Privacy Policy

Effective date: August 1, 2026

WinchWorks (winch.works) is business management software for tow and vehicle storage operators, operated by WeaveHub Technologies LLC, a United States company ("WinchWorks," "we," "us"). This policy explains what information we collect, how we use it, who we share it with, and the choices you have. It applies to the WinchWorks application and to this website.

1. Our Role: Controller and Processor

WinchWorks is used by tow and storage companies (our customers, the "operators") to run their businesses. That means two different kinds of personal information pass through the service, and our role differs for each:

• Account data about operators and their staff (the people who sign up for and use WinchWorks). For this data, WinchWorks decides how and why it is processed (we act as the data controller).
• Business records the operator enters, including personal information about vehicle owners and other third parties. For this data, the operator is the controller: the tow company decides what to collect and why, under the laws that apply to its business. WinchWorks acts as a processor, handling the data only on the operator's behalf and instructions, as described in our Terms of Service.

If you are a vehicle owner and have questions about records a towing company keeps about you, the towing company is the right first contact (they control that data). We will assist and will refer requests we receive to the relevant operator where we can identify them.

2. What We Collect

Account data

• Name, email address, and login credentials of each user on an account
• Company name and business contact details
• Subscription and billing status (payment card details are collected and stored by Stripe, not by us)

Enquiries you send us

If you contact us through the form on this website or by email, we receive what you choose to send: your name, email address, any phone number or company name you give, and the content of your message. We use it only to answer you and to keep a record of the exchange. Enquiry correspondence is kept for two years and then deleted, unless it becomes part of a customer support history or we are required to keep it longer.

The contact form is protected by Cloudflare Turnstile, which checks that a submission comes from a person rather than an automated script. Turnstile receives technical signals from your browser for that check and does not use them to build an advertising profile.

Tenant business records

Data the operator enters or uploads in the course of using the service, which can include personal information about third parties:

• Jobs, invoices, and payment records
• Vehicle owner and customer details: names, phone numbers, email addresses, physical addresses
• Vehicle identifiers: VINs and license plate numbers
• Photos and documents uploaded to the account (stored in cloud object storage)

Technical data

• Server and application logs, including IP addresses, timestamps, and request metadata, kept for security, abuse prevention, and audit purposes
• An essential session cookie (see Section 6)

We do not run third-party analytics or advertising trackers on the service.

3. How We Use Information

We use the information described above to:

• provide, operate, and maintain the service, including storing and displaying the records your company creates;
• secure the service: authentication, tenant isolation, audit logging, and detecting and investigating abuse or unauthorized access;
• manage subscriptions and billing through Stripe;
• send transactional email related to your account (for example, sign-in, billing, and service notices) via our email provider; and
• comply with legal obligations.

We do not sell personal information, and we do not use it for advertising or share it with advertisers. We do not use tenant business records to train machine-learning models or for any purpose other than providing the service.

4. Subprocessors and Service Providers

We use a small set of infrastructure providers to run WinchWorks. Each processes data only as needed for its role:

We may also disclose information if required by law, court order, or governmental request, or to protect the rights, safety, or property of WinchWorks, our customers, or others. If we ever add or replace a subprocessor that handles tenant data, we will update this policy.

5. Data Retention

• Active accounts: we retain account data and tenant business records for as long as the account is open, so the service can function.
• Closed accounts: after account closure, data is retained for 30 days so it can be recovered, then purged from our systems.
• Legal holds and legal obligations: financial and transaction records we are legally required to keep (for example for tax or accounting purposes), or data subject to a litigation hold or lawful preservation request, may be retained for as long as the applicable requirement lasts, and are then deleted.
• Logs: security and audit logs are retained for a limited period consistent with their security purpose, then deleted or anonymized.

6. Cookies

WinchWorks uses a single essential cookie to maintain your signed-in session. It is required for the service to work. We do not currently use analytics cookies, advertising cookies, or any third-party tracking cookies. Because we use only essential cookies, there is no cookie consent banner to manage.

7. Your Rights: Access, Export, and Deletion

Operators (account holders):

• You can view and correct your account and business data directly in the application.
• You can request export of your data, and request account closure, in-app or by emailing hello@winch.works. Closure starts the 30-day retention window described in Section 5, after which data is purged.

Vehicle owners and other third parties whose data an operator has entered: the operator (the towing or storage company) is the controller of that data. Please direct access, correction, or deletion requests to that company. If you contact us at hello@winch.works, we will assist and pass your request to the relevant operator where we can identify them, and we will act on the operator's lawful instructions.

Depending on where you live, you may have additional rights under state privacy laws (for example, the right to know, correct, or delete personal information). We honor such requests to the extent the law requires, within our role as controller or processor as described above. We do not discriminate against anyone for exercising privacy rights.

8. Security

We take security seriously. Measures include:

• Encryption in transit: all traffic to and from the service is encrypted with TLS.
• Tenant isolation: each customer company's data is segregated per tenant, and access controls enforce that users can only reach their own company's data.
• Access controls: authentication is required for all access, and internal access to production data is restricted and limited to what is needed to operate the service.
• Audit logging: security-relevant events are logged, including IP addresses, to support investigation and accountability.

No system is perfectly secure, and we cannot guarantee absolute security, but we work to protect your data with controls appropriate to the service. You can report security concerns to security@winch.works.

9. Breach Notification

If we become aware of a breach of security that affects personal information we hold, we will investigate, take steps to contain and remediate it, and notify affected customers without undue delay, consistent with applicable breach notification laws. Where the affected data belongs to an operator's tenant, we will notify that operator so it can meet its own notification obligations to the individuals concerned.

10. Children

WinchWorks is a business tool and is not directed at children. We do not knowingly collect personal information from anyone under 16, and the service is not intended for their use. If you believe a child has provided us personal information, contact hello@winch.works and we will delete it.

11. Where Data Is Processed

WinchWorks is operated from the United States, and data is stored and processed on infrastructure located in the United States. If you use the service from outside the US, you understand that your data will be transferred to and processed in the US.

12. Changes to This Policy

We may update this policy from time to time. When we do, we will change the effective date above, and for material changes we will notify account holders by email or in-app notice before the change takes effect where reasonably practicable. The current version will always be available at winch.works.

13. Contact

Privacy questions or requests: hello@winch.works. Security reports: security@winch.works.

WeaveHub Technologies LLC, operator of WinchWorks (winch.works), United States.