Plain-language summary
We use your information to sign you in, operate your private garage, support the collaboration you choose, protect the service, and comply with law. We do not use your information for targeted advertising or sell it to data brokers.
1. Scope
This Privacy Policy applies to DTM Vault's websites, applications, and related services (collectively, the “Service”). “DTM Vault,” “we,” “us,” and “our” refer to the operator of the Service. This policy does not govern third-party websites, applications, or services that have their own privacy policies.
2. Information we collect
Account and identity information
When you sign in with Google, we receive basic identity data such as your Google account identifier, name, email address, email verification status, and profile image. We also keep the account, session, invitation, and authentication records needed to provide and secure your access.
Garage content
We collect the information you and your authorized collaborators add to DTM Vault. This may include vehicle details and identifiers, ownership and service history, modifications, events, tasks, parts and supplies, inventory purchases and use, costs, contacts, locations, notes, photographs, documents, videos, captions, and related metadata. Some of this content may be sensitive, including financial details, receipts, vendor details, storage locations, private notes, or ownership documents.
Ownership history may include the purchase and sale amounts, transaction fees, and financial corrections you record for private reporting. DTM Vault no longer collects vehicle valuations. Retired Community data is not part of the live product and is removed through a separately approved, counts-only-logged operator procedure. Insurance cards may be uploaded only as ordinary user-managed Files documents.
Collaboration and communications
We collect information used to invite and manage garage members, attribute changes, deliver transactional messages, and respond when you contact us. This may include names, email addresses, roles, vehicle assignments, support messages, and delivery records.
Technical and usage information
We automatically receive limited technical information when you use the Service, such as IP address, browser and device details, session activity, requested routes, security events, and error or performance information. We use this information to operate, protect, diagnose, and improve the Service.
3. How we handle Google user data
DTM Vault requests only the basic Google sign-in scopes needed to authenticate you: openid, email, and profile. We use the resulting Google user data to verify your identity, create and maintain your DTM Vault account, match you to invitations, manage sessions, and protect account access.
Authentication records may include the provider and issuer, authorized scopes, tokens or claims supplied during sign-in, and related expiration information. We store and process those records only as needed to provide and secure sign-in. DTM Vault does not request or access your Google Drive files, Gmail messages, Google Calendar, contacts, or other Google Workspace content. Email you choose to forward to your garage's upload address reaches us through our email delivery provider, not through your Google account.
We do not sell Google user data, use it for advertising, provide it to data brokers or information resellers, use it to determine creditworthiness or for lending, or use it to train generalized artificial intelligence or machine-learning models. We transfer it only as described in this policy, such as to infrastructure providers that help us deliver and secure the user-facing sign-in experience, or when required by law.
DTM Vault's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.
4. How we use information
We use information to:
- Provide, maintain, and support the Service.
- Authenticate users and enforce membership access level and explicit garage or vehicle scope.
- Store, organize, search, display, include in export packages, and attribute the records you ask us to manage.
- Deliver invitations, account notices, service messages, and responses to support requests.
- Detect fraud, abuse, security incidents, and violations of our Terms of Service.
- Diagnose problems, understand feature performance, and improve user-facing features.
- Comply with applicable law, enforce our agreements, and protect the rights and safety of users, DTM Vault, and others.
6. Private garages
Garage records are private by default. Access is based on active membership, access level, and an explicit whole-garage or selected-vehicles scope. Every member sees complete records within that scope. DTM Vault does not automatically publish public garage profiles or public vehicle pages.
Parts & Supplies
Parts & Supplies records remain private garage content. Inventory identities, balances, purchases, use, adjustments, low-stock thresholds, receipts, shopping-list entries, search terms, and garage-added parts websites are not made public. Access requires whole-garage scope. Owner, Full Editor, and View Only receive complete inventory fields, including purchase amounts, receipts, vendor details, storage locations, and private notes; only Owner and Full Editor may change them.
DTM Vault does not contact parts websites to validate links, collect search results, compare prices or availability, or access retailer accounts and carts. When an authorized user clicks an individual external search link, the browser sends only that shopping entry's explicit search terms in the destination URL; vehicle and garage identifiers are not added. The destination website will receive the ordinary information associated with a browser visit and applies its own privacy policy.
Chronological record details
Timeline, maintenance, modification, ownership, and work details remain inside their garage and follow the permissions of the underlying vehicle. The retired private comment feature is not used to process new content or notifications.
7. AI Inbox, forwarded email, and VIN decoding
The AI Inbox is optional and switched off by default; it is enabled per platform by the operator, and forwarded email and VIN decoding are separate switches that are also off by default. When it is on, an Owner or Full Editor can submit documents and typed text from the app, or forward email to the garage's upload address, and the Inbox proposes records to create or update.
You choose how records are added
The Inbox defaults to review first: a member with editing access approves the prepared records before they are added. A garage Owner can enable automatic filing for future uploads and forwarded emails. Clear, supported history for known vehicles can then be added automatically; uncertain matches, possible duplicates, and sensitive changes still require review. Turning automatic filing off also stops queued documents from being added automatically. Records identify whether they were added automatically or after review and link to their private source document. Discarded proposals create no records.
What is sent to OpenAI
To produce proposals we send OpenAI the documents and typed text you submit or forward, and a compact list of your garage's vehicles and contacts—internal record identifiers, display names, vehicle identifiers such as VINs and plates, and contact email addresses and phone numbers—so the proposals can be matched to the records you already have. We do not send passwords or sign-in credentials, private notes, costs, other files, or any content from another garage. Processing runs under OpenAI's enterprise terms: submitted data is not used to train models and is not stored by the provider beyond the request.
Forwarded email
A message sent to the upload address is accepted only when it comes from the email address of an active Owner or Full Editor and passes sender authentication; anything else receives a reply that discloses nothing and is not kept. We retain the raw message for three days so a problem can be diagnosed, then delete it. Attachments and the message text become private files in the garage when records are added after review or through enabled automatic filing. Evidence from a rejected message or a message whose records have not been added is deleted on the same three-day schedule.
VIN decoding
When VIN decoding is switched on, the Look up action sends only the 17-character VIN to the United States NHTSA vPIC service and prefills empty vehicle fields from its answer. No garage, vehicle, or account identifier accompanies the request, and results are cached by a digest of the VIN. No commercial decoder, valuation, or market-data service is involved.
8. Data deletion
Vehicles have two ownership states: Current and Former. Marking a vehicle Former keeps its vehicle history; it does not create a hidden copy. An Owner can instead permanently delete a vehicle and its associated records. An Owner can permanently delete a garage, and you can permanently delete your account after completing the required recent Google sign-in and confirmation.
Account deletion permanently deletes every garage you own, removes your memberships in garages owned by other people, revokes sessions and sign-in credentials, and deletes the DTM Vault user account. Records that belong to another owner's garage remain that owner's records; your personal attribution is removed and shown as “Former member.” Shared contacts and files survive when another authorized relationship still uses them. A content-free deletion entry may retain the operation identifier, actor, timestamp, and counts without vehicle details, filenames, notes, email addresses, or deleted content.
Deletion is irreversible in DTM Vault. Database access to deleted files ends with the deletion transaction. We then delete storage objects immediately; a transient provider failure places only an application-encrypted storage key, object kind, attempt status, and timestamps in a restricted retry queue. The queue contains no user content and cannot be used to recover a record or file.
DTM Vault does not keep application-controlled backups or a customer recovery window for deleted content. Deletion cannot erase copies outside our control, including files or export packages you or another recipient downloaded, Work Order PDF attachments already delivered by email, or copies a service provider must keep independently for security, fraud prevention, legal process, or other lawful obligations. Provider-internal copies, when required, are governed by that provider's terms and are not available through DTM Vault.
Session expiry, bearer-link expiry, rate-limit buckets, temporary processing retries, and the non-recoverable file-deletion queue are security and reliability controls rather than storage of deleted customer content. Disconnecting DTM Vault in your Google Account stops future authorization but does not itself delete your DTM Vault account or garage records.
9. Security
We use administrative, technical, and organizational safeguards designed to protect information. These include encrypted network connections, private file storage, secure session cookies, server-enforced authorization, least-privilege access, redacted operational logging, and security monitoring. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
10. Your choices and rights
Depending on your location and relationship to a garage, you may have the right to request access, correction, portability, deletion, restriction, or objection regarding personal information. You can update many records directly in the Service, ask a garage owner to change your collaboration access, create an export package for eligible garage records, revoke Google access from your Google Account, or contact us with a request.
We may need to verify your identity and authority over the relevant account or garage before completing a request. We will not discriminate against you for exercising applicable privacy rights.
12. Children's privacy
The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.
13. International use
DTM Vault and its service providers may process information in the United States and other countries where privacy laws may differ from those in your location. Where required, we use appropriate safeguards for international transfers.
14. Changes to this policy
We may change this Privacy Policy from time to time as the Service, our practices, or applicable law evolves. We will post the updated policy here and revise the “Last updated” date. If a change is material, we will provide additional notice when reasonably appropriate, such as through the Service or by email. If we change how we use Google user data, we will provide notice and obtain any consent required before using that data for a new purpose.
15. Contact us
For privacy questions or requests, email info@dtmvault.com. Please do not include passwords, OAuth tokens, or highly sensitive vehicle documents in an email.