Privacy policy

Who we are

Workbay provides workshop-management software to commercial-vehicle workshops in Ireland. For the account data of the people who sign in — administrators and mechanics — Workbay is the data controller. For the records a workshop keeps in Workbay about its own customers and their vehicles, the workshop is the controller and Workbay is a processor acting on its instructions. Questions about this policy: hello@workbay.ie.

What we hold

• Account data — your name, email address and role in the workshop. Authentication is handled by Google’s Firebase Authentication; Workbay never sees or stores a password.
• Workshop records — jobs, inspections, defects, estimates, invoices, customer and vehicle details entered by the workshop. Vehicle registrations and photographs of vehicles can identify a person and are treated as personal data.
• Media — photographs and video captured against jobs and defects, and signatures on inspection sheets. These are reachable only through short-lived signed links, never public URLs.
• Billing data — subscription status and Stripe identifiers. Card numbers go directly to Stripe; Workbay never receives them.

Where it lives

Data is stored on Google Cloud in the EU (Belgium, europe-west1), isolated per workshop at the database level — one workshop cannot read another’s records, and that isolation is enforced by the database itself, not by application code alone.

Who processes it for us

Google Cloud and Firebase (hosting, authentication), Stripe (payments and invoicing), Cloudinary (photo and video storage), Twilio SendGrid (email), and Sentry (error reporting). Each receives only what its job needs, under a data-processing agreement.

How long we keep it

For as long as the workshop’s account exists. Statutory inspection records carry their own legal retention obligations, which the workshop owns. When an account is closed, its data is deleted after a wind-down period; you can also delete your own account from inside the app.

Your rights

Under the GDPR you can ask for access, correction, erasure, restriction or portability of your personal data, and you can complain to the Data Protection Commission (dataprotection.ie). If your data is in a workshop’s records, we may direct your request to that workshop as its controller — but we will always answer.

What this site itself collects

No analytics, no advertising pixels, no third-party cookies. The signup pages talk to Firebase Authentication to create your account, and that is the extent of it.