longer.
• Shops should keep their own copies of their invoices for tax purposes.
• Deleted information can stay in our backups for up to 30 days before it's gone for good.
• Support emails are kept while they're needed to help, then deleted.

Your choices and rights

You can ask to see the personal information MCM Hub has about you, ask us to correct it, or withdraw your consent (which may mean you can no longer use MCM Hub). Email support@mcmhub.ca. We answer within 30 days. If your information is in a shop's records, for example because you're one of its customers, we'll pass your request to the shop and help it answer.

If you're not satisfied with our answer, you can complain to:

• the Office of the Privacy Commissioner of Canada
• in Quebec, the Commission d'accès à l'information

If something goes wrong

If a security incident puts people's information at real risk of significant harm, we'll tell the shops affected and the people concerned, and report it to the privacy commissioner, as the law requires.

Changes to this policy

When this policy changes, the date at the top changes too. Before a significant change, we tell the shops using MCM Hub by email.

Contact

Privacy Officer, MCM Hub