Privacy Policy

How do.repair collects and uses personal data about the people who run and use shop accounts, visit our website or get in touch. Customers of a repair shop should read that shop’s own privacy notice.

EFFECTIVE

15 October 2026

VERSION

2026-10-15

FROM

AMIRENA LTD

ON THIS PAGE

1. Who we are

2. Who this policy covers

3. What we collect, why, and our lawful basis

4. Artificial intelligence

5. Who we share data with

6. Where your data is stored

7. How long we keep it

8. Your rights

9. How we protect it

10. Cookies

11. Children

12. Changes to this policy

OTHER DOCUMENTS

Terms of Service

Data Processing Agreement

Cookie Policy

do.repair is run by AMIRENA LTD, registered in England & Wales (company number 16001043), registered office Arkley Road, Birmingham B28 9PJ. For the personal data in this policy we are the controller, which means we decide how it is used and are responsible for it.

Questions or requests about your data: [[email protected]](mailto:[email protected]). We aim to reply within a few working days and always within one month.

Owners and staff of businesses that use do.repair.

People who visit our website.

People who email or contact us.

WHAT | WHY WE USE IT | LAWFUL BASIS (UK GDPR)

Account details: your name, business name, email, phone, postcode, and a scrambled (hashed) password | To create and run your account and provide do.repair | Contract

Team members you invite: name, email, role | So they can sign in and work on jobs | Contract, and our legitimate interest in running your account securely

Sign-in and security records: IP address, device and browser, sign-ins, an audit trail of important actions | To keep accounts secure, prevent fraud and fix problems | Legitimate interests (security)

Plan and billing records | To charge for paid plans and keep accounts | Contract and legal obligation (tax records)

Messages you send us by email or through our contact form: your name, email, and any business name, phone number and message you give us. For the form, also the IP address it was sent from | To answer you and help with support, and to stop spam | Legitimate interests, or contract if you are a customer

Website visit data: IP address and pages requested, in our server logs | To run and protect the website | Legitimate interests

We do not use advertising or tracking cookies, and we do not sell personal data. We send service messages about your account. We do not currently send marketing emails. If we start, we will follow the electronic marketing rules (PECR) and you can unsubscribe at any time.

do.repair uses AI to draft quotes and messages, suggest diagnoses, estimate from photos and answer missed calls for shops. AI makes suggestions. It does not make decisions about you that have legal or similarly significant effects: money matters and public replies wait for a person to approve them.

Where we use an outside AI provider, we choose settings that stop the provider using the data to train its models and that keep data for the shortest time the provider allows. The providers we use and whether each one is switched on are listed in our Data Processing Agreement.

Service providers who help us run do.repair, under contracts that protect your data. The full list, and which are in use today, is in the Data Processing Agreement.

Professional advisers, such as lawyers and accountants, when needed.

Authorities, where the law requires it.

A buyer, if do.repair is sold. We would tell you first.

Your data is stored on servers we run in the United Kingdom, with nightly backups also kept in the UK. Traffic reaches our servers through Cloudflare’s secure network.

Some providers are based outside the UK, for example in the United States. When data goes to them, it is protected by the safeguards UK law requires: the UK International Data Transfer Agreement or Addendum, or the UK–US data bridge where the provider is certified under it.

Account data: while your account is open. If you close it, we keep it for 30 days in case you change your mind, then delete it.

Billing records: 7 years, for tax.

Security records and the audit trail: for as long as the account exists, so problems can be traced.

Messages you send us: up to 2 years after we last hear from you.

The limits for the data shops keep about their customers are in the Data Processing Agreement.

You have the right to:

see the personal data we hold about you and get a copy;

have it corrected if it is wrong;

have it deleted, unless we must keep it, for example for tax;

ask us to limit how we use it, or object to how we use it;

get the data you gave us in a format you can take elsewhere;

withdraw any consent you have given, at any time.

Email [email protected]. We reply within one month. Account owners can also export everything, or delete the account, from Settings → Privacy & data.

If you are unhappy with how we handle your data, please tell us. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

All connections to do.repair are encrypted (HTTPS).

Passwords are stored only in hashed form. Connection tokens, keys and two-factor secrets are encrypted in our database.

Each shop’s data is kept separate at the database level, and important actions are recorded in an audit trail.

Our servers are not open to the internet directly, staff access uses two-factor sign-in, and data is backed up every night.

We only use cookies and browser storage that do.repair needs to work, such as keeping you signed in. There are no advertising or tracking cookies. See our Cookie Policy.

do.repair is a business tool and is not meant for anyone under 18. We do not knowingly collect children’s data for our own purposes.

We will update this policy when how we use data changes, and show the date at the top. If a change matters to you, we will tell you by email or in the app before it takes effect.

Questions about this document: [email protected].

Version 2026-10-15, effective 15 October 2026. First published 10 October 2026. Changed on 15 October 2026: card payment fees, refunds and chargebacks, and VAT wording in the Terms of Service.