Ionis Privacy Policy

• Workshop or Customer: the automotive repair business that subscribes to Ionis.
• User: any individual with an account inside a Workshop (e.g., administration or a mechanic) who uses the Platform.
• End Customer: the vehicle owner whose data is entered by the Workshop into the Platform (has no account or direct access to Ionis).
• Personal Data: any information that identifies or could identify a natural person, consistent with Costa Rica's Law No. 8968.

Workshop data: business name, address, contact phone and email, operating currency, logo, and subscription details (plan, renewal date, payment status).

User data (workshop staff): name, email address, role within the Workshop, password (stored hashed, never in plain text), optional profile picture, language/theme preferences, and sign-in history.

Technical and usage data: IP address, device and browser type, access timestamps, and an internal activity log (e.g., “User X updated appointment Y”) used for traceability, security, and support.

Cookies: the site and application use only strictly necessary cookies (session, language, visual theme). We do not use advertising cookies or third-party analytics tools such as Google Analytics or Meta Pixel.

To operate, each Workshop records information in Ionis about the people it serves: name, phone, email, vehicles (plate, make, model, year), maintenance history, scheduled appointments, and, in the vehicle-inspection module, WhatsApp reminders sent to the contact number the Workshop itself registered.

Iupiter processes this data only on the Workshop's instructions and to deliver the contracted service. The Workshop is responsible for having a lawful basis to collect and store its own customers' data (e.g., informing them their data is stored in a digital system) and for directly handling any request its customers make about their own data.

• Provide, maintain, and support the Platform.
• Manage the Workshop's account, billing, and communications about subscription status (including notices ahead of renewal).
• Send, at the Workshop's request, operational reminders (e.g., vehicle-inspection reminders via WhatsApp) to its End Customers.
• Detect and prevent unauthorized access, fraud, or misuse of the Platform.
• Comply with legal, accounting, or tax obligations.
• Improve the product using aggregated usage patterns that do not identify individuals.

We process Workshop and User account data based on performance of the subscription contract. End Customer data is processed on the Workshop's instructions, in its capacity as controller of that data. Where applicable, we also rely on our legitimate interest in keeping the Platform secure and reliable.

We retain account data for as long as the Workshop's subscription is active and, afterward, for the period necessary to meet legal or accounting obligations (e.g., billing records). Records the Workshop enters about its End Customers (clients, vehicles, maintenance jobs) remain under the Workshop's control, who can edit or delete them directly from the Platform; upon termination, the Workshop has a reasonable window to export its data before it is permanently deleted.

We do not sell personal data. We share information only with:

• Cloud infrastructure providers — hosting the database and application. Servers may be located outside Costa Rica.
• Transactional email provider — sending account emails (password resets, invitations, subscription notices).
• WhatsApp / Meta — delivering vehicle-inspection reminders when the Workshop enables that feature.
• Competent authorities — when a valid legal obligation requires disclosure.

We require these providers to accept contractual confidentiality and security commitments equivalent to those described here.

Because we use cloud infrastructure providers, data may be stored or processed on servers located outside Costa Rica. In those cases, we adopt reasonable contractual safeguards to require a level of protection equivalent to that set out in Law No. 8968.

We apply reasonable technical and organizational measures, including: passwords stored using one-way hashing, encrypted transport (HTTPS/TLS), data separation per Workshop, role-based access control, and an activity log for traceability. No system is completely infallible; if we detect an incident affecting your data, we will notify you as required by applicable law.

Under Costa Rica's Law No. 8968 and its Regulations, you have the right to:

• Access: know what data we hold about you and how we use it.
• Rectification: correct inaccurate or outdated data.
• Cancellation: request deletion of your data once it's no longer needed, or withdraw consent.
• Objection: object to specific processing on legitimate grounds.

If you are a User (workshop staff), you may exercise these rights by contacting us directly. If you are an End Customer of a Workshop, you should first direct your request to that Workshop, as it is the controller of that data; if the Workshop does not respond, you may write to us and we will help route the request. We will respond within the timeframes set by the Regulations to Law No. 8968. You may also file a complaint with Costa Rica's Data Protection Agency (PRODHAB).

Ionis is directed at businesses and is not designed for use by minors. We do not knowingly collect data from minors.

We may update this Policy to reflect changes to the Platform or applicable law. We will publish the current version with its update date and, for material changes, notify you by email or within the application.

For questions or to exercise your rights, contact ionis.contact@iupitersoftware.com.