Privacy Policy

Bimmerman ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our web application and services.

By using Bimmerman, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our services.

2.1 Personal Information

We collect the following personal information:

• Account Information: Name, email address, password (encrypted)
• Vehicle Information: BMW model, year, engine type, mileage, country of residence
• Service Records: Maintenance history, service dates, costs, modification details
• Payment Information: Processed securely by Stripe (we do not store full credit card details)
• Uploaded Documents: Photos or PDFs of service invoices and mechanic quotes

2.2 Automatically Collected Information

• Usage Data: Pages visited, features used, time spent, interaction patterns
• Device Information: Browser type, operating system, device identifiers
• IP Address: For security, fraud prevention, and regional pricing
• Cookies: Session cookies for authentication, analytics cookies for usage tracking

2.3 AI Interaction Data

• Chat Messages: Questions you ask "Ask Bimmerman" (not stored long-term, session-based only)
• Document Analysis: Text extracted from uploaded invoices and quotes (processed by AWS Textract)
• AI-Generated Insights: Personalized recommendations based on your vehicle and usage patterns

We use your information for the following purposes:

• Service Delivery: Provide core features (service tracking, AI chat, quote analysis, insights)
• Personalization: Tailor recommendations and insights to your specific BMW and usage patterns
• Payment Processing: Process subscriptions and manage billing via Stripe
• Communication: Send service updates, renewal reminders, feature announcements (you can opt out)
• Improvement: Analyze usage patterns to improve features and user experience
• Security: Detect fraud, prevent abuse, enforce our Terms of Service
• Legal Compliance: Comply with legal obligations and respond to lawful requests

We use the following third-party services to operate Bimmerman:

We carefully vet third-party services for security and privacy compliance. These services may process data outside Australia. By using Bimmerman, you consent to this transfer.

• Active Accounts: We retain your data as long as your account is active or as needed to provide services.
• Deleted Accounts: Data is permanently deleted within 30 days of account deletion (except where legally required to retain).
• Chat History: "Ask Bimmerman" conversations are ephemeral and cleared when you close the chat. Not stored long-term.
• Backups: Data may persist in encrypted backups for up to 90 days for disaster recovery.

Depending on your location, you have the following rights:

• Access: Request a copy of your personal data we hold.
• Correction: Update or correct inaccurate information (you can do this in your profile settings).
• Deletion: Request deletion of your account and all associated data.
• Portability: Export your service history and vehicle data in a machine-readable format (JSON/CSV).
• Opt-Out: Unsubscribe from marketing emails (account-related emails may still be sent).
• Restrict Processing: Limit how we use your data in certain circumstances.
• Object: Object to processing based on legitimate interests.

To exercise these rights, email us at privacy@bimmerman.com.au. We will respond within 30 days.

We implement industry-standard security measures to protect your data:

• Encryption: Data is encrypted in transit (TLS 1.3) and at rest (AES-256).
• Authentication: Passwords are hashed using bcrypt. We support secure session management.
• Access Controls: Strict role-based access controls. Only authorized personnel can access user data.
• Monitoring: Automated alerts for suspicious activity and security incidents.
• Vendor Security: All third-party services are SOC 2 Type II compliant or equivalent.

While we take security seriously, no system is 100% secure. If we experience a data breach affecting your information, we will notify you within 72 hours as required by law.

8.1 Essential Cookies

Required for authentication and core functionality. Cannot be disabled.

8.2 Analytics Cookies

Track usage patterns to improve the service. You can opt out in your browser settings.

8.3 Do Not Track

We respect Do Not Track (DNT) signals where technically feasible.

Bimmerman is not intended for users under 18. We do not knowingly collect data from children. If we discover we have collected information from a child, we will delete it immediately. If you believe a child has provided us with personal information, contact us at privacy@bimmerman.com.au.

Your data may be processed in Australia, the United States (AWS, Stripe), and other countries where our service providers operate. We ensure adequate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) for GDPR compliance
• Data Processing Agreements with all third-party vendors
• Regular security and compliance audits

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or via a prominent notice in the app. Continued use after changes constitutes acceptance of the updated policy.

You can view the full change history at our changelog (if applicable).

For privacy-related questions, concerns, or data requests, contact us:

As an Australian business, we comply with the Australian Privacy Principles under the Privacy Act 1988 (Cth). This includes:

• Open and transparent management of personal information
• Providing access to and correction of personal information
• Only using and disclosing information for lawful purposes
• Implementing reasonable security safeguards

If you have concerns about our privacy practices, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au