Meca Privacy Policy

Version 0.9.3 · Last updated : October 5, 2026

Meca does not sell your information, does not do targeted advertising, and uses no third-party tracking or analytics tools. This policy explains, in plain language, what we collect, why, who we share it with (including outside Québec), how long we keep it, and how to exercise your rights.

It applies to the gomeca.ca website, the installable web app and the Meca mobile apps.

1. Who is responsible for your information

Meca is operated by a sole proprietorship doing business under the name “Meca” (registration with the Québec Enterprise Register pending; NEQ: [NEQ TO BE COMPLETED]; business address: [BUSINESS ADDRESS TO BE COMPLETED]).

Person in charge of the protection of personal information at Meca (a role held by the person with the highest authority in the business): contact@gomeca.ca. This is the right address for any question, access, correction, consent-withdrawal or deletion request, or privacy complaint.

2. Your consent

We collect and use your information only with your clear, free and informed consent, given for specific purposes. When you create your account, a separate checkbox (not pre-ticked) asks for that consent after pointing you to this policy. If you do not consent, we cannot provide the service, because the information in section 3 is necessary for it to work.

Withdrawing consent: at any time, at contact@gomeca.ca or by deleting your account (Settings). Withdrawing consent may prevent you from using some features.
For a new purpose (for example if we ever wanted to send you offers), we would ask for a separate consent again.
Push notifications and location (electric vehicles) are only enabled if you accept them on your device; you can withdraw them at any time in your device settings.

3. What we collect, why and for how long

Here is the complete list. Nothing else is collected. We do not have access to your contacts, to your continuous location, or to the contents of your device.

Information	Detail	Why	Where / how long
Account	First name, email address, language, creation date, acceptance of the terms (version, date)	Create your account, sign you in by email link, write to you (sign-in links, subscription confirmation)	Supabase. Until the account is deleted.
Vehicle(s)	Make, model, year, engine, VIN (optional), mileage, purchase, warranty and last oil-change dates	Tailor diagnoses, safety recalls and maintenance alerts to your vehicle	Supabase (and a local copy on your device). Until the vehicle or account is deleted. The VIN is not sent to the AI.
Diagnostic conversations	What you describe, your answers, Meca's questions and diagnoses, the full result (causes, estimated prices)	Answer you, keep the thread of the conversation, unlock your full diagnosis when you go Premium, show your history	Supabase. 24 months after the conversation's last activity, then automatic deletion; or sooner if you delete your account.
OBD2 codes	Codes read from your vehicle, with make, model and year	Explain the codes and answer in the OBD2 chat (Premium)	Explanations are cached anonymously (code + vehicle, not linked to you); the conversation follows the diagnostic-conversation rule.
Diagnostic or quote photos and videos	Images, or images extracted from a video or from a photo of a garage quote, that you choose to send	Have them analysed by the AI	Not kept by Meca: they are sent for analysis, then are not saved on our side. The AI provider deletes them under its own rules (section 5). Only the text of the result stays in the conversation.
Pre-purchase assistant	Inspection notes and photos you add to assess a used vehicle	Show them back to you, and have a photo analysed by the AI at your request	Supabase (private folder). Until you or the account deletes them.
Glovebox	Documents you voluntarily add (licence, insurance, invoices…) and their name, type and size	Keep them within reach, in your account only	Supabase (private folder, accessible only with your account). Until you or the account deletes them. Never sent to the AI. See the warning in section 11.
Maintenance log and alerts	Maintenance entries you record; status of reminders sent	Alert you when maintenance is due	Supabase. Until you or the account deletes them.
Subscription and payment	Stripe customer identifier, plan, trial and period dates, status (active, cancelled). Your card details are entered at Stripe: Meca neither sees nor keeps them.	Manage your trial, subscription and renewals; write to you about your subscription	Supabase for our copy; Stripe for payment. Mandatory accounting records (invoices, payments) are kept by Stripe and Meca for as long as the law requires (generally six years), even after the account is deleted.
Push notifications	Technical identifier provided by your browser or device	Send you the maintenance alerts you enabled	Supabase. Until disabled or the account is deleted.
Approximate location (electric vehicles)	Your coordinates, only if you tap the button to find chargers or weather; rounded before being sent to our providers	Find nearby chargers and estimate range from the weather	Not recorded by Meca.
Messages sent to Meca	Your contact-form message, category, email and active vehicle	Reply to you	Email (Resend, then our inbox). As long as needed to reply and keep a reasonable record of the exchange.
Technical data	IP address, device and browser type, pages requested, errors	Run and secure the service, prevent abuse	Hosting (Vercel) and authentication (Supabase) logs, kept briefly by those providers. No advertising profile is derived from them.

4. What your information is used for

Provide the service: diagnoses, OBD2 reading, analyses, history, alerts, subscription.
Bill and manage your subscription, and send you the related emails.
Keep the service secure and prevent fraud and abuse.
Meet our legal obligations (accounting, tax, confidentiality incidents).

We do not use your information for advertising, for commercial profiling, to train artificial-intelligence models, or to sell or rent to anyone.

5. Artificial intelligence and automated decisions

Diagnoses, code explanations, image and quote analyses and chat replies are produced automatically by an artificial-intelligence model (provider: Anthropic). To do so, we send it what you write or show, along with your vehicle's make, model, year and mileage, but not your name, your email or your VIN.

These results are based exclusively on automated processing. They have no legal effect on you and decide neither a price nor a refusal of service; they are general estimates (see the Terms, section 6). Access to Premium content depends only on your subscription.
On request, we tell you the personal information used to produce a result, the reasons and main factors that led to it, and you can have that information corrected (e.g. your mileage, your model).
You may submit your observations to the person in charge of the protection of personal information, who can review the result: write to contact@gomeca.ca.
Under its current API rules, Anthropic does not by default use data received through the API to train its models and in principle deletes it within 30 days; it may keep longer data flagged for violating its usage policies.

6. Who we share with, and where: providers and transfers outside Québec

We share your information only with the technical providers essential to the service, bound by contract or terms of service that prohibit them from using it for their own advertising purposes. Several are located outside Québec (United States, and some in Europe). Before communicating personal information outside Québec, Meca carries out a privacy impact assessment (PIA), as the law requires (s. 17), to make sure it would receive adequate protection.

Provider	Role	Information	Processing location
Supabase	Database, authentication, file storage	Account, vehicles, conversations, documents, subscription (copy)	United States (Ohio)
Vercel	Hosting of the site and server functions	Everything that passes through the service; technical logs	United States (Washington, D.C.); the delivery network uses servers in several countries, including Montréal
Anthropic	Artificial-intelligence model (diagnoses, analyses, chat)	Text, images and codes you send; make, model, year, mileage	United States
Stripe	Payment and billing of subscriptions	Email, card, billing address you enter at Stripe, payment history	Canada and United States
Resend	Sending emails (sign-in links, subscription confirmation, replies)	Your email and the content of the message sent	United States
OpenStreetMap (Overpass service) and MET Norway	Nearby chargers; weather forecasts (electric-vehicle features, on request)	Rounded coordinates, sent by our servers, without your identity	Europe
Your device's notification services (Apple, Google, Mozilla…)	Delivery of push notifications if you enable them	Your device's technical identifier and the notification text	Depends on your device
App stores (Apple App Store, Google Play)	Distribution of the mobile apps and, later, possible in-app purchases	Under their own policies	Depends on the store

We may also disclose information without your consent where the law requires it (a court order, for example). The app's fonts are hosted by us: your browser does not contact Google to load them.

Meca sells no information. If ownership of the business ever changed, your information would pass to a successor only with the same commitments, and we would notify you.

7. Cookies, local storage and tracking technologies

Meca uses no advertising cookies, no third-party analytics or tracking tools, no pixels, and no profiling technology. (That is why you do not see a cookie banner.)

The app only uses your browser's local storage (localStorage, sessionStorage) and a session token, strictly necessary for it to work: keeping you signed in, remembering your language, your active vehicle, a conversation in progress and preferences. This data stays on your device (and your vehicles are synchronised with your account). If we ever added a tracking technology, it would be off by default and enabled only with your consent, and this policy would be updated.

8. How long we keep your information, and how we destroy it

Account, vehicles, maintenance log, documents, pre-purchase photos: until you delete them or delete your account.
Diagnostic conversations: 24 months after their last activity, then automatic deletion; or sooner if you delete your account.
Diagnostic photos and videos, quote photos: not kept by Meca (section 3).
Accounting records tied to payments: as long as the law requires (generally six years).
Technical logs: briefly, at the host and the authentication provider.
Backups: short-lived; they disappear on their own at the end of the provider's rotation cycle.

Destruction. When you delete your account, we immediately delete your account, vehicles, conversations, documents and files, maintenance history, notifications and Stripe customer (which cancels the subscription). Information the law requires us to keep is set aside and destroyed at the end of the required period. When information is no longer needed, we destroy or anonymise it.

9. Your rights and how to exercise them

Access: know what information we hold about you and get a copy.
Rectification: have inaccurate information corrected (most can be corrected by yourself in the app).
Withdrawal of consent and deletion: withdraw your consent or ask for your information, or your account, to be deleted.
Portability: receive your computerised information in a structured, commonly used technological format.
Information about automated decisions and the right to submit your observations (section 5).

How: write to contact@gomeca.ca from your account's email address (to confirm it is you), or use the Delete my account and data page. Response time: in writing, diligently and no later than 30 days after your request is received. Access to your information is free; reasonable fees could only be charged for reproduction or transmission, and only after telling you the approximate amount.

If you are not satisfied, write to us first: we will treat your complaint seriously and reply in writing. You may also contact the Commission d'accès à l'information du Québec (cai.gouv.qc.ca, 1-888-528-7741). If you live outside Québec, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca) or your province's authority.

10. Security and confidentiality incidents

Encrypted connections (HTTPS); data access restricted per account (database-level security rules); files in private folders; secret keys on the server only; access to production data limited to the person in charge.
In the event of a confidentiality incident (unauthorised access, use or disclosure, loss or other breach), Meca promptly takes reasonable measures to reduce the risk of harm and prevent a recurrence, records the incident in a register (kept at least five years) and, if the incident presents a risk of serious injury, promptly notifies the Commission d'accès à l'information and the individuals concerned. Users outside Québec are also notified, and the Office of the Privacy Commissioner of Canada where needed, under the applicable law.

11. Glovebox: only put in what is necessary

Glovebox documents are stored in a private folder of your account. Only upload what you really need (for example your driver's licence or car insurance) and avoid highly sensitive documents (passport, SIN, bank documents, medical records). You can delete a document at any time.

12. Our personal-information governance rules

Meca is a small business; its rules come down to a few concrete commitments:

Roles and responsibilities: the person with the highest authority in the business holds the role of person in charge of the protection of personal information, is the only one with access to production data, and ensures compliance with the law throughout the information's life cycle (collection, use, retention, destruction).
Minimal collection: we only collect what the table in section 3 lists.
Retention and destruction: the durations in section 8, automatic deletion of old conversations and full deletion when the account is closed.
Providers: we choose recognised providers and assess privacy factors before any transfer outside Québec (PIA).
Incidents: procedure and register described in section 10.
Complaints: any privacy complaint is received at contact@gomeca.ca, acknowledged promptly, examined by the person in charge, and receives a written reply within 30 days.
New projects: a PIA is done before any new project involving personal information (for example adding a provider or a feature).

13. Minimum age

Meca is for people 18 and older (see the Terms, section 3). We do not knowingly collect information about minors; if we learn we have, we delete the account.

14. Emails

Meca only sends you transactional emails, necessary for the service you asked for: sign-in link, subscription confirmation, receipts, replies to your message. You cannot unsubscribe from them because they are part of the service; they stop when the account is deleted.

Meca sends no promotional emails (news, offers). If that changed, it would be only with your express, separate consent, and every message would identify the sender and explain how to unsubscribe in one click, as Canada's Anti-Spam Legislation (CASL) requires.

15. Users outside Québec

If you live elsewhere in Canada, federal law (PIPEDA) and your province's law apply as the case may be; we follow the same principles (consent, limiting collection, access, safeguards, openness). The law governing the contract is that of Québec, without depriving you of your province's public-order protection (see the Terms, section 17).

16. Changes to this policy

When we make a significant change to this policy, we change the version number and date at the top of the page and notify you by email or in the app before it takes effect. For any new purpose for your information, we ask for your consent again.