Effective Date: 2026-10-09 | Version: 1.3 | Supersedes version 1.2 (2026-09-23)
This Data Processing Addendum (DPA) is part of the Terms of Service and Privacy Policy of WrenchLane.com and applies when WrenchLane AB (org. no. 559450-7393), Engelbrektsgatan 33, 114 32 Stockholm, Sweden, which operates WrenchLane.com ("WrenchLane.com"), processes personal data on behalf of its corporate clients ("Customer").
1. Definitions
1.1 "Applicable Data Protection Laws" refers to all applicable privacy and data protection laws, including:
General Data Protection Regulation (EU) 2016/679 (GDPR)
UK GDPR and UK Data Protection Act 2018
California Consumer Privacy Act (CCPA)
Brazil's General Data Protection Law (LGPD)
Canada's Personal Information Protection and Electronic Documents Act (PIPEDA)
1.2 "Personal Data" means any data processed by WrenchLane.com on behalf of the Customer that relates to an identified or identifiable business representative or employee of the Customer, or to the Customer's own customers, such as vehicle owners, keepers and drivers, whose data the Customer submits to the Services.
1.3 "Processor" refers to WrenchLane AB (org. no. 559450-7393), operating as WrenchLane.com, when processing Customer Data under this Addendum.
1.4 "Controller" refers to the Customer, who determines the purposes and means of processing personal data.
1.5 "Sub-Processor" refers to any third party that WrenchLane.com engages to process personal data.
2. Processing of Personal Data
2.1 Scope and Purpose
WrenchLane.com will process personal data solely for:
Providing, maintaining, and improving the Services.
Enhancing AI-driven vehicle diagnostics and workflow automation.
Complying with legal obligations.
2.2 Customer Instructions
WrenchLane.com will process personal data only per documented instructions from the Customer, unless required by law.
2.3 Confidentiality
All WrenchLane.com personnel processing personal data will be bound by strict confidentiality obligations.
2.4 AI Processing
Personal data submitted to the AI features of the Services (including fault codes, vehicle data, problem descriptions, documents and photos attached by the Customer's users, and voice notes) is processed by the AI Sub-Processor listed in Section 4 within the European Union. Except for web grounding as described in the next paragraph, the AI Sub-Processor does not store prompts or outputs beyond the duration of the request, does not review them for abuse monitoring, and does not use them to train or improve its models. These settings are confirmed in writing by the AI Sub-Processor and evidence is available to the Customer on request.
Some AI features check their answers against the public web with the AI Sub-Processor's web grounding service (Grounding with Google Search): the chat assistant, fault-code look-ups, repair procedures and verification checks. For these requests the AI Sub-Processor derives search queries from the request and runs them on Google Search. It stores those queries, together with contextual information provided with the request, for up to three (3) days, without associating them with the Customer or its End Users, and may use this stored information to debug the systems that support grounding. This storage cannot be switched off while the grounding service is used, and Google Search is not limited to the European Union.
In addition, where a diagnosis requires information from the public web, a search query containing the fault codes, the vehicle make, model and year and the problem description is sent to a web-search provider (Brave Software, Inc., United States) under the Brave Search API privacy notice. Brave does not treat search queries as personal data and is therefore not engaged as a Sub-Processor. WrenchLane.com does not include customer identity, registration numbers or vehicle identification numbers in the queries it builds.
2.5 Categories of Data
Data subjects: the Customer's users (business representatives and employees) and the Customer's own customers (vehicle owners, keepers and drivers). Personal data: account and contact details; vehicle identifiers such as registration numbers and VINs; diagnostic data; and the content of documents and photos the Customer's users attach, which may include names, addresses, telephone numbers, invoice details and images of people or registration plates. The Customer shall not submit special categories of personal data (Article 9 GDPR) and shall limit attached documents to what the diagnosis or repair needs.
2.6 Attached Documents and Photos
Documents and photos attached to a diagnosis or a chat are stored encrypted in Sweden and processed by the AI Sub-Processor under clause 2.4. A file that is uploaded but never submitted is deleted automatically within three (3) days. Deleting a diagnosis or clearing a chat permanently deletes the files it carried; information read from those files remains part of the diagnosis or chat record and is deleted under Section 7.
3. Security Measures
WrenchLane.com implements technical and organizational measures to protect personal data, including:
Encryption of personal data (both in transit and at rest).
Access controls and authentication protocols.
Regular security audits and risk assessments.
4. Sub-Processors
4.1 Use of Third-Party Service Providers
WrenchLane.com engages the following Sub-Processors. Sub-Processors located outside the EU/EEA process personal data under the safeguards described in Section 5. The web-search provider used during a diagnosis is described in clause 2.4.
| Sub-Processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Cloud hosting, data storage, speech-to-text and search infrastructure | Stockholm, Sweden (EU, region eu-north-1) | Not applicable (EU) |
| Google Cloud EMEA Limited | AI inference (Vertex AI) for the diagnostic and chat features, configured for zero data retention (no caching, no prompt logging, no training) | European Union (EU multi-region) | Not applicable (EU) |
| Stripe Payments Europe, Ltd. | Payment processing (WrenchLane.com does not store card details) | Ireland (EU) | Per Stripe's data processing terms |
| Customer.io, Inc. | Service, onboarding and lifecycle e-mail to business representatives | European Union (EU data centre) | Not applicable (EU); EU-U.S. Data Privacy Framework and Standard Contractual Clauses under Customer.io's DPA for any access from the United States |
| PostHog, Inc. | Product analytics (EU cloud; IP address discarded) | European Union | Not applicable (EU) |
| Functional Software, Inc. (Sentry) | Application error monitoring | European Union (EU data region, Germany) | Not applicable (EU); Standard Contractual Clauses under Sentry's DPA for any access from the United States |
| Haynes Group Limited (HaynesPro) | Vehicle identification by registration number and licensed technical data | United Kingdom | UK adequacy decision |
4.2 Customer Right to Object
The Customer may object to a new Sub-Processor within 30 days of notice if they believe it negatively impacts their data protection rights.
4.3 Notice of Changes
The current list of Sub-Processors is published at wrenchlane.com/en/dpa. WrenchLane.com will inform Customers by e-mail of the addition or replacement of a Sub-Processor at least 30 days before the new Sub-Processor processes personal data.
5. International Data Transfers
5.1 Compliance with Transfer Laws
Personal data is stored in Sweden and AI processing takes place within the European Union, except for the web-grounding searches described in clause 2.4. Personal data is transferred outside of the EEA or UK only to the Sub-Processors identified as such in Section 4, and only with appropriate safeguards such as:
Standard Contractual Clauses (SCCs) under GDPR
Data Privacy Framework (for US-based transfers, if applicable)
6. Data Subject Rights
WrenchLane.com will assist the Customer in fulfilling its obligations regarding individual rights, including:
Right to Access – Providing a copy of processed personal data.
Right to Deletion – Deleting data when requested, subject to legal retention periods.
Right to Restrict Processing – Limiting data processing upon request.
7. Data Retention & Deletion
WrenchLane.com will retain personal data only as long as necessary for the purposes outlined in the agreement. Upon termination of services, personal data will be deleted unless legal retention requirements apply. Data will be retained for 90 days post-termination, unless an explicit deletion request is made.
Any data that has been de-identified and aggregated before deletion may be retained indefinitely for WrenchLane.com's own service improvement and for the evaluation of its AI features. This data cannot be traced back to any customer and does not contain personally identifiable or proprietary information. Such data is never provided to the AI Sub-Processor for the training of its models, and the AI Sub-Processor does not train on Customer data (clause 2.4).
Customers may opt out of AI training data usage at any time by notifying WrenchLane.com via support@wrenchlane.com. Once an opt-out request is processed:
No further data will be used for training.
Previously anonymized and aggregated data cannot be removed, as it is no longer linked to any identifiable entity.
8. Liability & Indemnification
Both parties shall be responsible for damages resulting from violations of data protection laws. WrenchLane.com is liable only for non-compliance caused by its own processing activities.
9. Term & Termination
This DPA remains effective as long as WrenchLane.com processes personal data on behalf of the Customer. Upon termination, WrenchLane.com will delete or return all personal data unless legally required to retain it.
10. Contact Information
For any data protection inquiries:
Email: support@wrenchlane.com
Post: WrenchLane AB, Engelbrektsgatan 33, 114 32 Stockholm, Sweden