Privacy Policy

Effective date: August 14, 2026

WinchWorks (winch.works) is business management software for tow and vehicle storage operators, operated by WeaveHub Technologies LLC, a United States company ("WinchWorks," "we," "us"). This policy explains what information we collect, how we use it, who we share it with, and the choices you have. It applies to the WinchWorks application and to this website.

1. Our Role: Controller and Processor

WinchWorks is used by tow and storage companies (our customers, the "operators") to run their businesses. That means two different kinds of personal information pass through the service, and our role differs for each:

• Account data about operators and their staff (the people who sign up for and use WinchWorks). For this data, WinchWorks decides how and why it is processed (we act as the data controller).
• Business records the operator enters, including personal information about vehicle owners and other third parties. For this data, the operator is the controller: the tow company decides what to collect and why, under the laws that apply to its business. WinchWorks acts as a processor, handling the data only on the operator's behalf and instructions, as described in our Terms of Service.

If you are a vehicle owner and have questions about records a towing company keeps about you, the towing company is the right first contact (they control that data). We will assist and will refer requests we receive to the relevant operator where we can identify them.

2. What We Collect

Account data

• Name, email address, and login credentials of each user on an account
• Company name and business contact details
• Subscription and billing status (payment card details are collected and stored by Stripe, not by us)

Enquiries you send us

If you contact us through the form on this website or by email, we receive what you choose to send: your name, email address, any phone number or company name you give, and the content of your message. We use it only to answer you and to keep a record of the exchange. Enquiry correspondence is kept for two years and then deleted, unless it becomes part of a customer support history or we are required to keep it longer.

The contact form is protected by Cloudflare Turnstile, which checks that a submission comes from a person rather than an automated script. Turnstile receives technical signals from your browser for that check and does not use them to build an advertising profile.

Tenant business records

Data the operator enters or uploads in the course of using the service, which can include personal information about third parties:

• Jobs, invoices, and payment records
• Vehicle owner and customer details: names, phone numbers, email addresses, physical addresses
• Vehicle identifiers: VINs and license plate numbers
• Photos and documents uploaded to the account (stored in cloud object storage)

Technical data

• Server and application logs, including IP addresses, timestamps, and request metadata, kept for security, abuse prevention, and audit purposes
• An essential session cookie (see Section 6)

We use PostHog for product analytics and error monitoring inside the signed-in application, so we can see that features are working and be alerted when something breaks. It records which actions were taken (for example, a job created or an invoice finalized), technical error details, and the signed-in user's name, email address and role. It does not record the business records you enter — customer names, vehicle details, invoice amounts and similar are excluded, and error messages are stripped of that content before they are sent. Interaction capture, session recording and session replay are all switched off. We do not run advertising trackers on the service.

3. How We Use Information

We use the information described above to:

• provide, operate, and maintain the service, including storing and displaying the records your company creates;
• secure the service: authentication, tenant isolation, audit logging, and detecting and investigating abuse or unauthorized access;
• manage subscriptions and billing through Stripe;
• send transactional email related to your account (for example, sign-in, billing, and service notices) via our email provider;
• understand how the product is used and detect errors, so we can see that features are working and be alerted when something breaks;
• send occasional product and marketing email to the person who created an account, or who contacted us, about WinchWorks features, changes, and offers — you can opt out at any time using the unsubscribe link in any such message, or by emailing us, and we will stop; and
• comply with legal obligations.

We never market to your customers. Product and marketing email goes only to the people who signed up for a WinchWorks account or contacted us directly. The business records you enter — vehicle owners, their contact details, adjusters, and everything else about your jobs and invoices — are never used to send marketing, are never used for advertising, and are never disclosed to anyone for their own marketing. We hold that data only as your processor.

We do not sell or share personal information, as those terms are defined under United States state privacy laws, including for cross-context behavioral advertising. We have never done so and have no plans to. We do not use tenant business records to train machine-learning models or for any purpose other than providing the service.

4. Subprocessors and Service Providers

We use a small set of infrastructure providers to run WinchWorks. Each processes data only as needed for its role:

We may also disclose information if required by law, court order, or governmental request, or to protect the rights, safety, or property of WinchWorks, our customers, or others. If we ever add or replace a subprocessor that handles tenant data, we will update this policy.

5. Data Retention

• Active accounts: we retain account data and tenant business records for as long as the account is open, so the service can function.
• Closed accounts: after account closure, data is retained for 30 days so it can be recovered, then purged from our systems.
• Legal holds and legal obligations: financial and transaction records we are legally required to keep (for example for tax or accounting purposes), or data subject to a litigation hold or lawful preservation request, may be retained for as long as the applicable requirement lasts, and are then deleted.
• Logs: security and audit logs are retained for a limited period consistent with their security purpose, then deleted or anonymized.

6. Cookies

Essential. WinchWorks uses a single essential cookie to maintain your signed-in session. It is required for the service to work.

Advertising measurement. When we run search advertising, Google Ads sets cookies (for example _gcl_au and _gcl_aw) so that we can tell whether an advert led to someone starting a trial. These are set by Google, not by us, and we use them only to count conversions — we do not build advertising audiences, run remarketing, or use them to profile you across other websites. If we ever begin to, we will say so here first.

Product analytics remains cookieless. Our product analytics keeps no cookie and no browser storage of its own, and identifies you from the session you are already signed in to.

Because advertising measurement cookies are not strictly necessary, visitors in jurisdictions that require prior consent for such cookies (for example the EEA and the UK) should not be served them without consent. WinchWorks advertises in the United States only. If we advertise into those jurisdictions we will add a consent mechanism before doing so.

7. Your Rights: Access, Export, and Deletion

Operators (account holders):

• You can view and correct your account and business data directly in the application.
• You can request export of your data, and request account closure, in-app or by emailing hello@winch.works. Closure starts the 30-day retention window described in Section 5, after which data is purged.
• You can opt out of product and marketing email at any time, using the unsubscribe link in any such message or by emailing hello@winch.works. Opting out does not stop transactional messages — sign-in, billing, and service notices are part of the service and continue.

Vehicle owners and other third parties whose data an operator has entered: the operator (the towing or storage company) is the controller of that data. Please direct access, correction, or deletion requests to that company. If you contact us at hello@winch.works, we will assist and pass your request to the relevant operator where we can identify them, and we will act on the operator's lawful instructions.

Depending on where you live, you may have additional rights under state privacy laws (for example, the right to know, correct, or delete personal information). We honor such requests to the extent the law requires, within our role as controller or processor as described above. We do not discriminate against anyone for exercising privacy rights.

8. Security

We take security seriously. Measures include:

• Encryption in transit: all traffic to and from the service is encrypted with TLS.
• Tenant isolation: each customer company's data is segregated per tenant, and access controls enforce that users can only reach their own company's data.
• Access controls: authentication is required for all access, and internal access to production data is restricted and limited to what is needed to operate the service.
• Audit logging: security-relevant events are logged, including IP addresses, to support investigation and accountability.

No system is perfectly secure, and we cannot guarantee absolute security, but we work to protect your data with controls appropriate to the service. You can report security concerns to security@winch.works.

9. Breach Notification

If we become aware of a breach of security that affects personal information we hold, we will investigate, take steps to contain and remediate it, and notify affected customers without undue delay, consistent with applicable breach notification laws. Where the affected data belongs to an operator's tenant, we will notify that operator so it can meet its own notification obligations to the individuals concerned.

10. Children

WinchWorks is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 16, and the service is not intended for their use. If you believe a child has provided us personal information, contact hello@winch.works and we will delete it.

11. Where Data Is Processed

WinchWorks is operated from the United States, and data is stored and processed on infrastructure located in the United States. If you use the service from outside the US, you understand that your data will be transferred to and processed in the US.

12. Changes to This Policy

We may update this policy from time to time. When we do, we will change the effective date above, and for material changes we will notify account holders by email or in-app notice before the change takes effect where reasonably practicable. The current version will always be available at winch.works.

13. Contact

Privacy questions or requests: hello@winch.works. Security reports: security@winch.works.

WeaveHub Technologies LLC, operator of WinchWorks (winch.works), United States.