Privacy policy

1. Who we are and how to reach us

ShopTop (Riyadh, Saudi Arabia) operates the ShopTop workshop-management platform at shoptop.world.

We play two roles. For workshop accounts (owners and staff) and for visitors to this website we are the controller: we decide why and how that data is used. For the data a workshop enters about its own customers — vehicle owners' names, phone numbers, emails, vehicles, work orders, invoices, bookings and inspection photos — the workshop is the controller and ShopTop is its processor: we store and process it only to provide the service on the workshop's instructions. If you are a workshop's customer, contact that workshop first; we will help it answer you.

To ask about your data or use your rights, use the data-request form at /privacy/request. We do not publish an email address for privacy requests, so every request is logged and tracked.

2. Last updated and change history

• 2026-10-26 — Added: the name and time recorded when a customer approves or declines an estimate online, next-service dates on vehicles, and the sign-in return page kept in session storage. Messages to customers open in the workshop's own WhatsApp or email app.
• 2026-10-25 — First PDPL-aligned policy: cookie choices, data-rights request form, retention periods, processor role.

3. Data we collect

• Account (workshop owners and staff): email and password, or your Google account's name and email if you sign in with Google; your full name (optional); your role and workshop. Required to create an account — without it we cannot provide the service.
• Workshop details: workshop name, address, phone, email, tax number, logo, rates and terms (entered by the workshop; optional except the name).
• Workshop customers' data (we are processor): customer names, phone numbers, emails, addresses and notes; vehicles (make, model, year, plate, VIN, colour, mileage, next-service date and mileage); work orders, estimates, inspections and inspection photos; the name typed and the time when a customer approves or declines an estimate from its link; invoices and payments recorded by the workshop; appointment and booking requests. When a workshop messages its customer from ShopTop, the message opens in the workshop's own WhatsApp or email app; ShopTop does not send it.
• Online booking form (/book/…): your name, email or phone (at least one is required so the workshop can reply), vehicle, service, preferred time and notes. Sent to that workshop.
• Support chat: the messages you type, the page you opened it from, and your account email if you are signed in. Optional — you can use the site without it.
• Data-rights requests: request type, name, email and/or phone, your message, and whether you were signed in.
• Technical and security data: a shortened one-way hash of your IP address used for rate limits (kept 3 days), Cloudflare's security cookie, and hosting logs.
• Cookie choice: a random consent id, the banner version, your choices and the date (no IP, no account).

4. How we collect it

• Directly from you: sign-up, settings, forms, support chat, uploads.
• From the workshop: a workshop enters its customers' and vehicles' data.
• From Google, if you choose "Continue with Google" (name and email).
• Automatically: essential cookies and local storage; and, only if you allow analytics, our hosting platform's page analytics and performance reports.

5. Why we use it and the legal basis

• Providing the workshop service, accounts, customer portal, share links and bookings — contract (and, for workshop customers' data, the workshop's instructions as processor).
• Answering support chats and data-rights requests — contract / legal obligation.
• Security, fraud and abuse prevention (rate limits, bot protection, error logs) — legitimate interest. We use hashed, shortened IPs and keep them only 3 days.
• Product analytics and performance measurement — consent (analytics cookies). You can refuse or withdraw it at any time.
• Remembering chat history and preferences on your device — consent (functional cookies).

6. Cookies and local storage

• Essential: sb-…-auth-token (sign-in session, local storage); shoptop-consent (your cookie choice); shoptop.branch (selected branch); shoptop.auth.redirect (the page to return to after sign-in, session storage, removed once you are signed in); __cf_bm (Cloudflare bot protection, 30 min); __dpl (Lovable hosting: keeps you on the same site version during a release, session).
• Functional (only with consent): shoptop-support-conversation and shoptop-support-messages (support chat history); shoptop.checklist-builder (checklist builder draft); shoptop.getting-started.hidden.* (dismissed tips); sidebar_state cookie (sidebar open/closed).
• Analytics and performance (only with consent): Lovable hosting's page analytics (/~flock.js → /~api/analytics, stored with its analytics provider Tinybird; session-id cookie, 30 min) and page-speed/error reports (/__l5e/). Until you allow analytics, our site blocks these requests and the cookie.
• Marketing and advertising: we do not use any.
• Change your choice any time with "Cookie settings" in the footer.

7. Who we share data with

• Lovable (Lovable Cloud) — website hosting, build and deployment, platform analytics (with consent; stored with Lovable's provider Tinybird), and the AI gateway.
• Supabase — database, sign-in and file storage (inspection photos), on Amazon Web Services.
• Cloudflare — content delivery and security in front of the site.
• Google — "Continue with Google" sign-in; and Google Gemini, which writes support-chat answers through the Lovable AI gateway.
• Account emails (confirmation and password reset) are sent by our sign-in provider (Supabase / Lovable Cloud). We do not use SMS.
• The workshop you book with or are a customer of sees the data it entered or that you sent it.
• Authorities, only when the law requires it. We never sell personal data.

8. Where your data is stored and transfers outside the Kingdom

Our database and file storage are in Amazon Web Services' eu-west-1 region (Ireland, EU). Hosting and Cloudflare serve the site from global data centres. Support-chat text is processed by Google Gemini, whose servers may be outside the Kingdom (including the USA).

These transfers are necessary to provide the service you asked for (Transfer Regulation, Art. 2). We send the minimum needed and rely on our providers' security and contractual safeguards.

9. AI and automated processing

Only the support chat uses AI: your messages go to Google Gemini through the Lovable AI gateway so it can answer questions about ShopTop. Before sending, we remove email addresses and phone numbers from your text; your name and account are not sent. Workshop records, customers and photos are never sent to AI. No decision with legal or similar effect is made about you solely by automated means — the chat can hand you to a person.

10. How long we keep data

• Workshop accounts and workshop data: while the account is active. On a deletion request we delete within 30 days, except records the law requires us or the workshop to keep, for that period.
• Workshop customers' data, bookings and inspection photos: as long as the workshop keeps them (the workshop can delete them); deleted with the workshop's account.
• Support chats: 12 months after the last message, then deleted automatically.
• IP-hash rate-limit counters: 3 days.
• Cookie consent records: 3 years.
• Data-rights requests: 3 years after they are closed, as a record that we answered.
• Analytics session cookie: 30 minutes.

11. How we protect your data

• Encrypted connections (HTTPS/HSTS); row-level security on every database table so each workshop sees only its own data; private file storage with short-lived links.
• Staff roles inside each workshop; administrator actions limited to a small list of platform admins.
• Server-only tables for consent records and privacy requests; rate limits on public forms and the chat.

12. Marketing messages

We do not send marketing messages. If we ever do, we will ask for your separate opt-in per channel first.

13. Children's privacy

ShopTop is a business service for people aged 18 and over. We do not knowingly collect data from children.

14. Your rights and how to use them

Under the Personal Data Protection Law you have the right to be informed; to access and get a copy of your data; to have it corrected; to have it destroyed when it is no longer needed; to withdraw consent; to complain; and to compensation as the law provides.

Use the form at /privacy/request. It is free. We answer within 30 days; if we need longer, we will tell you before the 30 days end, with the reason, and extend once by up to 30 more days. We may ask you to confirm your identity (being signed in counts).

15. Complaints and SDAIA

Please contact us first through /privacy/request (choose "Make a complaint"). If you are not satisfied, you can complain to the Saudi Data & AI Authority (SDAIA) at sdaia.gov.sa.

16. Changes to this policy

We update this page when our processing changes, change the date at the top and add a line to the history. For important changes we will also show a notice in the app or on the site before they take effect.