Privacy Policy

Effective Date: January 1, 2026 — Last Updated: January 1, 2026

Phlite Software LLC ("Carmic," "we," "us," or "our") provides vehicle repair management software through our mobile applications for iOS and Android (the "Mobile App"), our Windows desktop application (the "Desktop App"), and our web portal at carmicai.com (the "Web Portal," and collectively with the Mobile App and Desktop App, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use any part of the Service.

By creating an account or using the Service, you consent to the practices described herein. If you do not agree with this Privacy Policy, do not use the Service.

1. Information We Collect

1.1 Account Information

Registration Data. Name, email address, and password when you create an account. If you sign in via a third-party service (e.g., Apple Sign-In, Google Sign-In), we receive the profile information you authorize that service to share.
Organization Data. Company name, shop name, job title, industry, and account location you provide during onboarding or in settings.
Payment Information. If you subscribe to a paid plan, payment is processed by our third-party payment processor. We do not store full credit card numbers. We receive only a tokenized reference, billing address, and last four digits for receipt purposes.

1.2 Repair File and Project Data

Repair File Information. Vehicle identification numbers (VINs), customer names, insurance company names, claim numbers, job numbers, vehicle descriptions, and other repair-specific data you enter or that is extracted from uploaded documents.
Photographs and Images. Photos captured within the App or uploaded to the Web Portal, including vehicle damage photos, AR markout photos, part photos, quality control photos, and estimate screenshots. Photos are stored locally on your device and, when synced, on our cloud infrastructure.
Voice Recordings and Transcriptions. When you use voice note or voice annotation features, audio is recorded and transcribed. Audio files and transcriptions are stored locally and, when synced, on our cloud infrastructure. Transcription may be performed on-device using offline speech recognition engines or via third-party cloud speech-to-text services.
AR Markout Data. When you use the augmented reality spatial annotation feature, the App processes data from your device's camera, accelerometer, gyroscope, and LiDAR sensor (if available). AR session data (3D coordinates, plane detection, measurements) is processed locally on your device. Measurement metadata (polygon coordinates, perimeter, area, confidence scores) is stored as part of your repair file data.
AI-Processed Image Data. When the Service performs AI-powered analysis (tag suggestions, estimate analysis, document extraction), a processed portion of your image or document is transmitted to a third-party AI inference service. Transmitted images are cropped and resized to low resolution for efficient processing. The AI service processes the data to return results and does not retain your content after processing. See Section 4 for details.
Estimates and Documents. Insurance estimates, supplements, and related documents you upload or that are extracted via AI analysis.

1.3 OEM Procedures and Third-Party Reference Materials

Important: How Carmic Handles OEM Procedures and Copyrighted Materials.

Carmic's AI features assist technicians in comprehending and executing OEM (Original Equipment Manufacturer) repair procedures and other industry reference materials within the context of a specific repair on a specific vehicle. Carmic does not aggregate, index, compile, redistribute, or create a searchable database of OEM procedures or other copyrighted materials. OEM procedures and third-party reference documents are accessed, referenced, and applied exclusively as work product within individual repair files belonging to your account. These materials are never grouped across accounts, shared between accounts, made publicly accessible, or used to build derivative databases. Each account's use of such materials is isolated to that account's specific repair files for specific repairs.

1.4 Device and Sensor Data

Device Information. Device model, operating system version, app version, unique device identifiers, and language settings.
Location Data. With your permission, GPS coordinates are embedded in photograph metadata at the moment of capture. The Mobile App may also use location to provide contextual features (e.g., associating your device with a shop location). You can disable location access in your device settings at any time. We do not continuously track your background location.
Motion and Sensor Data. Accelerometer and gyroscope data used for AR features. This data is processed locally on your device and is not transmitted to our servers.
Camera and Microphone. Camera access for photo/video capture and AR features. Microphone access for voice notes, voice annotations, and real-time transcription. These sensors are activated only when you use the relevant feature.

1.5 Contacts and Calendar (Optional)

With your permission, the Mobile App may access your contacts (for customer lookup) and calendar (for scheduling). This data is used only for the feature you initiated and is not transmitted to our servers or shared with third parties.

1.6 Automatically Collected Data

Usage Analytics. Aggregated, anonymized usage data such as feature usage frequency, session duration, and crash reports. This data does not include your photographs, voice recordings, repair file content, or customer information.
Log Data. When you access the Web Portal, server logs may include IP address, browser type, pages visited, and referring URL.
Real-Time Communication Data. The Service uses real-time messaging (SignalR) to deliver notifications and sync updates between devices. Connection metadata (device type, account identifier) is used for message routing and is not stored beyond the active session.

2. How We Use Your Information

Purpose	Data Used
Provide and operate the Service across all platforms	Account info, repair file data, photographs, annotations
AI-powered analysis (tag suggestions, estimate extraction, document comprehension)	Cropped/resized image regions, document content, capture mode context
Transcribe voice notes and annotations	Audio recordings
Sync your data across your devices	Repair files, photographs, annotations, settings
Generate reports and exports	Repair file data, photographs, annotations, measurements
Deliver real-time notifications	Account identifier, device type, notification content
Send service communications (email, SMS)	Email address, phone number (when provided)
Process payments	Payment tokens, billing address
Improve the Service	Anonymized usage analytics, crash reports
Respond to support requests	Support communications, account info
Comply with legal obligations	As required by applicable law

We do not:

• Sell your personal information or repair file data to third parties

• Use your photographs, voice recordings, or repair data for advertising purposes

• Train AI models on your content

• Share your repair file data with other Carmic accounts unless you explicitly initiate sharing

• Aggregate or redistribute OEM procedures or other copyrighted reference materials across accounts

• Create searchable databases or compilations of third-party copyrighted content

3. Data Storage and Security

3.1 Local Storage

The Mobile App and Desktop App store photographs, voice recordings, and repair file data locally on your device. Core features function fully offline. Cloud sync is used to back up your data and enable access across devices.

3.2 Cloud Storage

When you use the Service, your synced data is stored on cloud infrastructure hosted in the United States (Amazon Web Services). Data is encrypted in transit (TLS 1.2+) and at rest (AES-256).

3.3 Account Isolation

Each Carmic account's data is logically isolated. Repair files, photographs, documents, and all associated data belong to and are accessible only by the account that created them. We do not aggregate data across accounts or provide cross-account access unless you explicitly share a specific item with a specific recipient.

3.4 Security Measures

Encryption of data in transit and at rest
Access controls limiting employee access to user data on a need-to-know basis
Secure authentication with hashed passwords and optional biometric unlock
Regular security assessments of infrastructure and application code
Background upload service with retry logic to prevent data loss during network interruptions

No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

4. Third-Party Services

The Service integrates with the following categories of third-party services to provide its functionality:

Service Category	What Is Shared	Purpose
AI/LLM Vision and Language Models (e.g., Google Gemini via OpenRouter)	Cropped, resized image regions; document text; structured prompts	AI tag suggestions, estimate analysis, document comprehension, OEM procedure interpretation for specific repairs
Speech-to-Text Services (e.g., ElevenLabs, Deepgram)	Audio stream	Transcribe voice notes and annotations
Text-to-Speech Services (e.g., ElevenLabs)	Text content	Voice playback of AI responses
Offline Speech Recognition (Vosk, SherpaOnnx)	Audio processed locally on device	On-device transcription without network
Cloud Storage (AWS S3)	Photographs, audio files, synced repair data	Cloud storage and cross-device sync
Email Delivery (AWS SES)	Recipient email, message content	Transactional and notification emails
SMS (Twilio)	Phone number, message content	SMS notifications when configured by your account
Payment Processing	Payment method details	Subscription billing
Analytics (anonymized)	Anonymized usage events, crash data	App stability and improvement

Each third-party service is bound by its own privacy policy and, where applicable, data processing agreements with us. We select providers that meet industry-standard privacy and security requirements. We do not permit third-party providers to use your data for purposes other than providing the requested service.

AI inference providers process your submitted data in real time and do not retain images, documents, or text content after returning results. We do not send full-resolution photographs to AI services — only cropped, resized, low-resolution excerpts necessary for the specific analysis task.

5. Sharing and Disclosure

We do not sell your personal information. We may share your information only in the following limited circumstances:

At Your Direction. When you share a repair file, generate a report for a customer or insurance company, invite team members, or send notifications via email or SMS. What you share and with whom is your choice.
Within Your Account. Users within the same Carmic account (e.g., multiple employees at the same shop) may have access to shared repair files and data based on the account's access configuration.
Service Providers. With third-party service providers who process data on our behalf (Section 4), subject to contractual obligations to protect your data and use it only for the stated purpose.
Legal Requirements. When required by law, subpoena, court order, or governmental regulation, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
Business Transfers. In connection with a merger, acquisition, or sale of all or a portion of our assets. Your data would remain subject to this Privacy Policy or you would be notified of changes.
Aggregated/Anonymized Data. We may share aggregated, de-identified data that cannot reasonably be used to identify you or your customers.

Repair file data is never shared across accounts. Each account's repair files, customer information, photographs, and related data are isolated to that account. We do not provide any mechanism for cross-account data access, aggregation, or search.

6. Your Rights and Choices

6.1 Access and Portability

You can access your data at any time through the Service. You may export repair files, photographs, and reports in standard formats (PDF, JPEG, CSV). We will provide a copy of your personal data upon written request within 30 days.

6.2 Correction

You may update your account information, repair file data, tags, labels, and annotations at any time through the Service or by contacting us.

6.3 Deletion

You may delete individual photographs, repair files, or your entire account. When you delete your account, we will delete your personal data and repair file data from our active systems within 30 days. Some data may persist in encrypted backups for up to 90 days before being purged.

6.4 Device Permissions

The Mobile App requests the following device permissions, all of which can be managed in your device settings:

Permission	Purpose	Required?
Camera	Photo/video capture, AR markout viewfinder	Required for core features
Microphone	Voice notes, voice annotations, real-time transcription	Optional
Location	GPS tagging of photos, shop location association	Optional
Motion & Sensors	AR tracking (accelerometer, gyroscope)	Required for AR features
Contacts	Customer contact lookup	Optional
Calendar	Scheduling and event sync	Optional
Photo Library	Save/import photos	Optional
Bluetooth	Peripheral device connectivity	Optional
Notifications	Real-time repair file updates and alerts	Optional

6.5 Marketing Communications

You may opt out of marketing emails at any time by clicking "unsubscribe" in any marketing email or updating your preferences in settings. Service-related communications (security alerts, billing receipts, critical product notifications) are not subject to opt-out.

6.6 California Residents (CCPA/CPRA)

If you are a California resident, you have the right to: (a) know what personal information we collect and how it is used, (b) request deletion of your personal information, (c) opt out of the sale or sharing of personal information (we do not sell personal information), (d) correct inaccurate personal information, and (e) not be discriminated against for exercising your rights. To exercise these rights, contact us at the address below.

6.7 European Residents (GDPR)

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have additional rights including access, rectification, erasure, restriction of processing, data portability, and objection. Our legal bases for processing are: performance of a contract (providing the Service), legitimate interests (improving the Service, security), and consent (where applicable). To exercise these rights, contact us at the address below.

7. Data Retention

Account data: For the duration of your account, plus 30 days after deletion request.
Repair files, photographs, and project data: For the duration of your account. Deleted items are purged within 30 days of deletion.
AI-processed image crops and document excerpts: Not retained by us or by AI service providers. Processed in real time and discarded.
Voice recordings: For the duration of your account, stored with their associated repair files.
OEM procedure references: Applied only within the context of specific repair files. Not aggregated, indexed, or retained as standalone materials.
Usage analytics: Anonymized and retained for product improvement. Not attributable to individual users.
Payment records: As required by tax and financial regulations (typically 7 years).
Encrypted backups: Up to 90 days after data is deleted from active systems.

8. Children's Privacy

The Service is designed for professional use and is not directed to children under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by: (a) posting the updated policy on the Site with a revised "Last Updated" date, (b) sending an in-app notification, and/or (c) sending an email for significant changes. Your continued use of the Service after the effective date constitutes acceptance of the changes.

10. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at:

Phlite Software LLC
Attn: Privacy
Phlite Software LLC
55 Hoffman Road
Monroe Twp., NJ 08831
Email: privacy@carmicai.com