Privacy Policy

Mechy is a garage management service operated by Chrysanthos Chrysanthou, a sole trader established in Cyprus, of Strovolos, Nicosia 2021, Cyprus ("we", "us"). This policy explains what personal data we handle, why, and what rights you have. You can reach us at privacy@mechy.cy about anything written here.

1. TWO DIFFERENT ROLES

We handle two kinds of personal data and our responsibilities differ for each.

For the people who use Mechy — garage owners and their staff — we are the data controller. We decide what account data is needed to run the service.

For a garage's own customers and vehicles, the garage is the controller and we are its processor. We hold that data on the garage's behalf and act on its instructions. A vehicle owner who wants their record corrected or deleted should ask the garage that holds it; if you contact us instead, we will pass the request to that garage rather than act on it ourselves.

2. WHAT WE COLLECT

Account data, from you: name, email address, mobile number, password (stored only as a hash, never in a readable form), your role, and your language preference. If you choose to sign in with a passkey we store its public key and a name you give the device. We never receive your fingerprint, face or device PIN — those stay on your device.

Business data, entered by the garage: shop name, address, VAT number, logo, staff accounts, working hours, customer records (name, phone, email, address, and for business customers the VAT number and Tax Identification Code), vehicles, jobs, inspections and their photographs, parts, invoices, payments and expenses.

Technical data, collected automatically: IP address, browser and device description, and the time of significant actions such as signing in, deleting a record, or issuing an invoice. This is what makes a garage's activity log possible, and it is also how we detect attempts to break into an account.

We do not use advertising cookies and we do not track you across other websites.

3. GOOGLE USER DATA

Connecting a Google account is entirely optional. Mechy works fully without it, and you can disconnect at any time from your profile page.

If you connect Google Contacts, we ask for permission to manage your contacts (https://www.googleapis.com/auth/contacts). We use it for one purpose: to copy your garage's own customer records into a contact group named "Mechy Clients" in your Google account, so their numbers appear on your phone. The copying is one way. We create and update contacts in that group and match against existing contacts by phone number so you do not end up with duplicates. We do not delete your contacts, and we do not read your contacts for any other purpose.

If you connect Google Calendar, we ask for permission to view and edit events on your calendars (https://www.googleapis.com/auth/calendar.events). We use it to place your Mechy appointments in your calendar and to reflect changes made in your calendar back into Mechy, so that the two agree. We do not read events unrelated to that synchronisation, and we do not access any other calendar data.

We ask for the narrowest permission Google offers for each task. Google does not publish a write-only permission for contacts, so the permission we must request also allows reading and deleting. We do neither beyond what is described above.

What we store: a refresh token that lets us continue the synchronisation while you are not signed in, the identifier of the "Mechy Clients" group, and a synchronisation cursor for the calendar. We do not store copies of your Google contacts or calendar events beyond the Mechy records they correspond to.

Disconnecting from your profile page deletes the stored token immediately and stops all further access. Disconnecting Contacts Sync also deletes the "Mechy Clients" group and the contacts we created inside it, so nothing we added is left behind in your account; the app tells you this before you confirm. Calendar events we created are left in place, because removing appointments you may still be working to would be the more harmful surprise. You can revoke our access at any time at https://myaccount.google.com/permissions, and you can delete anything we created yourself.

Mechy's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell Google user data, we do not use it for advertising, we do not use it to train any artificial intelligence or machine learning model, and no human reads it except where you have asked us to resolve a specific support problem or where the law requires it.

4. WHY WE ARE ALLOWED TO HANDLE THIS DATA

To perform our contract with you: running your account, storing your garage's records, producing invoices, taking payment.

Our legitimate interests: keeping the service secure, detecting fraudulent sign-in attempts, keeping an activity log so a garage owner can see what happened in their own business, and diagnosing faults.

Your consent: connecting a Google account, and receiving optional summary emails. You can withdraw either at any time without affecting anything else.

Legal obligation: keeping accounting and tax records for the periods Cypriot law requires.

5. WHO ELSE SEES IT

We use a small number of service providers, each handling only what its task needs:

- Our hosting and database provider, which stores all service data. Data is held in Google's and our infrastructure provider's data centres and may be processed in locations inside and outside the European Economic Area under transfer safeguards approved by the European Commission.

- An email delivery provider, for invoices, receipts and account emails.

- An SMS provider, for appointment reminders and pickup notifications.

- A payment provider, for subscription billing and for garages that collect card payments. Card numbers reach that provider directly and never pass through Mechy.

- An artificial intelligence provider, which reads only the photographs you deliberately submit for scanning — a vehicle registration plate, an odometer, or a supplier invoice — and returns the text it finds. These images are not used to train that provider's models.

We do not sell personal data. We do not share it for advertising. We will disclose data if a court or a competent authority lawfully requires it.

6. HOW LONG WE KEEP IT

Account and business records stay for as long as the garage's account is open. When a garage closes its account, we delete its data on request. Records we are legally required to retain, such as issued invoices, are kept for the period Cypriot tax law requires.

Logs are deleted automatically on a fixed schedule: sent messages and email records after 60 days, notification records after 30 days, a garage's own activity log after one year, and our internal administrative log after three years.

7. SECURITY

Passwords are stored only as hashes and cannot be read back by anyone, including us. Data is encrypted in transit and at rest. Access to a garage's data is restricted to that garage's own accounts, and every request is checked against the account making it. Repeated failed sign-in attempts lock the account and require confirmation by SMS. Passkeys and Google refresh tokens are never exposed to the browser.

No system is perfectly secure. If a breach occurs that is likely to put your rights at risk, we will notify the Office of the Commissioner for Personal Data Protection and affected users as required by law.

8. YOUR RIGHTS

Under the General Data Protection Regulation you may ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to limit how we use it, object to processing based on our legitimate interests, and ask for your data in a portable format. Where we rely on consent you can withdraw it at any time.

Write to privacy@mechy.cy and we will respond within one month. If you are not satisfied you may complain to the Office of the Commissioner for Personal Data Protection in Cyprus (www.dataprotection.gov.cy).

Remember that for a garage's customer records the garage is the controller, so those requests should go to the garage.

9. CHILDREN

Mechy is a tool for businesses and is not intended for anyone under 18. We do not knowingly collect data from children.

10. CHANGES

If we change this policy we will update the date at the top and, where the change is significant, tell account holders directly.