Version: 2.0 Effective date: September 30, 2026 Language: English. Spanish version: Política de privacidad Terms: Terms and Conditions

If the Spanish and English versions differ, the Spanish version controls, unless a mandatory data-protection rule requires otherwise.

1. Controller

The controller for AutoBlack accounts, the websites, and the paid plan is:

Seven Global Continental LLC 12480 NW 25th Street, Miami, Florida 33182, United States Privacy: info@autoblack.app Phones: +1 305 200 5507 and +1 786 600 5989

AutoBlack is the application. The Company also sells the American Black brake brand. This policy covers the AutoBlack software and sites. A parts purchase from a store or distributor is also governed by that seller’s policy.

This policy applies to:

• The AutoBlack mobile app (iOS and Android), the free version for vehicle owners, and the Pro shop mode.
• https://autoblack.app (information, contact form, and checkout).
• https://autoblack.app/privacy-policy/ and https://autoblack.app/terms-and-conditions/ (legal texts).
• https://autoblack.app/delete-account/ (account deletion request).
• Supporting systems (API, email, notifications, and the internal admin console).

We have not appointed a European Union representative under Article 27 GDPR or a United Kingdom representative. Requests are handled at the Miami address and the privacy inbox. If the volume or risk of processing people in the EEA or the United Kingdom makes that appointment mandatory, we will publish the contact on this page.

2. Who decides about each set of data

There are three different roles:

• We are the controller of app accounts, the personal garage, free-version reminders, the AI assistant, push tokens, service security, the contact form, and the shop’s billing account to the extent you buy the plan from us.
• The shop is the controller of customer data it uploads (name, phone, email, vehicle, services, and notices sent to those people). We are the processor of that record: we host it and send notices under the shop’s instructions and the product’s design.
• PayPal, WooCommerce in its payment operation, Apple, and Google decide, under their own policies, about payment, the app store, and part of notification delivery.

If a person appears only as a shop’s customer and has no AutoBlack account, that person should first contact the shop about that record. If they write to us, we will identify the shop when we can, forward the request, and block or delete the data on our systems when the law requires it or the shop instructs us to do so.

3. Data we process

3.1 Free account and profile

• Email address, which is also the sign-in identifier.
• First name and last name.
• Phone, if you provide it, with country code.
• Company, if you provide it.
• Preferred language (Spanish or English) and distance unit (kilometers or miles).
• Address as text and coordinates (latitude and longitude), if you save an address.
• A 6-digit one-time code (OTP), valid for a few minutes, used to sign in. We do not store a password for the free account.
• Session identifiers (access and refresh tokens).

3.2 Vehicle and history (free version)

• Make, model, sub-model, year.
• License plate, if you provide it.
• Mileage.
• Services: type, date, part, notes, mileage, custom service name, and repeat interval, if you set one.

We do not ask for the vehicle identification number (VIN).

3.3 AI assistant

• The text of your question (technical maximum of about 4,000 characters).
• If you select a vehicle: make, model, sub-model, year, and an extract of up to about 50 services (type, date, mileage, part, and notes).
• A context country set in system configuration, which may not be your country.
• The date and the number of questions that day, to apply the daily limit. In the current version the default limit is 5 questions a day, unless operations change it.

The full conversation is not stored in our database. The reply is generated at the time of the request. On the phone, the app may keep that day’s chat in local storage until the day changes or you clear the app data.

3.4 Notifications

• Push notification token (Expo) and platform (for example, iOS or Android), if you allow notices in the operating system.
• Notice content: title, text, and, for platform campaigns, an optional image and link.
• For shop reminders and promotions: whether the notice went by email, push, or both.

3.5 Pro plan and shop profile

• Shop name, contact email, phone, country, state, city, address, and website if present.
• Email, first name, and last name of the shop account holder.
• Plan status (active, inactive, or trial), expiry date, and whether an administrator activated it.
• Billing data WooCommerce sends us to provision the shop: name, email, phone, address, city, state, country, and the order id. The order id is used for activation and may remain in technical logs. We do not store the full card number.

3.6 Customers uploaded by the shop

• First name, last name, email, phone, and preferred language, if the shop enters them.
• Customer vehicles: make, model, year, plate, alias or sub-model, and mileage.
• Services performed by the shop, notes, next-notice date, and whether the shop asked to notify the customer.
• Invites tied to the customer’s email.
• The app owner’s acceptance or refusal to add that vehicle or those services to the personal garage.

3.7 The autoblack.app website

• Contact form: name, shop name, phone, email, message, and Google reCAPTCHA verification.
• Checkout: first name, last name, country, address, city, state, postal code, optional phone, and email, plus the payment method chosen.
• WooCommerce order-attribution cookies (sbjs_ family), cookies or storage required by PayPal, and the reCAPTCHA cookie or storage.

3.8 sevenglobalcontinental.cloud and the app on the device

• The information site may store the language preference in the browser (autoblack-lang). It does not use its own analytics cookies.
• On the device, the app stores the session token, the email while an OTP is pending, language, visual theme, user or shop mode, and that day’s AI chat. That data sits in the app’s local storage, not in the operating system’s highest-security keystore.

3.9 Technical data

• IP address and request logs (method, path, and status) for as long as needed for security, rate limits, and diagnosis. We do not build an advertising profile.
• We do not use analytics, advertising, or attribution SDKs (no advertising identifier such as IDFA/GAID and no cross-app tracking).
• The Android notification project may use Google’s delivery infrastructure (FCM) through Expo. That does not add an advertising use by us.

3.10 Internal console

Authorized staff can view accounts, vehicles, shops, shop customers, and campaigns in order to operate and support the service. Access is limited by role and is not a product offered to the public.

4. Data we do not ask for

We do not ask for a government ID, health data, biometrics, a password for the free account, address-book contacts, photos, camera access, or your full card number. Do not put that data in the notes field or in the AI chat. If a shop uploads it anyway, the shop must have a lawful basis and would have to instruct us outside ordinary use of the product; we may reject or delete it.

5. Why we use it and on what basis

You can withdraw location or notification permission in the operating system. Withdrawal does not affect the lawfulness of earlier processing. Without location, the address is not filled from GPS. Without notifications, push does not arrive; operational email may continue.

We do not use the data for third-party advertising or to build a profile for sale to others. The assistant may mention American Black parts when the question is about brakes, because the Company owns that brand. That is our own commercial speech inside the feature, described in the Terms. It is not a third-party ad based on tracking.

6. Artificial intelligence

The model provider is OpenAI, L.L.C. (United States), through its API. We send the text needed to answer, as described in section 3.3. We do not send your email, phone, or plate as separate fields; a note or the text you type could contain them if you include them.

Under OpenAI’s API policy as of the publication of this text, content sent through the API is not used to train its models. OpenAI may keep inputs and outputs for a limited time to monitor abuse, under its own policy. If that policy changes in a material way, we will update this section.

We do not make decisions with legal or similarly significant effects about you based on the assistant. The daily quota is a technical limit of the feature, not an assessment of your credit, conduct, or profile. The reply may be wrong. It is not a diagnosis. Section 10 of the Terms is part of this explanation.

7. Free version and paid plan

The free version does not require a card. We process account and garage data to provide that feature.

The Pro plan is paid on autoblack.app. WooCommerce and PayPal process payment data under their policies. We receive the shop-setup data and activate twelve months of access for each completed Pro order, unless the order states another period in writing. We do not sell the subscription inside the app, and we do not use Apple or Google in-app purchase for this plan.

8. Email, push, and promotions

• Operational: OTP codes, account notices, reminders for services you recorded, and reminders a shop sends for a service it performed. You can turn off push in the system. To stop emails from a shop, write to the shop or to info@autoblack.app.
• Shop promotions: the shop orders them, using the product’s templates and a monthly quota. The shop must have a lawful basis to send them. You can object by writing to the shop or to us.
• Platform campaigns: we may send product notices by push or email, segmented by internal criteria (for example, users with a vehicle, active shops, language). This is not third-party advertising. You can object at the same privacy address and turn off push.

Today, opt-out is handled by that request and by system settings, not by an automatic link in every email. We will honor the opt-out within the time required by applicable law.

9. Cookies and similar technologies

We do not install Google Analytics or the Meta pixel on these products. You can block cookies in the browser. If you block checkout cookies, payment may fail.

10. Who we share data with

We do not sell personal data. We do not share it for third-party cross-context advertising.

Staff and processors handle data only on instructions and under a duty of confidentiality. Where the law requires it, the processing arrangement is documented.

11. International transfers

The Company is in the United States. If you write to us or use the app from the European Union, the United Kingdom, Latin America, or another country, your data is processed in the United States and may pass through the providers in section 10, several of them in the United States.

For people in the EEA, the United Kingdom, or Switzerland, the transfer relies on an adequacy decision where one exists and, where it does not, on standard contractual clauses or another Chapter V GDPR safeguard (or the UK equivalent), plus supplementary measures when needed. You may ask us for a copy of the applicable mechanism at the privacy address, with commercially sensitive details redacted.

Latin America: we apply this policy and the local law that protects you on a mandatory basis (including Brazil’s LGPD, Mexico’s federal private-sector personal-data law, Argentina’s Law 25,326, Colombia’s Law 1581 of 2012, and the equivalent rules of your country).

12. How long we keep it

• Account, garage, and profile: for as long as the account exists.
• OTP: minutes, until it expires; then it is deleted.
• Access token: on the order of 30 days, unless you sign out or it is revoked.
• Refresh token: up to about 365 days, unless you sign out or it is revoked.
• Push token: until it is replaced, the session is effectively closed, or the account is deleted.
• AI questions on our server: we do not store the text; only the daily counter. On the phone, the local chat lasts that day. OpenAI may keep the submission for the period in its abuse policy.
• Sending queue: as long as needed to deliver the message and diagnose a failure. An OTP code may sit in that queue until the email goes out.
• Pro plan and order data kept by WooCommerce or PayPal: the plan period and the tax, accounting, and claims periods. In the United States that is often several years.
• Contact form: long enough to handle the inquiry and a reasonable business archive, not more than 24 months unless a claim is open.
• After account deletion: see section 16. Anonymized remnants, or data we must block by law, stay only for the legal period.
• A shop’s customer record: for as long as the shop keeps it and the processing engagement continues, and afterward for the limitation period or a deletion instruction.

13. Security

We use encryption in transit (HTTPS), role-based access, hashed OTP codes and admin passwords, and refresh tokens stored only as hashes. No one can promise absolute security. If we detect an incident that risks your rights, we will notify you within the time required by applicable law.

14. Automated decisions

We do not make decisions based solely on automated processing that produce legal effects about you or similarly significantly affect you within the meaning of Article 22 GDPR. The assistant informs; it does not approve credit, set personalized prices, or decide penalties. Maintenance due dates are calculations from the data entered.

15. Children

The Service is not directed to anyone under 18. We do not knowingly collect children’s data. If you are a parent or guardian and believe a child gave us data, write to us. If we confirm it, we will delete the account. This rule also covers the U.S. children’s privacy law (COPPA) and GDPR minimum ages (16, or the lower age a country sets, between 13 and 16).

16. Your rights and account deletion

Depending on your country, you may request access, correction, update, deletion, objection, restriction, portability, withdrawal of consent, and not to be discriminated against for exercising these rights. You may also object to commercial communications.

How to exercise them. Write to info@autoblack.app with the subject “AutoBlack privacy”, from the account email if you can. We may ask for reasonable information to confirm you are the account holder. We will respond within the period set by the law that applies to your request. As a guide: one month in the EEA and the United Kingdom (extendable), 45 days in California where that statute applies, and the LGPD, Mexican, or local period when it is shorter.

You can also delete the account in the app: Profile → Delete account. That closes access, revokes sessions, and anonymizes the email and username of that account. We will complete deletion or anonymization of the profile, the personal garage, that garage’s service history, push tokens, and assistant counters within 30 days, except what we must keep for law, fraud, security, or an open claim.

That deletion does not by itself erase a record a shop created about you in the shop’s workspace. For that record, write to the shop and copy us if you wish. It also does not erase payment records WooCommerce or PayPal must keep, or backups until they rotate, already out of operational use.

The Delete account page repeats this procedure for the app stores.

You may authorize an agent (including under the California regime) if the agent proves the authority.

Authorities. Without limiting any other remedy:

• EEA and United Kingdom: the supervisory authority where you live. If you live in Spain, the Agencia Española de Protección de Datos (aepd.es).
• Brazil: Autoridade Nacional de Proteção de Dados (ANPD).
• Mexico: the authority competent for personal data.
• Argentina: the Agencia de Acceso a la Información Pública.
• Colombia: the Superintendencia de Industria y Comercio.
• United States: your state attorney general and, where relevant, the Federal Trade Commission.

California and other U.S. states

If the California law (CCPA/CPRA) or a similar state law covers you:

• We collect identifiers (name, email, phone, push token), customer records (address; payment data at PayPal and WooCommerce), commercial information (Pro plan), limited internet activity (logs and attribution cookies on the purchase site), precise geolocation if you save your address or use location, and professional or business information (company or shop profile).
• Precise geolocation is sensitive personal information under the CPRA. We use it only to save your address and to show or sort points of sale, not to infer characteristics and not to sell it.
• In the 12 months before this version we do not sell personal information and we do not share it for cross-context behavioral advertising, as those terms are used in the CPRA.
• You have the right to know, correct, delete, and not to be discriminated against. You may limit the use of sensitive information by writing to the privacy address. We do not offer a financial incentive in exchange for data.

We do not track users across third-party sites for advertising, and we do not respond to the browser “Do Not Track” signal, because that tracking is not part of the Service.

17. Changes

We will post changes on this page with a new date. If a change is material, we will notify you in the app, by email, or on the site.

18. Contact

Seven Global Continental LLC 12480 NW 25th Street, Miami, Florida 33182, United States info@autoblack.app +1 305 200 5507 · +1 786 600 5989