Privacy Policy

Effective date: October 28, 2026

Bumpstart is operated by Bumpstart LLC, a Texas limited liability company ("Bumpstart", "we", "us"). This policy explains what we collect when you use Bumpstart, why, who helps us process it, and the choices you have.

The short version

• Your shop's data belongs to your shop. We use it to run Bumpstart for you, and nothing else.
• We don't sell your data, and there are no advertising or analytics trackers.
• We never see your card number: payments are handled by Stripe.

What we collect

Your account

• Your name and email address.
• Your password, stored only as a one-way hash, or, if you sign in with Google, the name, email address and profile picture Google shares with us.
• Sign-in sessions, including the IP address and browser details of the device that signed in, so we can keep your account secure.
• Your appearance choice (Match device, Light or Dark), so the app looks the same on every device you use.

Your shop's data

What you and your team put into Bumpstart, including:

• Contacts: your customers' and suppliers' names, phone numbers, email addresses and addresses.
• Machines, work orders, time entries, flips, parts and inventory, expenses, invoices and payments.
• Photos and files you upload, including a bill of sale for a machine you buy, which can show the seller's name and address. Photos are resized and compressed when uploaded.
• Your shop's settings, team members and their roles.
• For a device repair, the shop may record the device's passcode or unlock code. It is stored encrypted. It is shown only when someone working on the job asks to see it, and each time it is shown, the job's history records who saw it and when (never the code itself). It is erased when the job is finished. It is never shared: it is left out of exports, reports, our logs, the customer portal and Ratchet, and our support team never sees it.

Your shop is the one responsible for the customer information it enters. We process it on your shop's behalf.

Server logs

When you use Bumpstart, our servers record each request: the time, the page or action, the result, your IP address and browser details. Passwords and session cookies are removed before anything is logged. We use logs to keep the service running and secure, and to fix problems.

On your device

• A session cookie that keeps you signed in. It's needed for Bumpstart to work.
• A few preferences saved in your browser, such as your barcode scanner and printer setups and which tab you last had open. These stay on your device.
• If you scan barcodes with your camera, the image is read on your device. Camera images are not sent to us.
• If your shop takes card payments in the Bumpstart Android app (Tap to Pay on the phone, or a Bluetooth card reader paired with it), the app asks for location access, and for Bluetooth access to find and connect the reader. Stripe requires the device's location for each in-person payment, to prevent fraud, and Stripe's payment software on the phone sends it and information about the device to Stripe. We don't store your location.

How we use it

• To run Bumpstart: store your shop's records, show them to the people you've allowed, and do the calculations you ask for.
• To send the emails the service needs: account verification, password resets and team invitations.
• To bill your subscription.
• To keep the service secure, and to find and fix problems.
• To answer you when you contact us.

When our support team looks at your shop

If someone in your shop asks us for help through Ratchet, the in-app assistant, our support team may ask to see your shop the way that person sees it, so we can understand the problem.

• We never see your shop without that person's permission. The request appears in their app, and nothing is shown to us unless they choose Allow. They can end the session at any time, and it ends on its own after 60 minutes.
• It's view only: we can't add, change or delete anything in your shop.
• We see your shop as the person who allowed the session sees it, including invoices, reports and jobs, so we can help with the figures on them. Passwords and sign-in settings, the keys that connect your shop to other services, and bank, payout and card details are never shown to us. On your contact list, customers' phone numbers, email addresses and street addresses are partly hidden: we see the last 4 digits of a phone number, the domain of an email address, and the town, state and ZIP code. A device passcode a shop records is never shown to us.
• Each session is recorded: who asked, who allowed it, when it started and ended, how it ended, and the names of the pages we opened, never their contents. When it ends, a summary is emailed to the person who allowed it and to your shop's owners.
• Your shop's owner can turn these requests off in the app's Settings.

Who processes it for us

We use these service providers, each only for the job listed:

• MongoDB Atlas: database hosting, where your account and shop data are stored.
• Render: hosts the Bumpstart application and this website.
• Cloudflare: R2 file storage, for the photos, attachments and logo you upload.
• Stripe: payments, in two roles. For your Bumpstart subscription, Stripe collects your payment details directly; we keep only a reference to your Stripe customer and subscription. If your shop takes card or bank payments from its customers, it does so through its own Stripe account: Stripe receives the business and payout details your shop gives it when setting the account up, and, for each payment, the payer's card or bank details and the amount, whether paid online, on a card reader, or by tapping on a phone in the Bumpstart app. We keep the payment's reference, amount and status and, for a card payment, the card's brand and last 4 digits so they can be shown on the receipt; never the full card number, its expiry or security code, or bank details. When you provide personal data in connection with setting up your shop's Stripe account, Stripe receives that personal data and processes it in accordance with Stripe's Privacy Policy.
• Resend: sends Bumpstart's emails: sign-in and account emails, team invitations, the emails your shop sends its customers (such as invoices, estimates and job updates), and the purchase orders your shop emails its suppliers (with your shop's name, ship-to address and account number with that supplier). It receives the recipient's address and the message.
• Google: only if you choose to sign in with Google.
• Telnyx: text messages and phone calls. When your shop texts its customers, or a customer texts or calls your shop's Bumpstart number, Telnyx carries the message or call, so it receives the phone numbers involved and the content of the message. When your shop registers for texting, the business details it enters (such as its legal name, address, contact details and, if it has one, its EIN) are sent through Telnyx to the mobile carriers, who require them before a business may text. Telnyx also carries calls and texts to and from our own support line. Texts your shop sends and receives are stored in your shop's records, with the phone number and the message encrypted.
• ElevenLabs: if your shop uses the AI receptionist, or when you call our support line, the call is answered by an AI voice agent run by ElevenLabs. A caller to your shop is told at the start that they're speaking with the shop's AI assistant and that the call is recorded. ElevenLabs receives what is said on the call, records it and returns a transcript. The recording stays at ElevenLabs; we don't copy it, and it is deleted after 90 days. The transcript is stored encrypted, and a short summary of the call is written with Anthropic (below).
• Intuit (QuickBooks): only if you connect your shop's QuickBooks Online company. Bumpstart receives an authorization from Intuit to read and write accounting data in that company on your behalf, and stores the authorization and your QuickBooks company id encrypted. We use it only to send your invoices, payments, purchases, expenses and parts costs to QuickBooks, with the name, email address, phone number and billing address of the customer or supplier on each; and to read back your chart of accounts, customers, suppliers, payments and bills recorded there, and your Profit and Loss, Balance Sheet and Cash Flow reports. Disconnecting (in Bumpstart or in QuickBooks) revokes the authorization and deletes it. What was already sent stays in your QuickBooks company.
• Mapbox: if your shop uses automatic mileage, the addresses involved (your shop's and the pickup or delivery address) are sent to Mapbox to calculate the driving distance.
• Anthropic: the AI model behind Ratchet, the in-app assistant, the AI receptionist and our support line. Under Anthropic's commercial terms, it doesn't train its models on what we send. For Ratchet, it receives the question you ask, the earlier messages in that conversation, and the help articles that match it. If your plan includes Ratchet's answers about your shop, it also receives your shop's date and time zone and what Ratchet looks up to answer you, limited to what your role can already see in the app: totals and counts, and display details such as customer names, invoice, repair and flip numbers and statuses, machine make and model, part names and stock levels, expense categories, amounts and dates. If your shop is connected to QuickBooks, this can include the monthly overhead and operating profit Bumpstart calculates from your QuickBooks Profit and Loss, when you ask Ratchet about profit, and payments you recorded in QuickBooks on Bumpstart invoices, when you ask about payments or invoices, including in each invoice's amount paid and balance. Costs and margins are included only for roles allowed to see them, and a customer's description of a repair only when the question is about it. Your customers' phone numbers and email addresses, notes, and card or payment details are never sent. Ratchet only reads; it can't change anything in your shop. On a call answered by the AI receptionist or our support line, the AI voice agent (ElevenLabs, above) uses Anthropic's model to understand the caller and decide what to say, so Anthropic receives what is said on the call. Afterwards, Anthropic writes the call's short summary from its transcript. When Ratchet can't answer a question, Anthropic also sorts that question and removes names and contact details from it; for that it receives the question and the names of the permissions your role has and the features your plan includes, nothing else from your shop. We also use Anthropic to draft our own help articles from our published help, never from your shop's data.

Questions Ratchet couldn't answer

When Ratchet can't answer a question, we may keep a copy of the question with names and contact details removed. It isn't linked to your shop or to you, and we use it only to improve our help. Questions about your shop's records are kept as a topic only, never in your words. A shop's owner can turn this off in Settings.

Text messages

Shops that use Bumpstart can text their own customers about their jobs: updates, estimates to review and pickup reminders. Each shop texts from its own registered number and is responsible for having its customers' consent. A customer can reply STOP to any message to stop receiving texts from that shop, and HELP for help. We record a STOP so the shop can't text that number again until the customer replies START. Message frequency varies, and message and data rates may apply. Each shop's own text message terms and privacy page, linked from its registration, describes its program.

Text messages from Bumpstart

Bumpstart also texts the people who use it about their own support requests, from our support number, but only if they agree. You agree in the app's Profile: enter your mobile number, tick the box that reads "Bumpstart may text you about your support requests. Msg freq varies. Msg & data rates may apply. Reply STOP to opt out, HELP for help. Consent is not a condition of purchase. We won't share your mobile number with third parties for marketing.", and enter the code we text to the number. We keep your number, encrypted, and a record of your agreement: the wording you agreed to, when you ticked the box and when you entered the code. We text you only about your support requests, plus the code that confirms your number; we don't send marketing texts. Message frequency varies, and message and data rates may apply. Reply STOP to any text to stop, or turn support texts off in your Profile; reply HELP for help. See Text messages from Bumpstart in our Terms.

Mobile numbers and consent to receive text messages are never shared, sold or rented to third parties or affiliates for their marketing or promotional purposes. They are shared only with the service providers that deliver the messages (Telnyx and the mobile carriers), and only to deliver them.

We will not share your opt-in to an SMS campaign with any third party for purposes unrelated to providing you with the services of that campaign. We may share your Personal Data, including your SMS opt-in or consent status, with third parties that help us provide our messaging services, including but not limited to platform providers, phone companies, and any other vendors who assist us in the delivery of text messages.

All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

We don't sell or rent personal information, and we don't share it for advertising.

How long we keep it

• Your account and shop data are kept while your account is active.
• When you delete your account, see Delete your account for what's removed. Database backups are kept for up to 30 days and then overwritten.
• Server logs are kept for up to 30 days.
• AI receptionist calls: the recording and the transcript are deleted after 90 days. The call's summary and any message the caller left stay in your shop's records.
• Calls to our support line: the recording is deleted after 90 days; the transcript and the support case, with its summary, after 1 year.
• Text messages and STOP requests are kept in your shop's records while your account is active.
• A device passcode or unlock code is erased when the job it was recorded for is finished.
• Your mobile number is deleted when you remove it from your Profile or delete your account. The record of when you agreed to, or stopped, texts from Bumpstart is kept while your account is active.
• A question Ratchet couldn't answer (above) is kept for up to 180 days, without your name, your shop's name or your contact details.
• Records we must keep by law, such as billing records, are kept for as long as the law requires.

Your choices and rights

You can see and correct most of your information in the app. You can also ask us for a copy of your personal information, ask us to correct or delete it, or ask how it's used, by emailing support@bumpstart.app. We'll verify the request comes from you before acting on it. Depending on where you live, you may have further rights under laws such as the GDPR or the CCPA/CPRA, and the right to complain to a data protection authority.

If you're a customer of a shop that uses Bumpstart, please contact that shop first: it controls your information. We'll help the shop respond.

Security

Data is encrypted in transit. Each shop's data is kept separate from every other shop's, and access inside a shop follows the roles the shop sets. No system is perfectly secure; if we learn of a breach affecting your information, we'll tell you as the law requires.

Children

Bumpstart is a business tool and is not directed at children under 16. We don't knowingly collect their information.

Where data is processed

Bumpstart's servers are in the United States.

Changes to this policy

If we change this policy, we'll update the effective date above. For significant changes, we'll also tell shop owners by email or in the app before the change takes effect.

Contact

Bumpstart LLC
106 S Sierra Woods Dr
Rockport, TX 78382
support@bumpstart.app