Privacy Policy

Who we are and what Carvikon does

Carvikon is collision repair shop management software operated by Carvikon LLC. It gives repair shops a workflow board for managing vehicles and repair stages, customer communications, and appointment scheduling.

Information we collect

Depending on how you use Carvikon, we collect account and contact information, business and shop information, subscription and billing status, customer and vehicle records submitted by a shop, communications, appointment information, device and usage data, security logs, and support correspondence. Stripe processes payment-card details; Carvikon does not store full payment-card numbers.

Cookies and advertising technology

Required cookies keep Carvikon secure and working, including keeping you signed in, and stay on regardless of the choices below.

Carvikon is offered to businesses in the United States. We use Google Analytics, PostHog and Vercel Web Analytics (a page-view counter that sets no cookies) to understand how visitors use our site. These are off until you choose “Accept all” in the notice we show on your first visit, or turn them on at the Privacy Choices page. We use Meta Pixel and the X website tag to measure the performance of our own advertising and to show more relevant ads. These two are on by default, as the notice on your first visit says. Google Ads conversion tracking is on by default too, to measure our own ads; it does not add you to an advertising audience unless you choose “Accept all”. You can turn all of these off at any time with “Reject all” in that notice or on the Privacy Choices page; the choice is remembered for that browser, takes effect immediately, and deletes the cookies these tags had already set in it.

PostHog also records session replays and interaction heatmaps — a visual playback of how a page was used, including mouse movement, clicks, and scrolling — for both this site and the signed-in Carvikon product. Password fields and other form inputs are masked before anything leaves your browser, and so are the names, phone numbers, email addresses, and vehicle identification numbers of a shop's customers wherever the product shows them. Pages a shop's customers open from a private link — paying a bill, signing a document, or answering a texting request — and the pages that sign you in or reset your password from an email are never recorded or measured by these tags. Other pages opened from a private link we send you, such as booking or cancelling a setup call, do not load the Google, Meta, or X tags, and PostHog records them with the private part of the link removed. Replays are part of analytics: they are recorded only after you choose “Accept all”, and turning measurement off turns them off too.

Separately from that choice, Carvikon keeps its own record of how the product is used — for example, that a car was added or moved on a board, on what kind of device, and when an account was created — in our own systems, to run, secure, and improve the service. Errors and account events such as creating an account are also reported from our servers to PostHog, acting as our service provider, so we can find and fix problems. These records are about your use of Carvikon; they do not include a shop's customer details, and they are not shared with Meta, X, or Google for advertising.

Two small cookies of our own sit outside that choice. When you arrive from one of our ads or campaign links, carvikon_attribution remembers which campaign it was (the campaign tags in the link, the page you landed on, the site that referred you, and the date) for up to 90 days, so we can tell which campaign led to an account. Only Carvikon reads it. It holds Google's or Meta's identifier for the ad click (gclid, gbraid, wbraid, fbclid) unless you have chosen “Reject all” or your browser sends Global Privacy Control. When an account that came from a Google ad pays for its first month, we send Google Ads that click identifier, the amount and a hashed copy of the account's email address, so Google can count the sale for the ad; nothing else from the cookie is sent to an advertising platform. If you choose “Reject all”, or your browser sends Global Privacy Control, we do not set it and we delete one already set. cv_lp remembers which version of a landing page you were shown, so the page does not change between your visits.

If your browser sends a Global Privacy Control signal, we treat that as an opt-out automatically. It overrides any earlier choice you made here, and we honor it on every visit without asking you to repeat yourself.

Some browsers can also send a “Do Not Track” signal. There is no agreed standard for what a website should do with it, so our site does not change what it does when it receives one. Analytics is already off until you choose “Accept all”, advertising measurement turns off as soon as you choose “Reject all”, and Global Privacy Control is honored as an opt-out.

Some of what these tags measure — a subscription payment, for example — happens after you have left the site, when no pixel can fire. For those events we send the same information directly from our servers to Meta's Conversions API instead, subject to the exact same choice as the pixel: we send them unless you have rejected advertising measurement, and never if your browser signals Global Privacy Control. Any personal identifier in a server-side event, such as your email address, is one-way hashed (SHA-256) before it leaves our servers. We do not send Meta or X your name, phone number, vehicle information, or anything from inside your Carvikon account.

You can change your advertising choice at any time on the Privacy Choices page.

Google user data

Connecting Google is optional and happens only after you choose a Google integration and grant permission on Google's consent screen. Carvikon requests only the access needed for the feature you connect:

• Gmail: your Google account email address and permission to send email from the connected mailbox. Carvikon uses this permission to send customer messages that you initiate or configure. Carvikon does not read your inbox, contacts, or existing email messages.
• Google Calendar: your Google account email address and calendar-event access. Carvikon uses this access only to create, update, and delete repair appointment events in the connected account's primary calendar so they remain synchronized with Carvikon.

We store the connected Google account identifier, granted scopes, and encrypted or access-controlled OAuth access and refresh tokens on our servers so the requested integration can continue to work when you are not actively using Carvikon. Tokens are never exposed to other Carvikon customers.

Signing in with Google is different from the integrations above: it shares only your name, email address, and profile picture to create and authenticate your Carvikon account, is handled by our authentication provider, and grants Carvikon no ongoing access to your Google account.

Finding your shop on Google Maps

When you type your shop's name during setup, Carvikon looks it up with Google Maps features (the Google Places service) so you can confirm your shop's details instead of typing them. To do that, our servers send Google what you type, a random code that ties one search together, the language you are using, and the approximate area your connection comes from (a city, not an address), so nearby shops come first. When you pick a result, we fetch that listing's name, address, phone number, and time zone and show them to you.

We keep the Google identifier of the listing you picked. Picking a result fills in the shop name box, and the name you leave there is saved as your shop's name. The address, phone number, and time zone become your shop's details only if you confirm or edit them; otherwise they are not stored. Google handles these requests under the Google Privacy Policy, and your use of these features is subject to the Google Maps/Google Earth Additional Terms of Service.

How we use information

We use information to provide and operate Carvikon, authenticate users, process subscriptions, deliver requested communications and calendar synchronization, secure and troubleshoot the service, provide support, comply with law, and improve Carvikon.

Marketing emails to you

If you agree when you create your account, or later in Settings, we may send occasional Carvikon product news, tips, and offers to the email address on your account. This is optional and separate from the notices below: you can turn it on or off at any time from Settings → Account. Turning it off never affects account, billing, or security notices, which we send whenever they are needed to run your account.

Text messages and your shop's customers

If your shop uses Carvikon to text its customers, we operate the messaging infrastructure that sends those messages on your shop's instructions. Whether and how a customer has agreed to receive texts, and how they can stop receiving them (usually by replying STOP), is set out in that shop's own text-message program, published in its own privacy policy and terms of service. Carvikon hosts those documents at a carvikon.com URL for shops that do not have their own website, but the shop publishes them and answers questions about them, not Carvikon. We do not use a shop's customer phone numbers or message content for our own marketing, and we do not sell them.

Separately, if you give Carvikon your own mobile number, for example on the setup screen or when you book a setup call with us, we may call that number about your Carvikon account. We text it only if you opt in, by ticking the texting box beside the number, and then only about your Carvikon account: the setup call you booked, onboarding reminders during your trial, subscription notices, and replies to your support requests. Message frequency varies. Message and data rates may apply. Reply STOP to any message to stop receiving texts, or HELP for help. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

AI phone calls and call recordings

Setup check-in calls from Carvikon. If you ask for a check-in call, by ticking the check-in box and giving us a phone number, Carvikon's automated setup assistant may call that number during business hours, with one retry if you miss it. The assistant speaks with an AI-generated voice and tells you at the start of the call that it is automated and that the call is recorded. We record the call and keep a transcript, a short summary, and the answers you give (for example, how your shop works and whether you would like help setting up), so the person who follows up with you knows what you said. Say "stop" on the call and that number is not called again; the call is optional and is not needed to use Carvikon.

These calls are handled for us by service providers: our voice platform, Vapi, places and records the call; Deepgram converts speech to text; and a large language model (currently from OpenAI, and possibly a comparable model from Google or Anthropic) generates the assistant's replies and the call summary. The recording is stored by our voice platform, and the transcript, summary, and answers are stored in our own database. We do not use call recordings or transcripts for advertising, we do not sell them, and Carvikon does not use them to train AI models.

We delete the transcript of a check-in call, and our link to its recording, 90 days after the call. The short summary and your answers stay with your account record for as long as we keep that record, as described in Security, retention, and deletion below. The audio file held by our voice platform is kept under that provider's own retention settings. You can ask us to delete a recording or transcript sooner by contacting us.

AI Front Desk calls for a shop. If a shop turns on the AI Front Desk, calls to that shop's number are answered by an AI assistant on the shop's behalf and are recorded and transcribed by the same providers. The shop controls those calls: by default Carvikon deletes their transcripts after 90 days and its links to their recordings after 30 days, the shop can change both in its settings, and the audio files held by our voice platform follow that provider's own retention settings. If you called a shop, contact that shop about the call first.

How we share information

We do not sell Google user data or other personal information. We disclose information only to service providers that help us operate Carvikon, to an integration provider when you direct us to use that integration, to professional advisers, or when required by law or necessary to protect users and the service. Service providers may process data only to perform services for Carvikon and must protect it appropriately.

Unless you have rejected advertising measurement, we also share hashed identifiers with Meta and X for that purpose only, as described in Cookies and advertising technology above.

Google user data is not used for advertising, retargeting, user profiling, credit or lending decisions, or sale to data brokers. We do not allow humans to read Google user data except when you give explicit permission for support, when required for security or legal compliance, or when the data has been aggregated and anonymized. Carvikon's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

Carvikon does not use Google Workspace API data to develop, improve, or train generalized or non-personalized artificial intelligence or machine-learning models.

Google Workspace API data is not transferred to artificial-intelligence services. Our use of information received from Google Workspace APIs adheres to the Google Workspace API User Data and Developer Policy, including its Limited Use requirements.

Security, retention, and deletion

We use reasonable administrative, technical, and organizational safeguards designed to protect information, including access controls and restricted server-side storage for OAuth credentials. No transmission or storage method is completely secure.

We retain information only as long as reasonably necessary to provide the service, maintain security, resolve disputes, and meet legal and accounting obligations. Google OAuth credentials are retained while the integration is connected. Disconnecting Gmail or Google Calendar in Carvikon deletes the stored connection credentials. You can also revoke access in your Google Account connections.

You can delete your account yourself in Settings › Account. A shop owner can also delete the whole shop there: its subscription is cancelled at once, everyone is signed out, and we permanently erase the shop's data within 30 days. Owners can download their shop's cars, customers, appointments and time records from the same page first. You may also request deletion of your account or personal information by emailing us. We will delete or de-identify information unless we must retain it for legal, security, fraud prevention, billing, or dispute-resolution purposes.

Children's privacy

Carvikon is a business tool for repair shops and is not directed to children. We do not knowingly collect personal information from anyone under 13. If you believe a child has given us personal information, contact us and we will delete it.

Your choices and rights

Depending on where you live, you may request access to, correction of, deletion of, or a portable copy of personal information and may object to or restrict certain processing. For customer or vehicle data entered by a repair shop, contact that shop first because it controls how that data is used.

Analytics is off until you allow it, and advertising measurement is on until you reject it. You can change either for a browser at any time on the Privacy Choices page. Your browser's Global Privacy Control signal, if enabled, keeps both off automatically in that browser and overrides any earlier choice — you do not need to use the notice or that page as well.

Contact and policy changes

Questions, privacy requests, and deletion requests can be sent to hi@carvikon.com, through the contact form, through our Help Center, which reach the same people, or by mail to 2047 NW 5th Ter, Cape Coral, FL 33993. We may update this policy as Carvikon, our practices, or legal requirements change. We will post the revised policy here and update its effective date.