Privacy Policy

1.1 Personal Identification Information: When you request repair services, we collect your full legal name, residential or business address, phone number(s), email address, and government-issued identification (driver's license number and state) for identity verification and loaner vehicle authorization.

1.2 Vehicle Information: We collect and store your Vehicle Identification Number (VIN), make, model, year, mileage, license plate number, and color. We may also access your vehicle's onboard diagnostic system (OBD-II) to retrieve fault codes, engine parameters, and electronic system data necessary for proper repair.

1.3 Insurance Information: If you file an insurance claim, we collect your insurance carrier name, policy number, claim number, adjuster contact information, and coverage details.

1.4 Financial Information: For payment processing, we may collect credit/debit card numbers, bank account information (for ACH payments), and billing addresses. Payment card information is processed through PCI-DSS compliant third-party payment processors and is not stored on our systems.

1.5 Photographic Documentation: We capture photographs and video recordings of your vehicle before, during, and after repairs for quality control, insurance documentation, and dispute resolution purposes. These images may include the vehicle's interior if interior damage or cleaning is involved.

1.6 Communications: We retain records of phone calls, emails, text messages, and in-person conversations related to your repair service, including appointment scheduling, estimate approvals, and service updates.

2.1 Service Delivery: Your information is primarily used to perform collision repairs, order parts, schedule appointments, communicate repair status, and process payments.

2.2 Insurance Processing: We submit estimates, supplements, and photographic evidence to insurance carriers on your behalf to facilitate claim approval and payment.

2.3 Legal Compliance: We may use your data to comply with New York State DMV regulations, consumer protection laws, tax obligations, and court orders or subpoenas.

2.4 Quality Assurance: Photographs and repair records are reviewed internally to maintain quality standards and train technicians.

2.5 Safety and Fraud Prevention: We may analyze data to detect fraudulent insurance claims, prevent theft, and ensure facility security through video surveillance.

3.1 Third-Party Service Providers: We share information with trusted partners who assist in business operations:

• Parts Suppliers: VIN and vehicle specifications for accurate parts ordering (e.g., OEM dealerships, aftermarket distributors).
• Paint Manufacturers: Color codes and paint formulas are shared with PPG for Moonwalk system color matching.
• Towing Companies: Vehicle location and your contact information for recovery services.
• Rental Car Agencies: Driver's license and insurance information for loaner vehicle authorization.
• Payment Processors: Financial institutions and merchant service providers (Stripe, Square, etc.) to process transactions.

3.2 Insurance Companies: We are required to share estimates, photographs, repair invoices, and vehicle history with your insurance carrier to process claims. This may include third-party appraisal services hired by insurers.

3.3 Legal Authorities: We will disclose information when required by law, including responses to subpoenas, court orders, law enforcement requests, or to establish/defend legal claims.

3.4 Business Transfers: In the event of a merger, acquisition, or sale of assets, customer data may be transferred to the acquiring entity, subject to the same privacy protections.

3.5 No Sale of Data: We do NOT sell, rent, or trade your personal information to third-party marketers, data brokers, or advertisers.

4.1 Physical Security: Paper records containing personal information are stored in locked filing cabinets within secure areas of our facility. Access is restricted to authorized personnel only. Surveillance cameras monitor entry points 24/7.

4.2 Digital Security: Our website is hosted on Cloudflare Pages with SSL/TLS encryption to protect data transmission between your browser and our servers. We do not store sensitive customer information such as payment details or personal data on our website or digital systems. Any customer information collected for repair services is stored securely in physical records at our facility, as described in section 4.1.

4.3 Employee Training: All staff members receive annual privacy and security training and sign confidentiality agreements.

4.4 Secure Disposal: Physical documents are cross-cut shredded after the retention period. Digital files are securely wiped using DOD 5220.22-M standards.

4.5 Breach Notification: In the unlikely event of a data breach affecting your information, we will notify you via email and/or postal mail within 72 hours of discovery, as required by New York State law (NY General Business Law § 899-aa).

5.1 Active Records: Repair orders, invoices, and photographs are retained for a minimum of seven (7) years to comply with New York State tax law and statute of limitations for breach of contract claims.

5.2 Insurance Records: Documents related to insurance claims are retained for ten (10) years due to extended claim dispute windows.

5.3 Marketing Data: If you opt into marketing communications, your contact information is retained until you unsubscribe.

5.4 Video Surveillance: Security camera footage is retained for 90 days unless needed for an investigation or legal proceeding.

6.1 Access: You have the right to request a copy of the personal information we hold about you. We will provide this within 30 days of a verified request.

6.2 Correction: If your information is inaccurate or incomplete, you may request corrections by contacting us at privacy@nuplusauto.com.

6.3 Deletion: You may request deletion of your personal information, subject to legal retention requirements (e.g., tax records, pending legal matters). Some data may be retained in backup systems for up to 90 days.

6.4 Opt-Out of Marketing: You may unsubscribe from promotional emails at any time by clicking the unsubscribe link or emailing support@nuplusauto.com.

6.5 Do Not Track: Our website currently does not respond to "Do Not Track" browser signals, but we do not track users across third-party websites.

7.1 No Tracking Policy: We respect your privacy and do not use cookies or tracking technologies to monitor your behavior, collect personal data, or track you across websites.

7.2 Essential Functionality: Our website operates without relying on cookies. Any session data required for basic functionality (such as form submissions) is handled securely and temporarily without storing tracking information on your device.

7.3 Third-Party Services: We do not integrate third-party analytics, advertising networks, or tracking services. Your visit to our site remains private and is not shared with external parties for marketing or analysis purposes.

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from minors without parental consent. If you believe we have inadvertently collected information from a child, please contact us immediately at privacy@nuplusauto.com for prompt deletion.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information (subject to exceptions)
• Right to opt-out of the sale of personal information (we do not sell data)
• Right to non-discrimination for exercising CCPA rights

To exercise these rights, email privacy@nuplusauto.com or call (347) 692-8698.

We reserve the right to modify this Privacy Policy at any time to reflect changes in our practices, technology, legal requirements, or business operations. The "Last Updated" date at the top of this page indicates when the policy was last revised. Material changes will be communicated via email to customers with active service records or by posting a notice on our website for 30 days.