Built for busy auto repair shops. From first estimate to final invoice, keep every job moving.
Legal

Data Processing Agreement

Version 1.1.0Effective September 29, 2026Draft — under review

TL;DR — the short version

  • Your shop is the data controller for its customers' information. Scanvato Labs LLC (Bay2Bill) is the data processor.
  • We process that data only to provide the service, keep it confidential, and never sell it.
  • We list every sub-processor and give 30 days' notice before adding a new one.
  • If there's a data breach affecting your data, we'll tell you within 72 hours.
  • When you leave, you can ask us for an export of your data within 30 days. After that we delete it.
  • Standard Contractual Clauses cover transfers of EU and UK data.

This summary is for convenience only. The full text below is what applies.

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Scanvato Labs LLC, a Texas limited liability company that operates Bay2Bill ("Processor", "we" or "us"), and the business that uses Bay2Bill (the "Shop", "Controller" or "you"). It applies whenever we process Personal Data on the Shop's behalf. If this DPA conflicts with the Terms of Service, this DPA controls for the processing of Personal Data.

1. Definitions

  • Data Protection Laws means all privacy and data protection laws that apply to the processing, including, where applicable, the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended (CCPA), and other U.S. state privacy laws such as the Texas Data Privacy and Security Act.
  • Personal Data means any information relating to an identified or identifiable person that the Shop or its Users submit to the Service ("Shop Data"), including information about the Shop's customers.
  • Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.
  • Sub-processor means a third party we engage to process Personal Data for the Service.
  • "Controller", "Processor", "Data Subject", "processing", "business", "service provider" and "sell"/"share" have the meanings given in the Data Protection Laws.

2. Roles

The Shop is the Controller (or "business") of Shop Data. We are the Processor (or "service provider"). The Shop is responsible for having a lawful basis and giving any notices required to collect Personal Data and to give it to us.

3. Details of processing

Item Details
Subject matter Providing the Bay2Bill invoicing and shop-management Service
Duration The term of the Shop's account, plus the return/deletion period in Section 10
Nature and purpose Hosting, storing, organizing, displaying, generating PDFs, emailing documents at the Shop's request, VIN decoding, backup, support and security
Types of Personal Data Names, phone numbers, email and postal addresses, vehicle information (VIN, make, model, plate, mileage), estimate, work-order, invoice and payment records, notes, and User account and sign-in data
Categories of Data Subjects The Shop's customers and contacts, and the Shop's Users (owners, staff, technicians)
Special categories None are intended. The Shop must not enter special-category or sensitive data (such as health or government ID numbers) into the Service.

4. Our obligations

We will:

  1. Follow instructions. Process Personal Data only on the Shop's documented instructions (the Terms of Service, this DPA, and the Shop's use of the Service), unless the law requires otherwise, in which case we will tell the Shop first unless the law forbids it. We will tell the Shop if we believe an instruction breaks Data Protection Laws.
  2. Keep it confidential. Make sure anyone authorized to process Personal Data is bound by confidentiality.
  3. Not sell or share. Not sell or "share" Personal Data, not keep, use or disclose it outside our direct business relationship with the Shop, and not combine it with data from other sources except as the CCPA allows for service providers.
  4. Secure it. Apply the technical and organizational measures in Section 6.
  5. Assist. Taking into account the nature of the processing, help the Shop respond to Data Subject requests, and with security, breach notification, data protection impact assessments and prior consultations, to the extent the Shop cannot do so itself through the Service.
  6. Show compliance. Make available information reasonably needed to show compliance with this DPA, and allow audits as described in Section 9.

5. Sub-processors

  • General authorization. The Shop authorizes us to use the Sub-processors listed below. We have written agreements with them that impose data protection obligations no less protective than this DPA, and we remain responsible for their performance.
  • Changes. We will give at least 30 days' notice (by email to the account owner or by updating this page with a new version) before adding or replacing a Sub-processor. The Shop may object on reasonable data-protection grounds within that period. If we cannot reasonably address the objection, the Shop may terminate the affected Service and receive a refund of any prepaid, unused fees for it.
Sub-processor Purpose Data processed
OVHcloud Application servers and database hosting All Shop Data
Hostinger Website hosting and support mailbox Support correspondence
Resend Sending estimates and invoices that the Shop emails to its customers Recipient email, document PDF, message
U.S. NHTSA vPIC VIN decoding VIN only
ipwho.is Approximate location of sign-in IP for trusted-device records User IP address

6. Security measures

We maintain appropriate technical and organizational measures, which currently include:

  • encryption of data in transit using HTTPS/TLS;
  • database-level row security that isolates each Shop's data from other Shops;
  • separate database roles for the application and for administration;
  • passwords stored with a strong, salted hashing algorithm (Argon2id);
  • optional two-factor authentication, account lockout after repeated failed sign-ins, and revocable sessions;
  • role-based access within each Shop (owner, staff, technician);
  • CSRF protection and secure, HTTP-only cookies;
  • administrative access limited to authorized personnel of Scanvato Labs LLC;
  • keeping software dependencies and servers updated.

We may update these measures as long as the overall level of security is not reduced.

7. Personal Data Breaches

We will notify the Shop without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Shop Data. The notice will describe, as far as we know at the time, the nature of the breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the steps taken or proposed. We will provide further information as it becomes available and take reasonable steps to contain and remedy the breach. Notifying the Shop is not an admission of fault.

8. International transfers

We are located in the United States, and Personal Data may be processed in the United States and other countries where we or our Sub-processors operate. Where Data Protection Laws require a transfer mechanism for Personal Data from the European Economic Area, the United Kingdom or Switzerland, the parties agree that the European Commission's Standard Contractual Clauses (Module 2, controller to processor, and Module 3 where applicable), with the UK Addendum and Swiss amendments where relevant, are incorporated by reference, with: Clause 7 (docking) applying; Option 2 (general authorization) under Clause 9 with the notice period in Section 5; the optional language in Clause 11 not applying; Clauses 17 and 18 governed by and brought before the courts of Ireland; and Annexes I and II completed by Sections 3 and 6 of this DPA.

9. Audits

On written request no more than once a year (or after a Personal Data Breach, or when required by a regulator), we will answer a reasonable security questionnaire and provide relevant documentation. If that is not enough to show compliance, the Shop may conduct an audit at its own cost, with at least 30 days' notice, during business hours, in a way that does not disrupt our operations or compromise other customers' data, and subject to confidentiality.

10. Return and deletion

When the Shop's account ends, the Shop may ask us (at support@bay2bill.com) for an export of Shop Data within 30 days, and we will prepare it on request. After that, we will delete or anonymize Shop Data from active systems, generally within 90 days, and it will be removed from backups as they expire in the normal course, except where the law requires us to keep it. Retained data remains protected by this DPA.

11. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms of Service, except where Data Protection Laws do not allow them.

12. Contact

Scanvato Labs LLC (operator of Bay2Bill)
3808 Smoke Tree Ln, McKinney, TX 75070
Privacy questions and requests: support@bay2bill.com