BayThru privacy policy

Who we are and what this covers

BayThru: Dealership Follow-ups, published as BayThru by Mahara Labs, is a Mahara Labs product, provided by Mahara Labs (16276334 Canada Inc.), 3136 Mavis Road, Unit 210, Mississauga, ON L5C 1T9, Canada ("Mahara Labs", "we", "us").

This policy covers BayThru: the web app at baythru.maharalabs.com (including its pricing page and Talk to us form), the Android app, the download page at get.baythru.maharalabs.com and the BayThru API at api.baythru.maharalabs.com. The maharalabs.com website, including this page and the BayThru support form, is covered by the Mahara Labs privacy policy.

Your dealership controls its data

BayThru is a team app for car dealerships. A dealership (our customer) uses it to assign work to its staff and follow each task up until it is done. The owner signs the dealership up. The owner and admins add the team by sending each person a personal invite, and, if the owner allows it, managers invite new staff onto their own team. A dealership can cover several stores, and its email domain belongs to it alone.

The dealership decides who gets an account, what is recorded and who on the team can see it. For the dealership's content, Mahara Labs is the dealership's service provider (a processor): we handle it on the dealership's behalf, only to provide BayThru. We decide how billing records, trial checks, the feedback you send us and Talk to us requests are used, for the purposes in this policy.

What your dealership can see. Depending on their role, the owner, admins and your managers can see the tasks you work on and their history, whether you are online and when you were last active, the kudos you receive, the department scorecards and, if the owner turns it on, the team board, which ranks departments. Everyone in the dealership can see your name, job title, role, departments, manager and whether you are online. Your personal stats are shown only to you. The details are under "Who sees it".

You can change your own name, phone number and email address in your profile in Settings. Changing your email address asks for your current password; the owner and admins can also change it for you. Your managers can correct your name and phone number. Whether colleagues see your phone number is your own setting, "Show my number to colleagues", which is off by default. For other requests, such as changing your role, job title or who you report to, or getting a copy of the dealership's records, start with your dealership's owner or an admin. You can also contact us through the support form or at support@maharalabs.com, and we will help or pass your request to your dealership. Your dealership's own employee and privacy policies apply as well.

What we collect

• Your account. Your name, your email address (which is how you sign in) and, if you add one, your phone number; your role (owner, admin, manager or staff), job title, department (and any other departments you are in or head), who you report to and any additional managers whose team you are also on, and whether colleagues may see your phone number. It also holds the permissions the owner or an admin gives you: "Can send requests" (on by default) and, for a staff member, "Can assign tasks" with the departments they may send work to. Your password is stored only as a one-way hash, so nobody at Mahara Labs can read it. If you can't sign in, the owner or an admin of your dealership can set a temporary password for you: you are signed out on every device, we email you that it happened (never the password itself), you choose your own password the next time you sign in, and the dealership's History records who set it. Changing your email address asks for your current password when you change it yourself (the owner and admins can change it for you), tells the address you are leaving, and takes effect only once you confirm the link sent to the new address. We also keep whether the account is active, when it was created, who added you and which version of the terms you accepted.
• Your dealership. When an owner signs up: the dealership's name, phone number, website, city, province or state, country and team size, and the time zone of the device used. The owner must give a phone number; for everyone else it is optional. Each dealership gets a Dealer ID, a 9-digit account number we use for support, quotes and invoices, and to check claims and ownership transfers. A Dealer ID is never used to sign in or to join a dealership.
• Signing in. A count of wrong passwords: after 10 in a row the account locks for 15 minutes, and failed sign-ins and locks are logged. Password reset links (valid for 60 minutes), invite links (for one person, valid for 14 days and used up once that person sets a password) and email confirmation codes and links are stored only as hashes.
• Joining or claiming a dealership. When someone at a dealership's email domain asks to join it or claims it: their name, email address and, if given, phone number, the request and its outcome. For a claim proved through the dealership's website, we check for the DNS record or file the person added.
• Your work. Tasks (title, description, due date, priority, status, department, repeat schedule, the template it came from, and any reason given when a task is blocked, snoozed or deleted), the people helping on a task (helpers), tasks sent to several people at once (one task for each person, linked so the sender can follow them together), tasks posted "up for grabs" to a department and who took them, requests (a task sent to someone outside your team, or to a department; the person who receives it can decline it with a reason, and the reason is kept), "Ask for help" requests (the task you are stuck on is blocked, waiting on the request, and everyone who can see that task sees the request's title and who it went to; the request carries that task's title), checklists, tags, comments and the people mentioned in them, saved views and searches, task templates, announcements and who acknowledged them, one-to-one chat messages and whether they have been read, and the photos and documents you attach (some tasks need a photo before they can be marked done). Every photo is saved as a new copy, which drops embedded details such as the place it was taken; a photo we cannot process this way is refused rather than stored.
• Vehicle and customer details. Optional fields on a task: stock number, VIN, vehicle, repair order (RO) number, deal number, and a customer's name and phone number. They are searchable inside the dealership and are never put in push notifications, emails or webhook messages.
• Kudos. A thank-you on a task you completed, from the person who assigned it, a manager above you, the owner or an admin, with an optional note of up to 140 characters. Whoever gave it can withdraw it.
• Notification settings and reminders. Your choices for each kind of notification (push and email), quiet hours, whether urgent ones come through, and your daily summary time; the dealership's business hours and reminder rules; personal reminders and follow-ups you set on a task; and notifications held during your quiet hours until they end.
• Daily figures. For each working day, per person, per department and for the dealership: tasks done, done on time and overdue. They power the Today and Pulse screens, your personal stats and streaks, the department scorecards, the team board and the weekly recap.
• Activity. A log of actions in the dealership: who created, took, assigned, started, blocked, completed, reopened or deleted a task (with the reason), who commented on it and who added or removed its helpers; requests sent, declined (with the reason), handed on and cancelled; who invited, changed or removed a person, and a manager's request to remove someone, with any note; who set a temporary password for someone (never the password itself); changes to a person's "Can send requests" and "Can assign tasks" switches; sign-ins, failed sign-ins and locks; reports and blocks. The app shows this log as history (see "Who sees it"). An entry about an account change can include what changed, such as a name, phone number or email address. We also keep when you were last active, so people you can chat with can see whether you are online, and the in-app notifications we create for you.
• Sign-in sessions. Each device you sign in on has a session: a random sign-in token, stored only as a hash, with a device label such as "Chrome on Android", the platform and when it was last used. You can see your sessions in Settings › Devices and sign any of them out.
• Push tokens. If you allow notifications: in the Android app, a Firebase Cloud Messaging token that lets Google's push service reach that install; in a browser or the web app installed from it, the Web Push subscription, which is an address at your browser maker's push service and the keys used to encrypt messages to it. With each one we keep the sign-in session it belongs to and, in a browser, your browser or device description (the "user agent") and whether BayThru runs from your Home Screen, so the test notification in Settings can name each device and we can see why one is not getting notifications.
• Feedback, reports and blocks. Feedback you send from the app: your message, the app version, the platform, your browser or device description (the "user agent") and your dealership's Dealer ID. When you report a comment, chat message or conversation, file, announcement or kudos note: a copy of what you reported, the reason and any note you add. When you block someone in one-to-one chat: who you blocked. When you mute a conversation: which one and until when.
• Trial checks. Keyed hashes (HMAC) of the owner's email address and phone number, the dealership's email domain and website, and its name, made at sign-up. They are used only to stop a dealership from taking more than one free trial, and nobody can read the original details back from them.
• Purchases. When a dealership subscribes through Google Play: the purchase token, the plan, its status, its renewal and expiry dates, the order reference and which person in the dealership bought it. Google handles the payment; we never see card details. For a plan we invoice, we record the plan, its seats and its dates; the invoice itself is issued by Mahara Labs outside the app.
• Talk to us requests. When you ask us to set up a plan with the Talk to us form in BayThru on the web (the Android app does not have this form): your dealership's name, your name, role, email address and phone number, how many people the plan is for, your message, your country, the plan you were looking at and when you sent the request. With it we keep a hashed form of your IP address, used to limit repeated requests, and your browser description (the "user agent"). If you are signed in to BayThru when you send it, the request is also linked to your account and dealership, so we can see who asked. Deleting your account does not delete a request your dealership made; ask us at the support address and we will.
• API keys and webhooks (owners and admins only). The names, permissions and last-used time of API keys (the keys themselves are stored only as hashes), and the web addresses and events of webhooks. A revoked key or webhook stops working at once and stays listed, with who revoked it and when, until an owner or admin deletes it; the activity log keeps who created, revoked and deleted it.
• Information about other people. The customer fields above, and what people type into tasks, comments and messages, can include details about the dealership's customers. Your dealership is responsible for that information. Please include only what the work needs.

IP addresses. As with any website, your IP address and browser details reach our servers and our hosting providers with every request. BayThru uses your IP address to limit repeated attempts (rate limiting). When someone signs up, or asks to join or claim a dealership, the IP address is stored with that request for 24 hours to stop abuse, and then deleted. A Talk to us request keeps only a hashed form of the IP address, not the address itself, to limit repeated requests. BayThru does not store IP addresses anywhere else in its database. Our servers and hosting providers may record them in their usual technical logs, used for security and troubleshooting.

What we do not collect. BayThru has no analytics, advertising, tracking or crash-reporting tools, and shows no ads. It does not ask for your location, your contacts or your microphone, and it receives only the photos and files you choose to attach.

How we use it

• To run BayThru for your team. Signing you in, showing each person the tasks they hold, help on, created or oversee and the history of those tasks, reminders within the dealership's business hours (before a task is due, when it is due, then after it goes overdue, telling the person's manager and then the owner if it stays overdue, and once for a task with no due date that has not been started after two business days), personal reminders, nudges, @mentions, requests, chat, announcements, the daily summary, the Today and Pulse screens, kudos, personal stats and streaks, department scorecards, the team board and the weekly recap.
• To notify you in the app, by push notification if you allowed them, and by email (see below), and to help when notifications do not arrive (see "Notifications").
• To run the trial and subscriptions. Starting the free 30-day trial, checking that a dealership has not had one before, and opening or locking the dealership as Google Play reports the subscription or as we record a plan we invoice.
• To answer Talk to us requests. Replying to you, and setting up and invoicing a plan for your dealership if you go ahead. The hashed IP address and browser description are used only to limit repeated requests and spot abuse.
• To keep it secure. Limiting repeated attempts, locking an account after repeated wrong passwords, ending sessions when a password changes or a person is removed from the dealership, detecting a reused sign-in token, telling you about a sign-in from a new kind of device, keeping the activity log, and reviewing content that someone reports.
• To settle who runs a dealership. Handling requests to join or claim a dealership and ownership transfers: telling the owner and admins, checking website proof, and reviewing a claim ourselves when the owner does not decide it or the website does not prove it.
• To support your dealership. Answering support requests and feedback, and fixing problems. We look at a dealership's data only when the dealership asks us to help, to keep the service secure or working, to act on a report, or when the law requires.

Emails. BayThru emails come from BayThru by Mahara Labs (donotreply@maharalabs.com) and are delivered by Resend. They are:

• About your account: a confirmation code or link when you sign up or ask to join or claim a dealership; the welcome email with the dealership's Dealer ID; invites; password resets; a note of which email address you use (sent only if that address is registered); an alert when you sign in on a new kind of device; and, when your email address changes, a notice to the address you are leaving and a confirmation link to the new one.
• About the dealership (mostly to the owner and admins): join requests and claims, ownership transfers, trial-ending reminders (7, 3 and 1 days before), notices when the dealership locks and while its data is kept, and confirmations when an account or the dealership is deleted.
• About the work, as your notification settings allow: new tasks and requests assigned to you (several assigned within a couple of minutes arrive as one email, which lists only the tasks still assigned to you when it is sent), blockers on tasks you created or on the tasks of people on your team, completions on tasks you created, announcements, the daily summary and the weekly recap.
• About your feedback: an acknowledgement when you send us feedback from the app.
• About your Talk to us request: a confirmation to the email address you gave. The request itself is emailed to our support inbox.

We do not sell or rent BayThru data, use it for advertising, build profiles from it or use it to train AI models.

Why we are allowed to

In plain words: your dealership uses BayThru to run its work and has asked us to provide it to its team. The dealership decides what it records about its staff and customers, and it is responsible for having a lawful reason and giving any notice or getting any consent its team or customers need. We handle the data on the dealership's behalf for the purposes above, and for our own narrow needs: keeping the service secure, preventing repeat free trials, keeping the billing records the law requires, and answering the Talk to us requests people send us.

Who sees it, and who we share it with

Inside your dealership. The owner and admins run the dealership in the app: they see every task, the announcements, the team list and the whole history. They cannot read other people's one-to-one chats, in the app or in the dealership's export. A task is seen by the person it is assigned to, its helpers, the person who created it, the managers above any of them in the reporting line (a person may also have additional managers, who see all of that person's tasks like the main manager), the owner and the admins. A manager who heads a department also sees and manages every task filed in that department, whoever it is assigned to. A staff member the owner or an admin has given "Can assign tasks" can give work to staff in the departments chosen for them, and sees the tasks they created. A request (one person asking another, or a department, for something) is visible to the person who sent it, the person or department it was sent to, and both of their managers; a declined request keeps the reason the receiver gave. Helpers see the task and its comments and get its updates. A task posted up for grabs is also seen by the people in that department and their managers. A deleted task disappears from everyone's lists; only the owner and admins can still open it, marked as deleted, with who deleted it, when and why. Everyone in the dealership can see its directory: each person's name, job title, role, departments, manager, whether they head a department and whether they are online, with phone numbers only under the rules below. Managers see the team list, with email addresses and phone numbers only for themselves and the people below them (their reports and anyone they are an additional manager of). Phone numbers are shown to the owner, the admins and the person's own managers; colleagues see a number only when the person turns on "Show my number to colleagues" (off by default), and our servers never send a number to a colleague who may not see it. A one-to-one chat is shown only to the two people in it. Everyone you can chat with can see whether you are online and when you were last active. Announcements go to the people they are addressed to, and their author, the owner and admins can see who has acknowledged them and when, and who has not yet.

Kudos, personal stats and scorecards. Kudos on a task are seen by everyone who can see the task, and its history notes when kudos are given or withdrawn. The kudos you have received are seen by you, the owner, the admins and the managers above you. Your personal stats (tasks done this week, your on-time rate, and your current and best streak) are shown only to you, never on your profile, in Pulse or in an export. In Pulse, department scorecards show each department's on-time rate, overdue and finished tasks and how long tasks take: managers see the departments they manage, and the owner and admins see every department. The owner can turn on a team board, which is off by default; when it is on, everyone in the dealership sees the departments ranked by on-time rate this week. The weekly recap can name people who received kudos or finished all their tasks on time that week: the owner and admins see everyone's names, managers see the names of people below them, and staff see only their own. BayThru never ranks individual people or lists who did worst.

History. Each task shows its history: who created, took, assigned, started, blocked, completed, reopened, declined or deleted it, who added or removed its helpers, and when. Anyone who can see a task can see its history. The History screen is for the owner, admins and managers. The owner and admins see the whole dealership, including changes to people and settings and sign-in and security events. Managers see the history of the tasks they can see and of the people below them, never sign-in or security events. History lines name people, departments and checklist steps and can quote a short reason, such as why a task was blocked or deleted or a request declined; they never show email addresses or phone numbers. A deleted task's entries stay in the history.

Removing someone. A manager can ask the owner to remove someone on their team; the owner and admins see the request and any note with it. When the owner or an admin removes a person, whoever takes over their open tasks is told.

Reports and blocks. When you report something, the owner, the admins and Mahara Labs see a copy of it with the reason and your note, even if it was a one-to-one chat message. The owner and admins can remove reported content. Blocking someone hides their one-to-one chat messages from you, stops them messaging you, and stops their @mentions from notifying you.

Joining and claiming. When someone at your dealership's email domain asks to join, the owner and admins see their name and email address, and approve or refuse. When someone claims the dealership, the owner and admins are told at once and can approve or refuse; email addresses shown during a claim are partly hidden. Otherwise the claim is decided by proof on the dealership's website or by our review.

Exports. The owner or an admin can download the dealership's data as a file (JSON) in Settings › Export data. It holds the tasks, comments, announcements, kudos, people and departments, a list of the files, and only the downloader's own chats, never other people's one-to-one chats. The owner, admins and managers can also download the tasks they can see as a spreadsheet (CSV).

Mahara Labs. We read the feedback you send from the app, open reports, support requests and Talk to us requests. We look at a dealership's other data only for the reasons under "How we use it".

Service providers. These companies process data for us, only to deliver BayThru:

• Vercel serves the web app's pages and files. It receives ordinary request details, such as your IP address and browser, but not your dealership's content: the app loads that straight from our own servers.
• Resend delivers BayThru's emails, so it receives each email's recipient and content.
• Oracle Cloud Infrastructure hosts a Mahara Labs server in Toronto that the app's connections pass through on their way to our servers.
• Google (Firebase Cloud Messaging) delivers notifications to the Android app. It receives the install's push token and each notification's title and text (never vehicle or customer details).
• Your browser maker's push service (for example Google's for Chrome, Apple's for Safari, Mozilla's for Firefox) delivers notifications in a browser. Each notification is encrypted for your device under the Web Push standard; the push service sees the delivery address and when a message is sent.

Google Play sells BayThru subscriptions in the app. Google processes the payment under its own terms and privacy policy, and tells us the purchase's status. A plan we invoice is billed by Mahara Labs directly.

Software your dealership connects. The owner or an admin can connect other software to BayThru with an API key, the MCP endpoint (used by AI assistants) or webhooks. That software then receives the data the owner or admin allowed, such as tasks and, if permitted, the team list. Software that uses an API key acts with the owner's rights within the permissions given to the key: with permission to read people, it reads the team list, including email addresses and phone numbers, and the tasks it assigns show as coming from the owner or an admin. The dealership chooses and controls that software, and its own terms apply to it.

Otherwise, we disclose data only when the law requires it, or if Mahara Labs's business is sold or merged, in which case BayThru data would move to the new owner under this policy.

Where it is stored

BayThru's database, uploaded files and application servers are run by Mahara Labs in Ontario, Canada, and reached through a Mahara Labs server on Oracle Cloud in Toronto. The web app's pages are served by Vercel, and emails are delivered by Resend; both are United States companies. Google Play and browser push services run around the world. So some data is processed outside Canada, where it may be accessible to courts and authorities under local law.

How long we keep it

• Your account is kept while it exists. When the owner or an admin removes you from the dealership, you can no longer sign in and your sessions end, your open tasks go to your manager, to a person they choose or up for grabs, and you are taken off the tasks you were helping on. The account is kept so the owner or an admin can bring it back. You can delete it in the app (Settings), or ask on the account deletion page.
• The dealership's content (tasks, comments, checklists, chats, announcements, files, feedback, reports and the activity log, which is also the history) is kept while the dealership exists. Finished tasks move to the archive after 14 days without changes unless the dealership chose a different period; archived tasks are kept, not deleted. A deleted task disappears from lists but is kept, with who deleted it, when and why, until the dealership is deleted. A chat message is removed when its sender deletes it for everyone or it is removed after a report. Delete for me, Clear chat and Delete conversation only hide messages from your own view: the messages stay for the other person and with the dealership. A person who is removed stays on the dealership's Removed people list until an owner or admin takes them off it; their name stays on the work they did either way.
• Your alerts (the in-app notifications in Alerts) are kept until you clear them. An alert you clear is deleted overnight, and alerts you have read are removed automatically 30 days after they arrived; alerts you have not read stay until you read or clear them. Your alerts are deleted with your account.
• When a trial or subscription ends, the dealership locks. Its data is kept for 90 days, during which the owner can export it and is reminded by email, and is then deleted.
• A whole dealership is deleted, with every account, all content and files, its reports, blocks and feedback, when the owner deletes it in the app, or within 30 days of the owner asking us. We keep only what is listed below, and our own record that the dealership existed and was deleted (its name, Dealer ID and the dates).
• Billing records (Google Play purchase records and our invoices) are kept for 7 years, as tax law requires, even after the dealership is deleted.
• Talk to us requests are kept for 2 years after we close them, then deleted. Requests we mark as spam are deleted after 30 days.
• Backups. We keep encrypted nightly backups of BayThru's database and files on our own servers in Ontario, on a separate disk. A backup is kept for at most about eight weeks (the last 14 days, then one a week for 8 weeks), so data you delete stays in backups until they expire, and is used only to recover from a failure.
• Trial checks are kept, as keyed hashes, after a dealership is deleted, so the same dealership cannot start another free trial.
• Sign-in sessions end after 90 days without use, when you sign out, or when you sign them out in Settings › Devices. Ended and expired sessions are deleted 30 days later.
• IP addresses stored with a signup, join or claim request are deleted after 24 hours.
• Push tokens and subscriptions are deleted when that device's sign-in session ends (for example when you sign out there or in Settings › Devices, or the session expires), when the push service reports them no longer valid, or when you are removed from the dealership or delete your account.
• Kudos, daily figures, templates and reminders are kept while the dealership exists. Your notification settings, reminders and held notifications are deleted with your account; kudos and daily figures stay with the dealership under "Former staff member".
• Resend keeps records of the emails it delivered under its own retention policy.

Cookies and storage on your device

In a browser, BayThru sets one cookie, baythru_rt, from api.baythru.maharalabs.com. It keeps you signed in: it holds your sign-in token, cannot be read by scripts on the page, is sent only to the sign-in part of the API, lasts 90 days (renewed each time the app refreshes your session) and is removed when you sign out. The Android app does not use the cookie: it keeps the sign-in token in the phone's secure storage instead. There are no tracking or advertising cookies. The short-lived access token the app uses is kept only in memory.

The app also stores some things in your browser or phone:

• your profile, for the current session only;
• a copy of your recent task lists and notifications, so the app still shows something when you are offline, and a note of which task comments you have already seen;
• a cache of recent responses from our servers, kept by the app's service worker.

Signing out clears all of these, the sign-in cookie or stored token, and this device's push subscription. The app does not remember your dealership or your email address for the next sign-in.

Notifications

BayThru sends push notifications only if you allow them: through Google's Firebase Cloud Messaging in the Android app, and through Web Push in a browser and in the web app installed from it. They cover new and changed tasks and tasks up for grabs, being asked to help on a task and updates on tasks you help on, requests (someone asks you or your department for something; your request was declined, with the reason), reminders, nudges and escalations, comments and @mentions, blockers (which also reach the managers of the person who is stuck) and completions, deleted tasks, chat messages (with the start of the message), announcements, kudos, the daily summary and the weekly recap. The owner and admins are also told when a manager asks them to remove someone. When you @mention people in a comment, you pick them by name, and only people who can see the task are told. Everyone also sees their notifications inside the app.

Task reminders are on for everyone, within the dealership's business hours: an early heads-up before a task is due, a reminder when it is due, then reminders while it is overdue, which also tell the person's manager and then the owner if it stays overdue. A task with no due date gets one reminder to the person it is assigned to if it has not been started after two business days; a task up for grabs with no due date gets one reminder to its department. Someone can nudge you about a task at most once an hour. In Settings › Notifications you choose push and email for each kind, set quiet hours (notifications that arrive then are held and sent as one summary afterwards) and your daily summary time. You can turn off the early heads-up and your own personal reminders, but not the reminders when a task is due or overdue, nudges, or billing and security notices, because the work and the account depend on them. You can also turn notifications off in your phone's or browser's settings. Signing out stops them on that device, and an account that is removed from the dealership or deleted stops receiving them everywhere.

Settings also shows help for turning notifications on that fits your phone or browser, and can send you a test notification (Send test) that shows, device by device, whether it was delivered. When notifications are off on a device, or turning them on fails, the app sends our servers a short note about that device's setup (the step, the notification permission, whether the app is installed, and your browser or device description) so we can help. It is kept only in our servers' technical logs.

Children

BayThru is a workplace tool for dealership staff and is not meant for children. Dealerships must not create an account for anyone under 16. If we learn that an account belongs to someone under 16, we will ask the dealership to remove it, or delete it ourselves.

How it is protected

Every connection between the app and our servers uses HTTPS. Passwords, sign-in tokens, API keys and one-time links and codes are stored only as hashes. Repeated attempts are rate-limited, repeated wrong passwords lock an account for 15 minutes, sessions end when a password changes or a person is removed from the dealership, a reused sign-in token ends that device's session, and a sign-in from a new kind of device is reported to you by email. Every request is checked against the caller's dealership and role, so one dealership cannot see another's data, and our database and file storage are not reachable directly from the internet. Backups are encrypted, and a restore is tested every month.

BayThru is run by a small team. It has not been through an independent security audit or certification, and no system is perfectly secure. If we discover a breach affecting BayThru data, we will tell the affected dealership promptly, and we will notify you and the Privacy Commissioner of Canada where the law requires.

Your rights

Canadian privacy law, including the Personal Information Protection and Electronic Documents Act (PIPEDA) where it applies, lets you ask what personal information is held about you, ask for it to be corrected, and withdraw consent, subject to legal and contractual limits. You can delete your account in the app (Settings), or ask on the account deletion page.

Because your dealership controls its data, many requests are quickest through its owner or an admin. You can always use the support form or write to support@maharalabs.cominstead; we will reply within 30 days, and where the request needs the dealership's decision we will tell you and pass it on.

If you are not satisfied with how a request was handled, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or to your provincial privacy commissioner where a provincial law applies.

Changes to this policy

When we change how BayThru handles personal information, we update this page in the same release and move the date at the top. For significant changes we tell each dealership's owner and admins before they take effect.

Contact

Use the BayThru support form or email support@maharalabs.com. Mahara Labs (16276334 Canada Inc.), 3136 Mavis Road, Unit 210, Mississauga, ON L5C 1T9, Canada.