PRIVACY POLICY

This Privacy Policy explains how The OG C10 Garage & Co. LLC, doing business as OGC10 Garage ("OGC10," "we," "us"), collects, uses, shares, and protects personal information when you use our website at theogc10.com, book or rent a bay, buy or hold a membership, apply for or use OGC10 Pro, pay us, sign up for our communications, or contact us.

It applies to our website, our booking, membership, and OGC10 Pro accounts, and the communications we send. It does not cover the practices of other companies whose services you reach from our site (see "Third-party links and embedded services" below).

Depending on how you use OGC10, we collect the following kinds of information.

• Account and contact information: your name, email address, phone number, and password (stored in protected, hashed form). If you sign in with Google, we receive your name and email address from Google.
• Booking and vehicle information: bay and service bookings, dates and times, and the year, make, model, and other details of vehicles you bring or ask us to work on, along with the notes and waiver acknowledgments you provide.
• Membership information: the membership plan you choose, its status and benefits, and how you use it.
• OGC10 Pro application information: your business information (such as legal and trade name, address, and the types of work you do), the name, email, and phone number of the applicant and owners, your answers to application questions, your attestations, and our review decisions and notes.
• Certificates of insurance (COIs) and insurance data: the documents you upload and the details in them, such as insurer, coverage types, limits, effective and expiration dates, and additional-insured status. COI files are kept in private storage.
• Electronic agreements and signatures: the agreement version you were shown and its cryptographic hash, your name and title, your drawn signature image, the acknowledgments you accepted and their exact wording, and the date, time, IP address, and browser or device information recorded when you sign. Our countersignature and the agreement's status are recorded as well.
• Payment transaction information: payments are processed by Stripe. We receive the status, amount, date, and reference numbers of a payment and limited details such as the card brand and last four digits. We do not receive or store your full card number.
• Communications: emails and text messages we send you and your replies, your communication preferences and consents, newsletter, giveaway, and event registrations, and messages you send us through our site or by email, phone, or text.
• Technical and security information: IP address, browser and device type (user agent), pages and actions on our site, dates and times of activity, and records created to keep the site secure and to limit abuse (for example, rate-limiting records).
• Audit records: for OGC10 Pro, we keep an append-only record of important actions on an application or account (for example, submissions, reviews, approvals, document access, and signatures), including who took the action, when, and from what IP address and browser.

• To provide and manage bookings, memberships, accounts, and OGC10 Pro, including reviewing applications, verifying insurance, and issuing, signing, and keeping agreements.
• To process payments and prevent fraud.
• To communicate with you, including confirmations, reminders, account and security messages, and responses to your questions.
• To keep our facility, website, and accounts secure, to enforce our policies and agreements, and to investigate and resolve disputes and incidents.
• To understand how our website is used and to improve it.
• To keep records and comply with legal, tax, accounting, insurance, and safety obligations.
• To send you marketing communications where you have asked for them or the law allows.

Transactional messages are about your bookings, memberships, accounts, payments, OGC10 Pro application and agreement, email verification, and security. We send them because they are part of the service, and you cannot opt out of them while you have an account or open request.

Marketing messages (such as newsletters, promotions, and giveaway updates) are sent only where you have signed up or the law allows. You can opt out of marketing emails at any time using the unsubscribe link in the email or by contacting us, and for text messages by following the opt-out instructions in the message or by contacting us. Message and data rates may apply to text messages.

Our website uses cookies and similar technologies. We do not claim that our site is cookie-free.

• Sign-in and security cookies: when you sign in, our authentication system sets cookies that keep you signed in and protect your session.
• Browser storage: our site may use your browser's local storage to make features work, for example to hold items in your cart or to keep a form submission until it can be sent.
• Google Analytics: our site uses Google Analytics and the Google tag to understand how the site is used and how it performs, such as which pages are visited. Google may set cookies or use similar technologies and receives information such as your IP address, browser and device details, and the pages you view. Google handles that information under its own terms and privacy practices, which may also depend on settings in your Google account and browser. You can learn more at policies.google.com/technologies/partner-sites and you can use Google's opt-out add-on at tools.google.com/dlpage/gaoptout.

You can block or delete cookies and clear local storage in your browser settings. If you do, some features, such as staying signed in or using the cart, may not work.

We do not sell your personal information for money. We share information only with the following, and only as needed.

• Service providers that help us run OGC10. These currently include: Vercel (website hosting); Supabase (database); Cloudflare R2 (private storage for OGC10 Pro documents); Stripe (payments); Telnyx (text messaging); Google email services (sending email); Google (sign-in with Google, Google Places for business reviews and information, Google Maps, and Google Analytics); Anthropic, where applicable (an AI service provider used by certain features; only when a feature that uses it is involved may the content submitted to that feature be sent to Anthropic so it can generate a response, and not every user's or customer's information is sent to it); Intuit QuickBooks (accounting); and C10Sync (scheduling, invoicing, and fleet tools for our shop). These providers may use the information only to provide their services to us, or as described in their own policies.
• QR code image service: for event registration confirmation emails, the email loads a QR code image from the third-party service QR Server (api.qrserver.com). The request for that image includes the ticket code contained in the QR code, so QR Server can receive that code and the technical information that comes with any web request.
• People you ask us to share with or who act for you, such as your business's authorized owners and, for OGC10 Pro, the owners and members of your Pro account.
• Authorities and advisors when required by law, to protect people, property, or our rights, or to our lawyers, insurers, and accountants.
• A buyer or successor if our business is sold or reorganized.

Certificates of insurance and other OGC10 Pro documents are stored in private storage that is not publicly accessible. They can be viewed only by authorized OGC10 staff and by the owners of the Pro account they belong to, and access to them is recorded.

We use reasonable administrative, technical, and physical safeguards, including encrypted connections (HTTPS), access controls, and activity logging. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please keep your password private and tell us right away if you think your account has been accessed without permission.

We keep personal information for as long as we need it for the purposes described in this policy, including providing the service, resolving disputes, enforcing agreements, and meeting legal, tax, accounting, and insurance requirements.

Some records are designed to be permanent or unchangeable so that they remain trustworthy. These include signed agreements, signature evidence, and OGC10 Pro audit records. We generally cannot delete or alter those records on request, but we limit who can see them and what they are used for.

Our site links to and embeds services run by others. Examples include Google Maps on our home and contact pages, scheduling and fleet-portal pages provided through C10Sync, and links to social media sites such as Instagram, Facebook, TikTok, and YouTube. When you view or use an embedded or linked service, that service may receive technical information such as your IP address, browser details, and the page you are on, and may set its own cookies. Their handling of information is governed by their own policies, not this one.

Our website and services are not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.

You can ask us to tell you what personal information we hold about you, to correct it, or to delete it, and you can opt out of marketing at any time. Depending on where you live and the law that applies to us, including Texas privacy law, you may also have rights to confirm whether we process your personal information, to access it, to correct inaccuracies, to delete it, to obtain a portable copy, and to opt out of the sale of personal information, targeted advertising, and certain profiling.

To make a request, contact us using the details at the end of this policy. We may need to verify your identity before acting. We will respond within the time the law requires (generally 45 days) and will tell you if we need more time or cannot fully act on a request, such as when the law or the nature of a record (for example, a signed agreement) requires us to keep it.

If we decline a request, you can appeal by writing to us at the email address below with the word "Appeal" in the subject line. If you are not satisfied with the result, you may contact the Texas Attorney General.

We may update this policy from time to time. We will change the "Last Updated" date above when we do, and we will give additional notice if a change is significant. When we update this policy, the revised policy will apply as described in the updated notice, subject to applicable law.

For questions about this policy or to make a privacy request, contact: