Privacy Policy

Last Updated: August 3, 2026 This Privacy Policy explains how 365 Solutions Group collects, uses, stores, and protects information from users of the garageauto.app, oficina.app, and smartgarage.app applications and websites. Because our services are offered in several countries, this policy includes a Regional Provisions section (Section 12) with additional information and rights that apply depending on where you are located. Where a regional provision conflicts with the general text, the regional provision prevails for users in that region.

1. Who We Are

The controller responsible for the processing of personal data described in this policy is:

• 365 Solutions Group LTDA
• Brasilia, Federal District, 903. Brazil, 71925720
• 📧 support@g365.app

For any question about this policy or about your personal data, write to support@g365.app. Please indicate your country of residence so we can apply the correct regional rules to your request.

2. Information We Collect

When registering for our applications, we may collect the following information:

• Name
• Email address
• Phone number
• Company information
• Tax identification number, where required to issue invoices — in Brazil, CPF or CNPJ
• Other personal registration data
• Password, securely stored using encryption
• Voluntarily provided information related to vehicles or repair shops, such as vehicle make, model, licence plate or VIN, mileage, maintenance dates, services performed, and products purchased
• Photographs, documents and audio recordings that you attach to repair orders, vehicle records or tasks

We may also automatically collect:

• Usage and navigation data within the applications
• Device and operating system information
• A push notification token, if you allow the application to send notifications. This token identifies your device installation and is used only to deliver notifications related to the service. You can revoke it at any time in your device settings.
• Cookies and similar identifiers, subject to Section 9

Data you enter about your own customers. If you use our applications to manage a repair shop, you may enter personal data relating to your customers, such as names, contact details and vehicle records. For that data, you are the controller and we act as a processor on your behalf, processing it only to provide the service, on your instructions, and as described in this policy or in a separate data processing agreement.

3. How We Use Information, and on What Legal Basis

We use personal data only for the purposes below. Where the law of your country requires a legal basis for each purpose, the applicable basis is indicated:

• To create your account, authenticate you and provide the contracted service — performance of a contract with you.
• To process subscription payments and issue billing records — performance of a contract, and compliance with legal and tax obligations.
• To provide technical support and send operational messages about the service, such as service changes, security notices and billing notices — performance of a contract.
• To keep the platform secure, prevent fraud and abuse, and maintain system integrity — our legitimate interest in protecting the service and its users.
• To measure and improve the performance of our applications and websites — your consent where consent is required for the technologies used, otherwise our legitimate interest.
• To send commercial communications about our products — your consent, or our legitimate interest where permitted by local law. You can opt out at any time.
• To comply with legal obligations and to establish, exercise or defend legal claims — compliance with a legal obligation, or our legitimate interest.

We do not use personal data to make automated decisions that produce legal effects concerning you or that similarly significantly affect you.

4. Data Sharing

We do not sell your personal information. We disclose personal data only in the following situations:

• To service providers that support our operations, acting on our instructions and under confidentiality and security obligations. These providers fall into the following categories: hosting and database infrastructure, application delivery, website hosting, payment processing, audience measurement and website analytics, and advertising measurement. They are located in Brazil, the United States and the European Union. You may request the current list of our processors at any time by writing to 📧 support@g365.app.
• When required by applicable law, regulation, court order, or a competent governmental authority.
• In connection with a corporate transaction, such as a merger, acquisition or transfer of assets, in which case we will inform you and the recipient will remain bound by this policy.

Measurement and advertising technologies run only on our public websites and sign-up pages. They are not active inside our mobile applications distributed through the App Store and Google Play.

5. International Transfers of Personal Data

Our application data is hosted on Amazon Web Services (AWS) in the United States, in the us-west-1 region (Northern California). Our applications are delivered through Vercel, and our websites are hosted by Hostinger. This means that if you are located outside the United States, your personal data is transferred to and stored in the United States, and may be accessed by our team and by our service providers from other countries where we operate, including Brazil. We rely on the safeguards required by the law of your country, as described in Section 12. Regardless of where data is stored, the protections described in this policy apply to it. You may request further information about the transfer and the applicable safeguards by writing to support@g365.app.

6. Storage and Security

Your information is stored on protected servers and systems. We implement reasonable technical and organizational measures, including encryption, access controls, monitoring, and security procedures designed to safeguard personal information against unauthorized access, disclosure, alteration, or destruction. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a security incident affecting your personal data occurs, we will notify you and the competent authority where applicable law requires it, within the time limits set by that law.

7. How Long We Keep Data

We keep personal data only for as long as necessary for the purposes described in this policy.

• Active accounts: for as long as the account or subscription remains active.
• After cancellation: we may retain account data, documents, service records, repair orders and images for up to 90 (ninety) days, to allow reactivation, to respond to requests, and to resolve disputes. After this period the data may be permanently deleted without possibility of recovery.
• Longer retention: where accounting, tax or other legal obligations require us to keep certain records for a longer period, we keep only what those obligations require.

8. Children

Our services are intended for businesses and adult users. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, write to support@g365.app and we will delete it.

9. Cookies and Similar Technologies

Our websites and sign-up pages use cookies and similar technologies for the following purposes:

• Strictly necessary — required to operate the service, keep you signed in and maintain security. These cannot be switched off.
• Measurement and performance — to understand how our pages are used, so we can improve them. This includes Google Analytics and Microsoft Clarity.
• Advertising — to measure the performance of our advertising campaigns. This includes Google Ads and the Meta Pixel.

You can refuse or delete non-essential cookies at any time through your browser settings, and you may ask us to stop processing your data for measurement or advertising purposes by writing to 📧 support@g365.app. Refusing non-essential cookies does not prevent you from using our services. These technologies are not active inside our mobile applications. The versions of our applications distributed through the App Store and Google Play do not load measurement or advertising tags, and do not track you across other companies’ apps or websites.

10. Advertising

We advertise our own products on third-party platforms, including Google and Meta, and use measurement tools to understand which campaigns are effective. For that purpose, our public websites and sign-up pages may send those platforms information about page views and sign-up events, together with the identifiers described in Section 9. We do not sell your personal data. We do not share the business, vehicle or customer records you enter into our applications with advertising networks, and no advertising or measurement technology runs inside our mobile applications.

11. Your Rights

Depending on your country, you have all or some of the following rights in relation to your personal data:

• Confirmation that we process your personal data, and access to it
• Correction of inaccurate, incomplete or outdated data
• Deletion of your account and personal data
• Restriction of processing, or objection to certain processing activities
• Portability of data you provided to us, in a structured, commonly used, machine-readable format
• Withdrawal of consent, at any time, where processing is based on consent — this does not affect the lawfulness of processing carried out before the withdrawal
• Information about how your data is shared
• To lodge a complaint with the competent supervisory authority in your country — see Section 12

To exercise any of these rights, write to support@g365.app. We will respond within the period required by the law applicable to you. We may need to verify your identity before acting on a request. We do not charge for these requests and we will not treat you differently for making one. If the request concerns data that a repair shop entered about its own customers, we will refer you to that repair shop, which is the controller of that data.

12. Regional Provisions

12.1. European Economic Area, including France and Spain

If you are located in the European Economic Area, the General Data Protection Regulation (GDPR) applies to the processing described in this policy.

• Controller: the entity identified in Section 1.
• Legal bases: as set out for each purpose in Section 3.
• Transfer to the United States: as described in Section 5, personal data is hosted on AWS in the United States. This transfer is made under the Standard Contractual Clauses adopted by the European Commission in June 2021, which are incorporated into our agreements with the service providers concerned, in accordance with Article 46(2)(c) of the GDPR. You may request further information about these safeguards by writing to support@g365.app.
• Your rights: access, rectification, erasure, restriction, objection, portability, and withdrawal of consent, as listed in Section 11.
• Right to lodge a complaint: you have the right to lodge a complaint with the supervisory authority of your country of residence, work, or of the place of the alleged infringement. In France, the authority is the Commission nationale de l’informatique et des libertés (CNIL) — www.cnil.fr. In Spain, it is the Agencia Española de Protección de Datos (AEPD) — www.aepd.es. A list of all authorities is available on the European Data Protection Board website.

12.2. Canada, including Québec

If you are located in Canada, the federal Personal Information Protection and Electronic Documents Act (PIPEDA) applies, and if you are located in Québec, the Act respecting the protection of personal information in the private sector, as amended by Law 25, also applies.

• Person in charge of the protection of personal information: Robério Santos — 📧 support@g365.app.
• Storage outside Québec: as described in Section 5, your personal information is stored in the United States. Before transferring personal information outside Québec, we assess whether it would receive adequate protection, having regard in particular to the sensitivity of the information, the purposes for which it is to be used, and the protection measures in place.
• Confidentiality incidents: we keep a register of confidentiality incidents and, where an incident presents a risk of serious injury, we notify the Commission d’accès à l’information and the persons concerned, as required by law.
• Your rights: in addition to the rights in Section 11, you have the right to access and rectify your personal information, and the right to receive the personal information you provided to us in a structured, commonly used technological format.
• Complaints: in Québec, to the Commission d’accès à l’information du Québec — www.cai.gouv.qc.ca. Elsewhere in Canada, to the Office of the Privacy Commissioner of Canada — www.priv.gc.ca.

12.3. Brazil

If you are located in Brazil, the Lei Geral de Proteção de Dados (LGPD, Law No. 13.709/2018) applies.

• Encarregado (Data Protection Officer): Robério Santos — 📧 support@g365.app.
• Your rights under Article 18 of the LGPD include: confirmation of processing; access; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary or excessive data or data processed in breach of the law; portability; deletion of data processed with consent; information about entities with which we shared data; information about the possibility of refusing consent and the consequences of doing so; and revocation of consent.
• International transfer: as described in Section 5, data is stored in the United States, in accordance with Articles 33 to 36 of the LGPD.
• Complaints: to the Autoridade Nacional de Proteção de Dados (ANPD) — www.gov.br/anpd.

12.4. Mexico

If you are located in Mexico, the Ley Federal de Protección de Datos Personales en Posesión de los Particulares applies, and this policy serves as our privacy notice (aviso de privacidad).

• Identity and address of the controller: as stated in Section 1.
• Data collected and purposes: as stated in Sections 2 and 3. The purposes necessary to provide the service are primary purposes; measurement and commercial communications are secondary purposes, which you may refuse without affecting your access to the service.
• ARCO rights: you have the right of Access, Rectification, Cancellation and Opposition in relation to your personal data, and the right to revoke consent and to limit the use or disclosure of your data. Requests should be sent to support@g365.app, indicating your name, a means of contact, a description of the data concerned, and documents proving your identity.
• Transfers: as described in Sections 4 and 5.
• Complaints: to the competent Mexican data protection authority.

12.5. Türkiye

If you are located in Türkiye, the Kişisel Verilerin Korunması Kanunu (KVKK, Law No. 6698) applies.

• Data controller: the entity identified in Section 1.
• Purposes and legal grounds: as described in Section 3.
• Transfer abroad: as described in Section 5, personal data is stored on servers located in the United States.
• Your rights under Article 11 of the KVKK include: learning whether your personal data is processed; requesting information about the processing; learning the purpose and whether the data is used accordingly; knowing the third parties to whom data is transferred, in Türkiye or abroad; requesting rectification, erasure or destruction; requesting notification of such actions to third parties; objecting to results produced exclusively by automated systems; and claiming compensation for damage arising from unlawful processing.
• Applications and complaints: requests may be submitted to support@g365.app, and complaints to the Kişisel Verileri Koruma Kurumu (KVKK Board) — www.kvkk.gov.tr.

12.6. United States

If you are a resident of a U.S. state with a comprehensive privacy law, including California, you may have the right to know what personal information we collect and how we use and disclose it; to request access to, correction of, or deletion of your personal information; to obtain a copy of it; and not to be discriminated against for exercising these rights. We do not sell personal information, and we do not share it for cross-context behavioral advertising. Requests may be sent to support@g365.app.

13. Changes to This Policy

This Privacy Policy may be updated periodically to reflect changes in our services, legal requirements, or business practices. We will update the “Last Updated” date at the top and, where the change is significant, we will inform users through the applications or by email. The most current version will always be available within our applications and on our websites.

14. Contact

If you have any questions regarding this Privacy Policy or your personal information, please contact us: 📧 support@g365.app