Privacy Policy

Last updated 21 August 2026

The short version: we collect what we need to show up at the right address, in the right car, at the right time, and to take a deposit. We don't run analytics, we don't run advertising trackers, and we don't sell anything to anybody.

01Who we are

Cipher Auto Lab LLC is a Connecticut limited liability company providing mobile auto detailing across New Haven County, the Naugatuck Valley and central Connecticut. This policy covers cipherautolab.com and the bookings made through it.

Reach us at (203) 592-9589 or hello@cipherautolab.com.

02What we collect

Things you type into the booking form

• Your name, phone number and email address
• The service address and town where the vehicle will be
• Vehicle make, model and size, and its rough condition
• Where the vehicle is parked, and the date and time window you want
• Any notes you choose to add

Photos you send for a quote

• The photos themselves, plus your name, phone number, town, which service you were asking about, and any note you add
• Your browser shrinks each photo before it is sent, so what reaches us is a reduced copy rather than the original file

These go straight out as an email attachment to us. They are not stored on this website — there is no upload folder and no image host involved. They live in our email inbox, and that is the only copy we hold.

Your signature on the Service Agreement

When you sign the Service Agreement at booking we record the name you typed, the version you agreed to, the date and time, and the IP address the signature came from. That last one exists so the agreement can be shown to be genuine if it is ever questioned — it protects you as much as us. It is stored on the payment record and nowhere else.

Payment details

Card numbers go from your browser straight to Stripe, our payment processor. They do not pass through this website and we never see or store them. What we can see afterwards, in the Stripe dashboard, is the booking reference, the amount, the last four digits, and whether it succeeded.

Things collected automatically

• Server logs. Our host, Vercel, records standard request information — IP address, browser type, the page requested and the time. This is ordinary web-server operation and is used for security and troubleshooting.
• Stripe's fraud checks. Stripe's payment library loads on this site so the deposit form can work. Stripe collects device and browsing information for fraud prevention and may set its own cookies. That processing is governed by Stripe's privacy policy.

03What we don't do

04Why we collect it

That's the whole list. We don't collect anything we don't use.

05Who else sees it

Three companies, each doing one job:

• Stripe — processes the deposit and the balance. Your booking details are attached to the payment record so we have one place to look them up. Stripe's privacy policy.
• Vercel — hosts the website and keeps the server logs described above. Vercel's privacy policy.
• Your own phone or email provider — if card payment isn't available and the booking is sent as a text or an email instead, that message goes through your own app and carrier in the normal way.

Beyond that, we'd only hand over information if the law required it — a subpoena, a court order, or something similar. If that ever happened and we were permitted to tell you, we would.

06How long we keep it

• Payment and booking records stay in Stripe for as long as we're required to keep business and tax records, which in practice is about seven years.
• Server logs are short-lived and rotate out automatically on our host's schedule.
• Texts and emails between us stay in the phone and inbox until deleted.

There is no separate customer database. The payment record is the record.

07Getting a copy, or having it deleted

Call or email and ask. We'll send you what we hold, correct anything that's wrong, or delete it. No forms and no fee.

Connecticut's data privacy law sets thresholds that a business our size is well below, so most of it doesn't formally apply to us. We handle these requests anyway — it's a reasonable thing to ask for.

08Calls and text messages

When you book, you're agreeing that we can call or text you about that booking — confirming it, telling you we're running late, asking which driveway. Standard message and data rates apply.

We don't send marketing texts. If that ever changes we'll ask first, and reply STOP will always work.

09Photos of your vehicle

We photograph vehicles before and after work, mostly as a record of condition. We'd like to use some of them to show what we do.

• We ask before posting a photo of your vehicle publicly.
• License plates are cropped or removed.
• We don't post the address, the location, or anything visible inside the vehicle that identifies you.
• If a photo of your car is already up and you want it gone, tell us and it comes down.

At booking there is an optional tick-box for this. It is off by default, declining it changes nothing about the service or the price, and your answer is recorded with the booking so we can check it before anything gets posted.

Photos you send us for a quote are a separate thing and the default is the other way round. They are used to work out your price and for nothing else. We will not put one on the site, on Facebook, or in an ad without asking you first and getting a yes. Ask us to delete them and they go out of the inbox.

10Security

The site is served over HTTPS only. Card details never touch our systems, which keeps the risk where it belongs — with a payment processor built for it. There is no customer database on this website to breach, because there is no database at all.

No system is perfect, and we're not going to claim otherwise. If something ever went wrong that affected your information, we'd tell you directly rather than hope you didn't notice.

11Children

This is a service for vehicle owners. The site isn't directed at children and we don't knowingly collect information from anyone under 13. If you believe a child has sent us information, call and we'll delete it.

12Changes to this policy

If this policy changes, the date at the top changes with it. If a change actually affects how we handle your information — rather than just fixing a typo — we'll say so on the site rather than quietly swapping the page.