Privacy Policy

1. Two groups of people, two roles

Workshops that buy Faro: we hold their business details, sign-in details and subscription records, and we decide how that information is used.

A workshop’s own customers: their names, phone numbers, vehicle details and billing history are held on the workshop’s behalf and on its instructions. If you are a workshop’s customer and want your details corrected or removed, ask the workshop first — it controls its records and can act immediately. If it cannot help, write to us and we will help it do so.

2. What we handle

• From workshops: business name, address, phone and email; owner and staff names; sign-in emails and password hashes (never plain passwords); subscription and plan records; machine identifiers used to tie a licence to a counter; and, where a workshop signs in with Google, the verified email address of that Google account.
• From a workshop’s customers, entered by the workshop: name, phone number and, if recorded, an address; vehicle registration, make, model and meter readings; service history, bills, amounts and balances; whether they have asked not to be messaged; and a record of messages sent to them.
• Automatically, on our servers: request and error logs from our online services, and sync times and device status so a workshop can see whether its data is current. The desktop software does not send crash reports or usage analytics.

We do not collect browsing history, location, phone contacts, or anything unrelated to running a workshop.

3. Where the data lives

On the workshop’s own computer, first. Faro is installed on the workshop’s counter PC and its records — customers, vehicles, bills, stock — are stored there.

On our servers, only for the online features a workshop uses: summaries it chooses to sync to the owner dashboard (such as daily sales, profit, top products and amounts owed — not individual customers’ details), encrypted backups, licence and account records, and WhatsApp delivery notifications. Our servers are hosted with DigitalOcean.

Decision needed: Confirm every hosting provider for the owner and admin web portals (the infrastructure notes mention Vercel as well as DigitalOcean) and list each one here.

Backups are encrypted on the workshop’s computer before upload. To be plain: the encryption key for a backup is generated and held by our systems, so we are technically able to decrypt a workshop’s backup. We do so only to restore the workshop’s own data at its request, or where the law requires it.

4. WhatsApp messages

Where a workshop uses WhatsApp, the software sends that workshop’s customers bills, service reminders and payment reminders. The workshop is the sender: its own WhatsApp Business account and business name are used, and customers reply to the workshop. The workshop pays Meta directly; we do not resell messages.

To send a message, the recipient’s phone number, the message content and, where a bill is attached, the bill document are sent to Meta, which processes them under its own terms. The attached bill is uploaded to Meta at the moment of sending; we keep no copy of it on our servers.

Workshops are responsible for having their customers’ agreement before sending promotional messages. The software records each customer’s choice, and stops all messages to a customer the workshop has marked as opted out. Customers who want to stop receiving messages should tell the workshop.

The record of what was sent, to which number and when is kept on the workshop’s computer. Meta’s delivery notifications pass through our servers on their way to the workshop’s computer. The identifier in those notifications contains the recipient’s phone number, so we treat it as personal information: it is kept only while delivery is being recorded and is removed automatically after that.

5. Online payments

When online payment opens, subscriptions bought online are sold by Paddle.com as Merchant of Record. Paddle collects the payment details and processes the payment under its own privacy notice; we receive confirmation of the subscription and Paddle’s reference numbers, not card details.

6. This website

This website sets no cookies and runs no analytics or advertising trackers. Its fonts are served from this site. The pricing page asks our server for current prices, which, like any web request, shares your browser’s IP address with our server. Links to WhatsApp and email open those services, which handle your message under their own terms.

Its one form is the sign-up page. If you start a subscription online, we ask for your email address and, if you choose, your business name. We email you a 6-digit code to confirm the address is yours; the code expires after a short time. We use the address to set up your account and to send you billing notices. Your browser keeps proof of the confirmation in the page’s memory only, until you leave the page.

When you continue to payment, the page loads Paddle’s checkout from Paddle’s servers, and Paddle handles your payment details under its own privacy notice.

Decision needed: How long we keep the email address (and business name) of someone who asks for a code but never completes a purchase; how long we keep our copy of each email we send (the outgoing-email log currently keeps the message, including the code); and which email provider sends the codes and billing notices (it must then be listed in section 7).

7. Who else sees the data

We do not sell personal information or share it for advertising. We use these providers to run the service: DigitalOcean (hosting and encrypted backup storage), Meta (delivery of messages a workshop sends), Google (sign-in, where a workshop chooses it) and, once online payment opens, Paddle (payments). They operate outside Pakistan, so data is transferred internationally.

We may disclose information where the law requires it. If we are compelled to hand over a workshop’s data, we will tell the workshop unless the law forbids it.

8. How long we keep it

• Workshop account and subscription records: while the subscription is active, and afterwards for as long as tax and company law require.
• Customer and billing records: on the workshop’s computer, for as long as the workshop keeps them.
• WhatsApp delivery notifications on our servers: up to 90 days; phone-number identifiers within them are removed sooner, once delivery is recorded.

Decision needed: Confirm the retention periods for backups, diagnostic logs and closed accounts before stating them (the earlier draft said one year, 30 days and 90 days; none is enforced or verified yet).

9. Your rights

You may ask us to tell you what we hold about you, correct it, delete it (subject to what the law requires us to keep), give you a copy, or stop using it for a particular purpose. Write to privacy@jenixlabs.com; we will reply within 30 days and do not charge for this. If you are a workshop’s customer, we will usually pass your request to that workshop, tell you we have done so, and help it act.

10. Security

• Data travelling to our servers is encrypted with TLS.
• Backups are encrypted before they leave the workshop’s computer.
• Passwords are stored only as one-way hashes.
• A workshop’s WhatsApp access token is stored on the workshop’s own computer, in the operating system’s secure storage. When a workshop connects its account through our sign-up page, our server holds the token only for the few minutes until the workshop’s computer collects it, then erases it.

No system is perfectly secure. If a breach affects a workshop’s data, we will tell that workshop promptly what happened, what was affected and what we are doing about it.

11. Children, changes and contact

Faro is for businesses; we do not knowingly collect information about anyone under 18 except as entered by a workshop as its customer, which is the workshop’s record. We will post changes here and update the date; material changes will be emailed to workshops before they take effect.

Jenix Labs (SMC-Private) Limited, Multan, Punjab, Pakistan. privacy@jenixlabs.com