How your data is handled
Privacy notice
Aethrovia lets car garages in Cyprus check cars in with a short form and keep their customers informed by SMS. This notice explains what happens to your data when you check a car in at a garage that uses Aethrovia, and to the data of the garages' own staff.
1. Who is responsible
- The garage you check your car in with is responsible for your data (the "controller"). It decides which messages you get and keeps the record of the work on your car.
- Aethrovia runs the service for each garage as its "processor", under a written data processing agreement (GDPR art. 28). We only use your data to provide the service to that garage. Service provider: Aethrovia, Arch. Makariou III 24, 4000 Mesa Geitonia, Limassol, Cyprus · [email protected].
- Each garage's data is kept separate. If you use two garages, neither sees what the other knows about you, and each has its own record of which messages you want.
- For garage staff accounts and garage billing, Aethrovia is the controller (section 11).
2. What we keep about you
- What you type in the check-in form: your name, mobile number, your car's registration number, and the language you want messages in.
- Your choices: that you agreed to messages about your car, your separate review-request and reminder choices, their source, language, notice version and when they changed.
- If the garage adds them: your car's make, model and version, and your email or notes.
- The SMS messages sent to you, and whether they were delivered.
- What the garage records about your visits: check-in, ready and pick-up times, service notes (mileage, oil, coolant, work done, next service, MOT expiry).
- While your check-in waits for its code: the details above, the code (stored scrambled, not readable), and your device's IP address, only to stop the form being misused. Deleted within a day (section 7).
- When you scan a garage's QR code: only that a scan happened, and your browser type.
3. What it's used for, and why that's allowed
- Checking your car in and telling you when it's ready or picked up, including the code that confirms your number is yours: to carry out the service you asked for (GDPR art. 6(1)(b)).
- One review request after pick-up, and service or MOT reminders the garage sets for your car: only for the purpose you selected in its separate optional box (your consent, art. 6(1)(a); Cyprus Law 112(I)/2004, s.106). You can withdraw it at any time, free of charge (section 4). If the garage checked your car in by hand, it records what you told it.
- Keeping the garage's record of the work on your car: the garage's legitimate interest in its service history, warranty and possible legal claims (art. 6(1)(f)).
- Security and preventing misuse (for example, limiting how many codes a number or device can ask for): legitimate interest (art. 6(1)(f)).
Your data is never sold, never used for advertising, and never shared with other garages.
4. Stopping messages
Every review request and service/MOT reminder includes a link where you can change the two choices separately or stop all optional messages. You can also tell the garage. Your choices apply only to that garage. Messages about your current visit (check-in, ready, pickup) continue as part of the service you requested.
5. Who else handles your data
- The garage's staff, each with their own login.
- Aethrovia staff can use the support interface only while the garage enables access, for up to 7 days. The garage can revoke it and see access records. Authorised staff may also access data where necessary for a security incident or a legal requirement, under confidentiality and the DPA.
- BulkGate (TOPefekt s.r.o., B. Němcové 767/13, 787 01 Šumperk, Czech Republic), which delivers SMS messages and codes through the mobile networks.
- Hetzner Online GmbH, Germany, which hosts the service.
- Cloudflare, Inc., when Turnstile security checks are enabled on online check-in: it processes your IP address and browser/device security signals to detect bots. Our verification request does not include your name, phone number or number plate. See Cloudflare's Turnstile privacy notice.
- Cloudflare edge protection, when enabled: website traffic passes through Cloudflare, including URLs, cookies, submitted forms and page contents. Cloudflare terminates HTTPS to deliver pages and filter attacks, and can process customer and account information in that traffic under its data processing addendum. Private pages and forms are excluded from edge caching. Essential security cookies may be used.
- Resend (Plus Five Five, Inc., United States), which sends account emails to garage staff and owners.
- Google, only if you tap the review or directions link: you then go to Google's own website, under Google's privacy policy. We don't send your data to Google.
- Public authorities, only where the law requires it.
6. Transfers outside the EU
Garage data is hosted in Germany. An SMS to a non-EU number passes through that country's mobile networks. Resend may process account email information in the United States; its data processing agreement provides standard contractual clauses for transfers from the EU.
When Turnstile is enabled, Cloudflare may process security signals outside the EU through its global service. Its privacy notice explains its processing and international transfers.
When Cloudflare edge protection is enabled, website traffic may also be processed outside the EU. Cloudflare's data processing addendum describes safeguards for international transfers. Provider security records are subject to its terms and settings; we do not enable optional request-payload logging.
7. How long it's kept
- Customer contact details are kept while you use the garage. After 3 years without a check-in, your name, number, email, customer notes, SMS history and optional-message preference records are removed. Vehicle plates, visits and service records remain as the garage’s work history. These records may still be personal data; the garage must assess its lawful retention needs and remove personal information in service notes where necessary.
- When a garage’s trial or paid service period ends, it has 30 days to export its data. Live-service data is deleted after that period. Backup copies expire within a further 30 days. A request to cancel earlier does not itself start this period.
- Pending check-in details and codes, reset codes, failed-login records and rate-limit IP addresses are removed after a day. Daily cleanup runs may remove them on the next scheduled run. Technical logs and backups are retained for up to 30 days. QR-scan browser strings are cleared after 30 days; aggregate scan records remain. Support-access records are kept for one year.
- Billing records are retained for applicable tax/legal requirements. Ask [email protected] for the retention applying to a particular record.
If you contact us for support, a privacy request or a security report, we use the information needed to verify and answer it and to meet our legal duties. We keep minimal closed-case records for up to three years, reviewing whether they are still needed; a documented legal obligation or claim may require longer. Temporary identity-verification documents are deleted after verification.
8. Your rights
You can ask to see your data, correct it, delete it, restrict its use, object to it being used, withdraw your consent to reminders and review requests at any time (section 4), or receive a copy in a common format. Ask the garage directly, or write to us at [email protected] and we'll help the garage answer. You'll get an answer within one month.
If you think your data is mishandled, you can complain to the Commissioner for Personal Data Protection: 15 Kypranoros Street, 1061 Nicosia (P.O. Box 23378, 1682 Nicosia) · +357 22 818 456 · [email protected] · www.dataprotection.gov.cy, or to the data protection authority where you live in the EU.
9. Automated processing
No decision with legal or similarly significant effects is made about you automatically. If the garage checked your car in by hand and you didn't choose a language, the service picks one from your number's country code. The garage can change it.
10. Security and cookies
Website connections use HTTPS. Ordinary SMS is not end-to-end encrypted. Staff have individual logins; garage records are separated and support access is controlled as described in section 5. Passwords and verification codes are hashed, and repeated incorrect attempts are limited.
Our website uses essential session and security cookies only. Fonts and our interface assets are served locally; when Turnstile is enabled, its security script and widget load from Cloudflare. There are no advertising or tracking cookies. The demo form can record a campaign code and acquisition channel from a link you follow; these are saved with the lead, without analytics cookies or cross-site tracking. Payment-provider pages have their own privacy and cookie notices.
Cookies and browser storage
We use storage for the forms, login and security features you use. We do not use advertising or analytics cookies, and there is no optional tracking to accept.
- sessionid — Aethrovia: connects your browser to your login or check-in steps. Public check-in sessions expire after up to 14 days. Ordinary garage logins use a browser-session cookie. If you select “Keep me signed in on this device”, the login lasts up to 180 days after use and is renewed while you use the app. Privileged operator logins last up to 12 hours. Logging out ends the login.
- csrftoken — Aethrovia: protects forms from requests made by another website; expires after approximately one year and may be renewed when you use a form.
- messages — Aethrovia: may temporarily hold a signed success or error notice, usually until the next page reads it; it is a browser-session cookie.
- Navigation state — Aethrovia: tab session storage remembers the current page address for browser navigation. It may include a search you entered and is updated when you navigate.
- Form drafts — Aethrovia: unfinished garage forms are saved in this tab's session storage, so entered details survive a refresh. They may include customer and vehicle details. Drafts are cleared after successful submission or logout; drafts over 24 hours old are discarded when the form is next opened. Closing the tab normally clears this storage.
- Cloudflare security storage: when security features are enabled, Cloudflare may set challenge cookies such as
cf_clearanceandcf_chl_*. Other enabled protections may use__cf_bm(30 minutes of inactivity) or_cfuvid(browser session). Challenge lifetimes depend on the protection settings. See Cloudflare's cookie documentation and its Turnstile privacy notice.
You can delete or block cookies and browser storage in your browser. Blocking functional storage may prevent login, form submission or security checks. Browsers with session restoration may retain session cookies or tab storage after closing. Log out on shared devices. Payment-provider pages have their own notices.
11. Garage staff and owners
For garage accounts, Aethrovia is the controller. We keep each mechanic's phone number, email, name and garage, a hashed password, and which board actions they took (for example, who marked a car ready), to run the accounts and keep them secure (art. 6(1)(b) and (f)). Owner and billing details are used to run the subscription; card payments are handled by Stripe, which acts under its own terms. Accounts are deleted with the garage 30 days after its service period ends; billing records are kept as long as tax law requires. The same rights and complaint route as in section 8 apply.
12. Garages that contact us
If you leave your name and number in the "Request a demo" form on our home page, or give them to us in person, Aethrovia is the controller. We use them only to contact you about Aethrovia, at your request, before any contract (art. 6(1)(b)), and keep notes of our conversations. If your garage signs up, section 11 applies. Otherwise they're deleted after 12 months with no contact, or sooner if you ask at [email protected]. The same rights and complaint route as in section 8 apply.
13. Changes
If this notice changes, the new version will be published here with a new date. For any question, write to [email protected].