Bott Mobile Auto Care logo

Privacy Policy

Last updated

Bott Mobile Auto Care LLC collects only what it needs to book, perform and bill a mobile oil change: your contact details, your vehicle, the address where you want the service, and a card you save with Stripe. It does not sell personal information, and you can opt out of Google Analytics from the site footer.

Who we are

Business

Bott Mobile Auto Care LLC, a mobile auto-care business in Colorado, USA

Privacy contact

randy@bottmobileauto.com

Phone

(720) 460-9179

Website developer and host

NeateWorks LLC (Denver, Colorado) builds, hosts and supports this website and booking system on our behalf, under our instructions.

What we collect

When you book an appointment online

  • Contact details: your full name, phone number and email address, and your company's name if you book fleet service for a business.
  • Your vehicle, or each vehicle in a fleet booking: its VIN, and its license plate if you choose to give it. The VIN is sent to the U.S. National Highway Traffic Safety Administration's public decoder, which returns the year, make, model, engine size and similar details that we store with the booking. Nothing else about you is sent with it.
  • Service location: the street address, apartment or suite, city, state and ZIP code, plus the map coordinates Google Maps returns for that address.
  • Scheduling and pricing: the date and time window you choose, any add-ons (air filter, wiper blades), the estimate and its line items, the amount charged and when, and the appointment's status.
  • Payment references: the IDs Stripe gives us for your Stripe customer record, the saved card, the card setup and each payment. Your card number is entered into Stripe's own payment fields and never reaches our servers.
  • Notes our technician adds about the vehicle or the service, and when we told you we were on the way.

When you call or email us

  • If you book by phone, we enter the booking for you. No card is saved for a phone booking, your email address and service address are optional, and the VIN can be replaced by the vehicle's year, make, model and engine size.
  • Every new booking also sends an alert email to our business mailbox with your name, phone number, email address, service address and vehicle.
  • Emails you send us stay in our business mailbox.

When you visit the website

  • Our servers log each request: your IP address, browser user agent, the page or address requested (including anything in it, such as the VIN looked up while booking), and any error.
  • Google Analytics records pages viewed, browser and device details, an approximate location, and a cookie holding a random identifier, so we can learn which pages and services people find most useful. Google uses your IP address to estimate that location but does not store it, and nothing it reports tells us who you are. Opt out at any time with the Analytics link in the footer. It never runs on the password-reset page, whose link carries a one-time token.

Staff accounts

  • The site has no customer accounts: you book as a guest. Only our own staff can sign in, and their accounts hold their name, email address, optional phone number and address, and a salted hash of their password.

How we use it

Book, schedule and perform your service, and contact you about it

Confirmation email, an "on our way" email when you are next, and your phone number so we can reach you about the appointment.

Legal basis

Performing our contract with you


Plan the day's route

Google Maps turns your address into coordinates and orders each booking window by driving distance; the travel cost on your estimate comes from that route.

Legal basis

Performing our contract with you


Take payment and send your receipt

Your card is saved through Stripe when you book and charged only when the service is complete. We then email you a receipt naming the amount and the card.

Legal basis

Performing our contract with you


Keep business, tax and accounting records

Completed appointments feed our revenue and expense reports.

Legal basis

Legal obligation and our legitimate interest in running the business


Keep the website secure and working

Server logs, and limits on how many requests one visitor can make.

Legal basis

Our legitimate interest in a secure, working website


Understand how visitors use the website

Google Analytics, unless you opt out.

Legal basis

Our legitimate interest in improving the website; you can object at any time with the opt-out in the footer

The legal bases above are those required by the EU and UK General Data Protection Regulation. They apply if you are in the European Economic Area or the United Kingdom.

Who we share it with

We do not sell your personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. The site runs no advertising tags.

NeateWorks LLC

Developer and host

Builds, hosts and supports this website and booking system for us, and can access the data only to do that work.

Google Cloud

Hosting

Runs the website, database and backups in Google's us-central1 (Iowa, USA) region, and keeps application logs in Google Cloud Logging.

Google Workspace (Gmail)

Email

Sends your confirmation, "on our way" and receipt emails from our business mailbox, and carries any email between us.

Stripe

Payments

Receives your name, email address and phone number when you reach the payment step (even if you do not finish booking), your card details directly from you, and the amount and appointment number of each charge. Stripe processes payments under its own privacy policy and may keep its records under its own retention rules.

Google Maps Platform

Mapping

Receives the service address you enter and the coordinates of booked locations, to geocode them and plan routes.

U.S. National Highway Traffic Safety Administration

Vehicle lookup

Receives your VIN only, to decode the vehicle's make and model through its free public service.

Google Analytics

Website measurement

Receives browsing data unless you opt out.

Anthropic

Support tooling

NeateWorks uses Anthropic's Claude AI assistant to diagnose and fix problems, which can involve reading application logs (IP addresses, request details, error messages). Credential-like text is redacted from logs first.

Your information is stored primarily in the United States. Google, Stripe and Anthropic may process it in the United States and other countries; they offer the EU Standard Contractual Clauses for transfers out of the EEA and UK, and Google and Stripe are also listed under the EU-U.S. Data Privacy Framework.

How long we keep it

Appointment records

Kept as our service history and accounting records. They are not deleted automatically; ask us and we will delete anything we are not required to keep for tax or legal reasons, including the booking alert email in our mailbox and your Stripe customer record.

Server and application logs

30 days.

Database backups

30 days, with superseded backup files purged within 35. Something deleted from the live database stays in backups until they expire.

Emails

Stay in our business mailbox until we delete them.

Stripe records

Kept by Stripe under its own retention rules.

Google Analytics data

Kept by Google for the retention period set in our Analytics property. The _ga cookies themselves last up to two years unless you clear them or opt out.

Staff sign-in sessions

Expired sign-in tokens are purged daily.

Cookies and browser storage

Analytics opt-out

Your browser's local storage

Remembers that you opted out of Google Analytics. Use "Analytics" in the footer to change it.

Google Analytics cookies (_ga, _ga_*)

Cookies

Set unless you opt out. Opting out deletes them.

Display preferences

Your browser's local storage

Remembers light or dark mode. Never sent to us or anyone else.

Stripe

Cookies, on the booking page only

Stripe's payment fields may set cookies Stripe needs to prevent fraud.

Staff sign-in and screen preferences

Your browser's local storage

Staff sign-in tokens, profile and screen settings, kept only in a staff member's own browser.

Your rights

  • Know what personal information we hold about you and get a copy.
  • Correct information that is wrong.
  • Delete your information, except what we must keep for tax or legal reasons.
  • Opt out of analytics at any time with "Analytics" in the footer.
  • If you are in the EEA or UK: object to or restrict processing based on our legitimate interests, receive your data in a portable format, and complain to your local data protection authority.

Email randy@bottmobileauto.com or call (720) 460-9179. We may ask you to confirm details of your booking so we know the request is yours, and we will answer within 30 days. You will not be treated differently for making a request.

Comprehensive state privacy laws such as the Colorado Privacy Act and California's CCPA apply only to businesses above certain size thresholds, and a small local business like ours may not be covered by them. We honor the requests above from everyone regardless. If you are a California or Colorado resident and believe one of those laws applies, you may also use an authorized agent.

Security

  • Every page and API request uses HTTPS.
  • Google encrypts the database, files and backups at rest.
  • Card numbers never touch our servers: Stripe collects and stores them.
  • Booking records are visible only to signed-in staff, and staff passwords are stored only as salted hashes.

Children

This website and our services are meant for adults who own or look after a vehicle. We do not knowingly collect personal information from children under 13; if you believe a child has given us some, contact us and we will delete it.

Changes to this policy

When what we collect or how we use it changes, we update this page and the "Last updated" date at the top.

CallEmail