Privacy Policy

KEVIN helps everyday car owners understand repair estimates, avoid unnecessary upsells, and get fair prices. This Privacy Policy applies to the KEVIN mobile app, the KEVIN web app, and this website (together, the "Service"). It explains what we collect, how we use it, who we share it with, how long we keep it, and the rights and choices you have.

The short version: we collect what we need to run the Service, we don't sell your personal information, we don't run ads, and you can delete your account and data at any time — in the app or from this website.

1. Information we collect

• Account & profile: name, email address, optional phone number, password (stored in hashed form by our authentication provider), subscription tier, and your preferences.
• Vehicle information: year, make, model, trim, mileage, license plate (if you provide it), and VIN — including VINs read from photos you scan. A VIN can identify a specific vehicle and its registered owner, so we treat vehicle data as personal information.
• Service & maintenance history: services you log — dates, mileage, costs, shop names, and notes.
• User content: photos of repair estimates, invoices, and VINs you upload; images you attach in chat; and the contents of your messages with KEVIN's AI and with our human advisors. Estimate photos may incidentally contain personal details printed on them (such as your name, address, or plate number).
• Purchase information: your subscription status and purchase history. Payments are processed by Apple, Google, or our payment processor — we never receive or store your full card number.
• Device & usage data: basic technical information such as device type, operating system, app version, IP address, and diagnostic logs used to keep the Service working and secure.
• Negotiation call recordings: if you purchase the Negotiate service, calls between our representative and your repair shop may be recorded to document outcomes, where permitted by law and with any legally required consent.

We collect this information when you provide it directly, when it's generated by your use of the Service, or — for recall data — from the U.S. government's public NHTSA database.

2. How we use your information

We use your information only to provide and improve the Service:

• analyzing repair estimates and answering your questions (including via AI, described in Section 3);
• connecting you with human advisors and, if you purchase the Negotiate service, contacting your repair shop at your direction;
• tracking maintenance, surfacing recalls, and building your vehicle's service history;
• managing your account, subscriptions, and payments;
• providing customer support and sending service communications;
• maintaining safety and security, preventing fraud, and complying with law;
• creating de-identified, aggregated repair-pricing insights that cannot reasonably be linked back to you.

We do not sell your personal information, and we have not sold it in the preceding 12 months. We do not share it for cross-context behavioral advertising. We show no ads. Data collected for one purpose is not repurposed for another without your consent.

3. Artificial intelligence — what happens to your chats and photos

KEVIN's estimate analysis and AI chat are powered by Claude, an AI service operated by Anthropic, PBC. When you send a message to KEVIN's AI or scan an estimate or VIN, the contents of that message or photo (plus relevant vehicle context, like your car's make, model, and mileage) are transmitted to Anthropic's API for processing, and the AI's response is returned to you.

• We ask for your explicit permission before your first AI chat or scan.
• Under Anthropic's commercial API terms, your inputs and the AI's outputs are not used to train Anthropic's models.
• AI output can be wrong. It is general information, not professional mechanical advice — see our Terms of Service.

4. Who we share information with

We share personal information only with the service providers below, only as needed to run the Service. We require every third party with whom we share user data to provide the same or equal protection of your data as described in this policy.

• Anthropic, PBC — processes chat messages and scanned photos to generate KEVIN's AI responses (Section 3).
• Supabase — hosts our backend: account data, vehicle data, service history, chat messages, and uploaded photos, on access-controlled infrastructure in the United States.
• Apple and Google — process in-app purchases and subscriptions on their platforms.
• Our payment processor — processes payments made outside the app stores (such as the $99 Negotiate fee purchased on the web). We receive confirmation of payment, not your full card details.
• Slack — relays Live Advisor messages to our human advisors so they can reply to you.
• NHTSA (U.S. Department of Transportation) — we query its public API with your VIN or vehicle details to check recalls and decode VINs. This is a lookup against a government database, not a sale or sharing for marketing.

We may also disclose information if required by law, to protect the rights and safety of users or the public, or as part of a merger, acquisition, or sale of assets (in which case this policy will continue to apply to your data and we'll notify you of any change).

5. How long we keep your data

• Account, vehicle, and service-history data: kept while your account is active; deleted within 30 days after you delete your account.
• Chat messages: kept while your account is active so you and our advisors can refer back to them; deleted within 30 days after account deletion.
• Photos you upload in chat or a negotiation: removed automatically 90 days after the last activity in that conversation (30 days for guest walk-in chats), and immediately when you delete your account. Photos of estimates you scan are analyzed and not stored — only the de-identified line items (vehicle model, service names, prices — never your name, plate, or VIN) are kept for pricing research.
• Purchase and transaction records: kept up to 7 years as required for tax, accounting, and legal compliance.
• Diagnostic logs: kept up to 12 months.

We may retain limited information longer where required by law, to resolve disputes, or to prevent fraud and abuse — and de-identified, aggregated data that no longer identifies you.

6. Deleting your account and your data

You can delete your KEVIN account — and the personal data associated with it — two ways:

• In the app: Profile → scroll to the bottom → Delete my account.
• On the web (no app required): sign in at our account page and choose Delete my account.

Deletion removes your account, profile, vehicles, service history, chats, and photos, subject to the limited legal-retention exceptions in Section 5. You can also request deletion of specific data (for example, your chat history) without deleting your whole account, or withdraw a previously given consent, by emailing privacy@kevinauto.app.

7. Your privacy rights

Depending on where you live, you may have the right to: know/access the personal information we hold about you; correct inaccurate information; delete your information; receive a portable copy; and opt out of sale, sharing, or targeted advertising (we do none of these, but you have the right regardless). We will never discriminate against you for exercising your rights.

To exercise any right, use the in-app options above or email privacy@kevinauto.app. We verify requests using your account email and respond within 45 days (extendable once by 45 days where permitted, with notice). You may use an authorized agent to submit requests; we'll verify the agent's authority. If we decline a request, you may appeal by replying to our decision, and we'll respond to appeals within 45 days.

California residents (CCPA/CPRA): the categories of personal information we collect are listed in Section 1; purposes in Section 2; recipients in Section 4; and retention in Section 5. We do not sell or share (as those terms are defined in the CCPA) personal information and have not in the preceding 12 months, and we do not use or disclose sensitive personal information for purposes requiring a right to limit. California's "Shine the Light" law: we do not disclose personal information to third parties for their direct marketing.

Do Not Track and opt-out preference signals: our Service does not respond to browser "Do Not Track" signals, and we do not permit third parties to collect personal information about your activity over time and across different websites or apps. Because we do not sell or share personal information, opt-out preference signals such as Global Privacy Control do not change how we process your data, but we honor them where required by law.

EEA/UK visitors: KEVIN is a U.S. service and your data is processed and stored in the United States. If you use the Service from the EEA or UK, you may have additional rights under the GDPR (including lodging a complaint with your supervisory authority); contact us to exercise them.

8. Security

We protect your data with encryption in transit (TLS), encrypted storage, row-level access controls so accounts can only read their own data, and least-privilege access for our team. No service can guarantee absolute security; if a breach affects your personal information, we'll notify you as required by law.

9. Children

The Service is intended for users 18 and older. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn we have, we will delete it — contact us at privacy@kevinauto.app.

10. Changes to this policy

We'll post updates here with a new effective date. For material changes, we'll notify you in the app or by email before they take effect.

11. Contact us

[LEGAL ENTITY NAME]
[MAILING ADDRESS]
Privacy requests: privacy@kevinauto.app
Support: support@kevinauto.app