Privacy policy

American Hail Network CRM is operated by American Hail Network (“the operator”). It is a private, invitation-only business system used by the operator and its partner paintless dent repair shops. There is no public sign-up. Questions: support@americanhailnetwork.com.

Business records entered by shop staff: customer name and contact details, vehicle details, damage photographs, repair estimates, insurance claim information, appointments, and payment and payout records.

Account data for the staff who use the system: name, email address, role, and the shops they are assigned to.

Usage data: which screens an account opens, to help us remove parts of the product nobody uses. This records the route pattern only (for example /leads/[id]), never which customer was on screen.

Connecting a Google Calendar is optional and is done per shop by an owner or manager. When a shop connects, this CRM requests two scopes:

• calendar.events — to create, update and delete the estimate and drop-off appointments that this CRM itself books on that shop’s calendar. We do not modify events that this CRM did not create.
• calendar.readonly — to read free/busy times so a customer is not offered a slot when the shop is already occupied. We read availability windows; we do not read, store or display the contents, titles, attendees or descriptions of events this CRM did not create.

The Google account email address of the person who granted access is stored so the shop can see which account is connected. The refresh token is encrypted at rest with AES-256-GCM and is scoped to the single shop that granted it.

American Hail Network CRM’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never sold, never used for advertising, and never used to train any machine-learning model.

A shop can disconnect at any time from Settings → Google Calendar, which deletes the stored token, or revoke access directly at myaccount.google.com/permissions.

To run the repair business: scheduling work, producing estimates, submitting and chasing insurance claims, communicating with the customer about their own vehicle, and calculating what each technician and shop is owed. We do not sell data, and we do not use it for advertising.

Each shop’s records are isolated to that shop’s workspace. Data is shared only with: the insurance carrier handling a specific claim, the customer whose vehicle it is, and the service providers that run the system on our behalf — hosting (Vercel), database (Supabase), email delivery (Resend), and Google Calendar where a shop has connected it. Each processes data only to provide its service to us.

Business and claim records are retained while the shop is a customer and afterwards for as long as tax, insurance and warranty obligations require. Calendar tokens are deleted immediately on disconnect. Usage records are retained for up to 24 months.

Access requires an account issued by the operator and is restricted by role. Each shop’s data is separated at the database level. Traffic is encrypted in transit, and third-party tokens are encrypted at rest.

A shop owner may request a copy or deletion of their workspace’s data by writing to support@americanhailnetwork.com. Customers whose vehicles are recorded may ask the shop that served them, or write to the same address. Deletion requests are honoured except where a record must be kept to meet a legal or insurance obligation.