Privacy Policy

Last updated: November 1, 2026

P1. Scope and Our Role

This policy explains how Veridlex Technologies LLC ("Xulari") handles personal information through the Services. Shop customers (End Customers): your repair shop controls your information and decides how it is used. Xulari processes it on the Shop's behalf as a service provider. For questions or requests, contact your Shop first. We will help the Shop respond, or we will forward your request to the Shop.

We do not sell or share your personal information for cross-context behavioral advertising. We do not use third-party advertising or analytics trackers on our public sites.

Fonts on our sites are served from our own servers; your browser does not contact a third-party font service when you load our pages.

We do not embed third-party chat widgets or session-replay tools that capture the contents of your communications on our public sites.

P2. Information We Process

• Shop staff: name, email, role, login credentials (stored hashed), and MFA data when it is enabled.
• Website visitors and prospective customers: the name, shop name, number of locations or bays, city, state, ZIP code, phone, email and contact consent you give us in a demo request or to our website assistant (Sparkplug™), and the content of your chat. We use it to answer you, follow up about Xulari, and improve our website and assistant. We keep these records for 7 years after our last contact with you.
• End Customers and vehicle owners (on behalf of Shops): name, mobile number, address, preferred language, VIN and license plate, service history, and messages exchanged with the Shop.
• Photos and documents: images of IDs (such as driver's licenses), insurance cards, and vehicle damage that Shops upload.
• Messaging data: consent status (service vs. marketing), opt-out and opt-in records, and message delivery status.
• Technical data: server logs, IP addresses, device and browser information, and error reports.
• Repair and payment features: inspection photos, estimate line-item approvals, e-signature audit data, invoices, and payment status. Card data would be collected by the payment processor, not stored by Xulari.
• Not collected at present: payment card data and voice data.

Device check and diagnostics

To keep Xulari working on your devices, we collect technical information when you use the shop app: browser and operating system type and version, screen size, which app features your browser supports, storage space, connection speed and timing, clock and time-zone settings, and error and performance logs. These results are linked to your account and to a random ID stored on this device. Some results are sent automatically when something changes, and you can also send a report to support yourself.

These tools are designed to exclude customer information, photos, audio, prices, messages and page content. We don't collect your IP address in diagnostic logs. We use this information only to find and fix problems and keep the service secure, never for advertising, and we don't sell or share it.

Error and performance logs are normally deleted after 14 days. Device check reports are deleted after 45 days.

If you ask for help, our support team may turn on extra diagnostics for your shop or for one user, for up to 24 hours at a time. While it's on, you'll see a notice in the app with a Turn off button, and extra logs are normally deleted after 7 days. Only authorized Xulari support staff can see diagnostics, through our support tools.

P3. Sensitive Information

If a Shop records a driver's license number read from a card, it is sensitive personal information. We use it only to provide the Services to the Shop, never to infer characteristics about anyone, and we do not sell it.

P4. How We Use Information

We use information to provide and operate the Services; to send repair-status and other messages on a Shop's instruction; to authenticate users; to provide support; to secure the Services, detect abuse, and diagnose errors; to bill Shops; to comply with law; and to improve the Services, including as described in "Improving Xulari" below.

AI processing: automated tools read text from scans, transcribe voice notes, and draft summaries and messages. A person reviews every AI output before it is used. Our AI model is hosted on infrastructure we control. We do not use Shop or End Customer data to train public or third-party AI models. We do not use automated decision-making that produces legal or similarly significant effects.

Improving Xulari. We may use data from the Services, including transcripts, corrections and, where permitted, audio, to develop and improve Xulari's own features and AI models, such as transcription that understands shop terms. Learning from corrected transcript text is on by default. Training on voice audio is off by default; it runs only if the Shop owner turns it on and the staff member gives written consent first. Audio used for training is deleted when it is no longer needed for that purpose, and no later than one year after. We never use Shop or End Customer data to train public or third-party AI models, and we never sell it.

Enforcing bans: if we ban a Shop or user under Section 25 of our Terms, we keep keyed one-way hashes of identifiers from that account (sign-in emails, business phone numbers, business names, and an EIN if provided), not the identifiers themselves, and compare them against new signups to block or review a banned party's return.

P5. How We Share Information

We do not sell personal information. We do not share it for targeted advertising. We disclose information only: (a) to the Shop that controls it; (b) to service providers acting on our behalf (Section P6); (c) to End Customers through tracker links the Shop creates; (d) when the law requires it, or to protect rights, safety, and security; and (e) in a merger, acquisition, or sale of assets, subject to this policy.

P6. Service Providers (Processors) by Category

P7. Public Tracker Links

A tracker link lets anyone who has it view the repair status and related details the Shop chooses to show, without logging in. Do not forward your link. We design links to be hard to guess, and we limit what personal information they show. Links may expire.

P8. Text Messages

If you agree to receive texts from a Shop, the Shop sends them through the Services. Consent to service messages and consent to marketing messages are separate, and neither is required to receive repair services. Reply STOP/BAJA to unsubscribe, START/ALTA to resubscribe, and HELP/AYUDA for help. By default, messages are not sent between 9 p.m. and 8 a.m. local time, and message frequency is capped. Message and data rates may apply. We do not sell or share mobile numbers or SMS consent data with third parties for their marketing purposes.

P9. Cookies and Similar Technologies

Our public websites currently do not use analytics or advertising cookies. The shop application uses strictly necessary cookies or local storage for login sessions and security. Our content-delivery and security layer may set strictly necessary cookies for security, such as bot protection. If we ever add analytics or advertising cookies, they will stay off until you agree to them, and we will update this policy first.

Global Privacy Control (GPC). We honor GPC. If your browser sends Sec-GPC: 1 or exposes navigator.globalPrivacyControl = true, we treat that as an opt-out of the sale or sharing of personal information for cross-context behavioral advertising. We do not sell or share personal information for that purpose. We do not respond to "Do Not Track" signals, because there is no common standard.

P10. Retention

We keep Shop Data while the Shop's account exists, subject to the retention settings the Shop configures, including for documents and photos. After an account is closed, data is available for export during a read-only period, and we delete Shop Data after a grace period (chosen by the owner when cancelling; otherwise 30 days), no later than 90 days after the read-only period ends. Backup copies are overwritten on our regular backup schedule. We may keep data longer where the law requires it or while it is needed for a legal claim. Logs and error reports are kept for a limited time. We keep billing records as the law requires. We keep the hashed identifiers of a banned account for a limited time to enforce the ban. We keep the record of the enforcement action as long as needed for legal claims.

P11. Security

We use reasonable safeguards, including encryption in transit, role-based access, hashed passwords, optional MFA, logging, and restricted administrative access. No system is perfectly secure. If a breach affects your information, we will notify the affected Shops and individuals, and regulators where the law requires it.

P12. Texas Residents (TDPSA)

Texas residents may have rights to confirm whether we process their data, access it, correct it, delete it, and obtain a portable copy, and to opt out of the sale of personal data, targeted advertising, and certain profiling. We do not sell personal data or engage in targeted advertising. We honor Global Privacy Control as an opt-out of sale and targeted advertising. If you are an End Customer, send requests to your Shop. We act on the Shop's instructions. For data where Xulari is the controller, email hello@xulari.com. We will respond within 45 days, and we may extend that once by 45 days where the law allows. If we deny a request, you may appeal by replying to our decision with "Appeal." If an appeal is denied, you may contact the Texas Attorney General (texasattorneygeneral.gov). Notice: if we ever sell sensitive personal data, we will post "NOTICE: We may sell your sensitive personal data." We do not do so.

P13. California Residents (CCPA/CPRA) – If Applicable

Xulari may not currently meet the CCPA's "business" thresholds. As a service provider to Shops, we follow their instructions. Where the CCPA applies, California residents have the right to know, delete, correct, and opt out of the sale or sharing of personal information, the right to limit the use of sensitive personal information, and the right not to be discriminated against for exercising these rights. Categories collected in the past 12 months: identifiers (name, email, phone, IP address); customer records (Cal. Civ. Code § 1798.80); commercial information (vehicle and service history); internet or network activity (logs and diagnostics); audio information (voice notes, processed briefly to transcribe and not stored, unless the Shop owner turns on voice training and the staff member consents, as described in P4); professional information (staff role); and sensitive personal information (account login credentials and, where a Shop records it, a driver's license number). Sources: you, the Shop, and your device. Purposes: those in P4. Disclosed for a business purpose to the service-provider categories in P6. To make a request, email hello@xulari.com; we will verify your request by matching information we already hold, and an authorized agent may act for you with written permission. We do not sell or share personal information, and we have no actual knowledge of selling or sharing the personal information of anyone under 16.

P14. Other U.S. State Privacy Laws

Depending on your state, you may have rights to access, correct, delete, and get a copy of your personal data, and to opt out of targeted advertising, sale, and certain profiling. To use them, email hello@xulari.com (End Customers should contact their Shop first). We will respond within 45 days, which may be extended once by 45 days. If we decline, you can appeal by replying "Appeal"; we will answer within 60 days, and if you disagree you may contact your state attorney general.

Washington My Health My Data Act (MHMDA, RCW 19.373): not applicable to current auto-repair SaaS data (vehicles, repair orders, plates, service history). We will re-check if health-related inferences or consumer health data are ever added.

P15. EU/UK Visitors (GDPR Basics)

The Services are intended for U.S. businesses. If we process personal data of people in the EU or UK, the legal bases are: performance of a contract, legitimate interests (security and improvement), consent (where required), and legal obligation. Those individuals have rights of access, rectification, erasure, restriction, objection, and portability, and the right to complain to their supervisory authority. We store Customer Data primarily in the United States. Some service providers we use, such as content-delivery, network-security and email providers, operate global infrastructure and may process data in transit or temporarily outside the United States. Where personal data from the EU or UK is transferred outside those areas, we rely on Standard Contractual Clauses or another lawful transfer mechanism. Where we rely on consent, you can withdraw it at any time. Retention periods are in P10. Contact hello@xulari.com.

P16. Children

Xulari accounts are only for people 18 and older. The Services are not directed to children. We do not knowingly collect personal information from anyone under 13 (or under 16 where stricter law applies). If we learn that a user is under 13, we will delete their personal information. Contact hello@xulari.com to report a concern.

P17. Language; Changes; Contact

This policy is available in English and Spanish. If the versions conflict, the English version controls. We will post changes here with an updated date. For material changes, we will notify Shops by email or in-app notice. Contact: Veridlex Technologies LLC, hello@xulari.com.