Privacy Policy

Last updated: May 5, 2026

1. Introduction

This Privacy Policy describes how Kebi AI LLC (“Vehix,” “we,” “us,” or “our”) collects, uses, and shares information in connection with the Vehix Technician mobile application for iOS and Android.

Effective date: May 5, 2026. If you have questions about this policy, contact us at contact@kebi.ai.

2. Who Vehix Technician is for

Vehix Technician is a business-to-business field-service tool for vehicle recall technicians employed by recall service operators (our customers). Technicians sign in with credentials issued by their employer. The app is not a standalone consumer product and is not intended for general public use.

3. Information we collect

We collect only the information needed to operate the app:

• Account information. Email address and password. Passwords are hashed by Supabase Auth using industry-standard algorithms; Vehix never sees the plaintext password.
• Identifiers. A Supabase user ID and a tenant ID that identifies which operator the technician works for.
• Location data. The device’s coarse location, used only while the app is in use, solely to provide turn-by-turn navigation to dealership stops on a route. Location is never tracked in the background.
• Camera input. The camera is used to scan VIN barcodes and to capture photos of completed recall work. Captured photos are uploaded to our backend; no other camera frames are recorded or transmitted.
• Recall work data. VINs scanned, recall procedures completed, timestamps, signatures captured on-device, and any free-text notes the technician adds.
• Push notification token. An opaque APNs (Apple) or FCM (Google) token used only to deliver assignment updates to the device.

4. Information we do NOT collect

• We do not collect health data, financial data, contacts, browsing history, biometrics, or advertising identifiers.
• We do not track users across other apps or websites. We do not use SKAdNetwork or the IDFA.
• We do not sell or rent personal information to third parties.

5. How we use your information

• To deliver the app’s core functionality: route management, VIN scanning, recall completion, navigation, and photo and signature attachment.
• To authenticate the technician and bind their work to the correct employer (tenant).
• To send operational push notifications about route assignments.

6. How we share your information

We share information only as needed to operate the service:

• With the technician’s employer (the recall service operator). The operator owns the work data their technicians create.
• With the dealerships the technician services, to the extent recall completion records are required.
• With infrastructure providers that process data on our behalf:
  • Supabase, Inc. — managed PostgreSQL database, authentication, and file storage.
  • Apple and Google — push notification delivery (APNs and FCM).
  • NHTSA (vpic.nhtsa.dot.gov) — public US government VIN-decode API. Only the VIN string is sent; no personal data is shared.
  • Google Maps Platform — map tiles and routing.
• When legally required, such as in response to a valid subpoena, court order, or other lawful request.

We do not share data with advertising networks or data brokers.

7. Data retention

Account and work data are retained for as long as the technician’s employer maintains an active subscription, plus a reasonable archival window for the operator’s recordkeeping needs.

On request, we will delete a technician’s personal account data within 30 days, subject to the operator’s recordkeeping obligations for completed recall work.

8. Data security

• Data in transit is encrypted via HTTPS/TLS.
• Data at rest is encrypted by Supabase.
• Passwords are hashed using industry-standard algorithms (bcrypt) by Supabase Auth.
• Tenant isolation: every database row is tagged with a tenant ID and access is enforced by row-level security.

9. Your rights

By contacting contact@kebi.ai, technicians may:

• Request a copy of their personal data.
• Request deletion of their account and personal data, subject to legitimate retention by their employer.
• Request correction of inaccurate data.

GDPR-specific rights (including the right to object and the right to data portability) and CCPA-specific rights are honored on request.

10. Children

The app is not directed to children under 13, and we do not knowingly collect personal information from children.

11. International users

Data is processed in the United States. By using the app, users located outside the United States consent to the transfer of their data to the United States.

12. Changes to this policy

We will update the “Last updated” date at the top of this page when we make material changes. Continued use of the app after changes constitutes acceptance of the updated policy.

13. Contact

Kebi AI LLC
contact@kebi.ai