Privacy Policy

1. Who We Are and What This Policy Covers

This Privacy Policy explains how 440 Technologies LLC, doing business as Spekco (“Spekco,” “we,” “us”), handles personal information in connection with spekco.com and the Spekco platform (the “Service”). Capitalized terms not defined here have the meanings given in our Terms of Service.

We handle personal information in two different roles:

• As the business responsible for it: information about Business Customers and their Authorized Users, visitors to spekco.com, and people who contact us. For this information we decide how it is used, and this policy describes those uses.
• On behalf of the shops that use Spekco: information a shop enters or collects through the Service about its own customers (“Customer Data”). The shop decides how that information is used. We process it as the shop’s service provider, following the shop’s instructions and our agreement with the shop.

2. If You Are a Customer of a Shop That Uses Spekco

If a repair shop or other business uses Spekco and you are its customer, that business controls your information and its own privacy practices apply. Please send questions and requests about your information (for example, to see, correct, or delete it) to that business. If you contact us instead, we will refer you to the business or act on its instructions. We do not sell your information, and we do not use it for our own marketing.

3. Information We Collect

Account information: name, email address, phone number, company name, business address, and login credentials. Passwords are stored only as secure hashes.

Billing information: subscription payments are processed by Stripe. We do not receive or store full card numbers. Stripe gives us limited information, such as billing status and transaction records.

Customer Data: information shops enter or collect through the Service. Examples are their customers’ names, contact details, addresses, devices, repair tickets, notes, appointments, orders, invoices, payment records, files, and messages. Card payments a shop takes are processed by the shop’s own payment processor, and we do not store full card numbers.

Communications: messages you send us for support, and text messages and emails sent and received through the Service, including replies to messages a shop sends.

Device and usage information: IP address, browser and device type, pages viewed, referring page, timestamps, and diagnostic logs.

Website and advertising information (spekco.com): pages visited, visitor and session identifiers, the referring site, and campaign details from links and ads (such as UTM parameters and ad click identifiers). If you sign up, we attach those campaign details to your signup.

Information from others: data from Third-Party Services you connect (such as accounting software, payment processors, and online marketplaces), data you import from another system, and bot-detection results from Google reCAPTCHA.

4. How We Use Information

• To provide, operate, maintain, and support the Service
• To create and secure accounts, including two-factor authentication
• To process subscription payments and send receipts and billing notices
• To send service messages, such as verification, password reset, security, and product-change notices
• To send Business Customers news about Spekco, which you can unsubscribe from at any time
• To detect and prevent fraud, abuse, spam, and security incidents
• To measure whether our own advertising leads people to visit spekco.com and sign up
• To provide AI-assisted features when you choose to use them
• To understand how the Service is used and improve it
• To comply with law and enforce our agreements

We do not sell personal information. We do not use Customer Data to advertise to anyone, and we do not use it for our own marketing.

5. Cookies, Analytics, and Advertising Measurement

Essential cookies. The Service uses cookies needed for sign-in, sessions, security, and remembering settings such as your selected location.

First-party analytics. On spekco.com we record page views ourselves, with the details listed in Section 3. We do not use a third-party analytics service.

Google Ads. spekco.com uses the Google Ads tag to measure whether our ads lead to visits and signups. Google may set cookies and receive information such as your IP address, browser, and the pages you visit on spekco.com. Google’s Privacy Policy governs its use of that information. You can manage ad personalization at adssettings.google.com and block cookies in your browser settings. We do not place advertising tags in the Spekco staff application or in shops’ portals and online stores.

Google reCAPTCHA. Forms such as sign-up, password reset, and contact forms are protected by reCAPTCHA, which sends hardware and software information to Google to tell people from bots. Google’s Privacy Policy and Terms of Service apply.

Google Maps. Some address fields use Google Maps Platform to suggest addresses. Google receives what you type into those fields and your IP address.

Do Not Track. We do not currently respond to browser “Do Not Track” signals.

6. How We Share Information

Service providers. We use other companies to run the Service. They may use information only to provide their services to us. Our current providers are:

• Amazon Web Services: hosting, file storage, and email delivery (Amazon SES), in the United States
• Neon: database hosting, in the United States
• Resend: email delivery
• Twilio: text messaging
• Stripe: subscription billing
• Google: reCAPTCHA bot protection, Maps address suggestions, and Google Ads measurement on spekco.com
• ZipTax: sales tax rate lookup, which receives addresses
• EasyPost: shipping rates and labels
• Anthropic: AI-assisted features, which receive the information you give them (such as a business description)

We will update this list when our providers change.

Services you connect. When a Business Customer connects a Third-Party Service, such as Stripe or Square under the shop’s own account, QuickBooks Online, or an online marketplace, we exchange data with it at that customer’s direction. That service’s own privacy policy governs what it does with the data.

The shop you deal with. Information an End User provides through a shop’s portal, store, or booking page is available to that shop.

Legal reasons. We may disclose information when we believe in good faith that the law, a court order, or legal process requires it, or to protect the rights, safety, or property of Spekco, our customers, or others.

Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this policy.

With consent. We may share information for other purposes when you ask us to or agree to it.

7. Text Messages (SMS)

If you opt in to SMS/text messages from a repair business using Spekco, you will receive transactional messages about your repair — such as status updates, ready-for-pickup notices, and appointment reminders. Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time, or HELP for help.

Opting in to SMS is optional and is not a condition of any purchase or service. Consent is collected via an explicit, unchecked opt-in in your customer account. We do not sell or share your mobile phone number, SMS opt-in, or consent with any third parties or affiliates for their own marketing or promotional purposes. Mobile opt-in data is used solely to deliver the messages you requested.

8. Amazon Marketplace Integration

When a tenant connects an Amazon seller account to Spekco via the Amazon Selling Partner API (SP-API), we receive marketplace data on the tenant's behalf to power order fulfillment, inventory sync, listing management, and accounting reconciliation. The integration is opt-in per tenant and can be disconnected at any time.

What we collect from Amazon:

• The seller's public Selling Partner ID and authorized marketplace IDs
• Long-Lived Access (LWA) refresh and access tokens, encrypted at the application layer with AES-256-GCM in addition to storage-layer encryption
• Order metadata (order ID, totals, items, status, shipped-at timestamps)
• Buyer name and shipping address per Fulfilled-by-Merchant (FBM) order, used solely to render shipping labels via Amazon Buy Shipping (we do not propagate this data to other subprocessors or use it for marketing)
• FBA inventory snapshots, listing status, returns reports, settlement reports

What we do not collect: Buyer payment methods, financial instruments, review content, advertising metrics, or any data Amazon does not surface via the standard order / inventory / listings / finances / notifications endpoints. Buyer email addresses are received only as Amazon-aliased proxy addresses; we do not receive direct buyer email addresses.

Retention: Buyer name and shipping address columns on order records are automatically nulled within 31 to 90 days of order shipment. Refresh and access tokens are retained while the Amazon connection is active and scrubbed within 72 hours of disconnection. Order metadata (without buyer-PII columns) is retained while the tenant subscription is active and deleted on tenant offboarding.

Recipients: Amazon marketplace data is consolidated under a single "Amazon Marketplace" customer record before being pushed to QuickBooks Online; no per-buyer PII is propagated to QuickBooks. Buyer name and address are rendered onto shipping label PDFs that are stored in S3 with private-bucket access controls and signed URLs scoped per tenant; the rendered label is the operator's working artifact.

Full technical details (encryption methods, access controls, deletion procedures) are documented in our Amazon SP-API Data Protection Plan, which was submitted as part of our SP-API developer registration with Amazon and is available upon request via our contact page.

9. Security

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information. They include:

• Encryption of data in transit and at rest
• Passwords stored as secure hashes, and payment and integration credentials encrypted at the application layer
• Role-based permissions within each account
• Two-factor authentication for staff logins, and a setting that lets a business require it for every staff user
• Monitoring and alerting for suspicious activity

Security is shared. An account is only as secure as its passwords, devices, and the people who have access to it. Each Business Customer controls who can use its account and its customers’ data. We strongly recommend turning on required two-factor authentication for every staff user, using a unique password, and removing access promptly when someone leaves. Section 5 of our Terms of Service explains who is responsible for what.

No method of transmission or storage is completely secure, and we cannot guarantee that information will never be accessed without authorization. If we confirm a security incident affecting personal information we hold, we will notify affected customers as required by law.

10. How Long We Keep Information

We keep account information and Customer Data while the account is active. While an account is active, the shop decides how long to keep its customers’ information.

When a Business Customer cancels or closes its account, there is a restore window of at least 30 days. After that window, we permanently delete the account’s data from our production systems. Copies in backups are deleted as the backups expire.

We may keep some information longer where the law requires it, such as billing and tax records, or where it is needed to resolve disputes, prevent fraud and abuse, or enforce our agreements. For example, we keep records of text-message opt-outs so that opted-out numbers are not messaged again. Section 8 describes retention for the Amazon integration.

11. Your Rights and Choices

Depending on where you live, you may have the right to:

• Know what personal information we hold about you and get a copy
• Correct inaccurate information
• Delete your information
• Receive your information in a portable format
• Object to or limit certain uses, and withdraw consent you have given

Business Customers can update most account information in settings and export their data at any time. Customers of a shop should contact the shop first, as Section 2 explains. To make a request to us, use our contact page or email support@spekco.com. We will verify your identity before acting on a request. We respond within 30 days, or within any shorter period the law requires. If we decline your request, you may appeal by replying to our response. We will not discriminate against you for exercising these rights.

You can unsubscribe from our marketing emails using the link in any of them. Service messages about your account, billing, and security are part of the Service and continue while your account is active. You can stop text messages by replying STOP.

12. International Users

The Service is hosted in the United States. If you use it from another country, your information will be transferred to and processed in the United States, where privacy laws may differ from those where you live. Where required, we rely on transfer mechanisms that applicable law permits.

If UK or European data protection law applies to information we handle as the responsible business, our legal bases are: performing our contract with you, our legitimate interests (operating, securing, and improving the Service, and telling Business Customers about it), your consent where the law requires consent, and compliance with legal obligations. You may complain to your local data protection authority. For Customer Data, the shop is responsible, and requests should go to it first.

13. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Spekco accounts are for people 18 and older. If you believe a child has given us personal information, contact us and we will delete it.

14. Changes to This Policy

We may update this Privacy Policy. If a change is material, we will notify Business Customers by email or in the Service before it takes effect. The effective date at the top of this page shows the current version.

15. Contact

Questions about this Privacy Policy: contact page or support@spekco.com.

440 Technologies LLC, doing business as Spekco
1371 Briar Creek Drive, St. Charles, MO 63304, United States