Draft · Not owner-approved · Not yet effective
Privacy policy
How TorqueOps handles personal information across its website, shop software, customer portal, and connected services.
1. Who is responsible
DISTRIVALEN COMERCIO Y SERVICIOS, S.A. DE C.V. (legal form: Sociedad Anónima de Capital Variable), operating as TorqueOps in Mexico, is responsible for personal data used to operate its own website, accounts, subscriptions, business communications, support, and service security. Address for this notice: Boulevard Adolfo López Mateos 1968, Colonia Los Alpes, Álvaro Obregón, Ciudad de México, C.P. 01010, México. Privacy contact: the company’s support team at privacy@torqueops.com.
TorqueOps also processes records on behalf of automotive businesses that use the service. Your shop decides why it collects your customer, vehicle, service, billing, and employee information, who may access it, and the lawful instructions it gives us. For those records, the shop is the responsible party and TorqueOps acts as its processor. This notice does not replace the shop’s own privacy notice.
2. Services covered
This notice covers the TorqueOps public website, public documentation, web application, customer Smart Links and portal, support interactions, and integrations when enabled for your shop. A feature described here is not a promise that it is available in every plan, country, environment, or account.
The public website and manual are separate from shop workspaces. Public product illustrations use sanitized examples; visiting these sites does not give access to a shop’s operational records.
3. Information we process
Account and business information: name, email, telephone, profile image where supplied, authentication and session records, shop identity and contact details, country, timezone, language, invitations, memberships, roles, and notification preferences.
Customer and vehicle information: customer names and contact details, billing identity and tax information such as RFC when entered, communication preferences, vehicle make, model, year, VIN, license plate, mileage, service history, and notes entered by the shop or customer.
Operations and workforce information: appointments, arrival and pickup details, estimates, approved or declined work, prices, inspections and findings, recommendations, job notes, uploaded photos or other supported evidence, staff assignments, work timers, completion records, and activity history.
Commercial and financial information: subscriptions, invoices, credit and refund records, payment amounts, status and references, payment proofs, provider account identifiers, supplier contacts, purchase orders, and supported marketplace purchase/import records. Financial or patrimonial data may require express consent under Mexican law unless a legal exception applies.
Communications and authorization evidence: inquiries and support correspondence, job messages, internal notes, sender/recipient identifiers, timestamps and delivery status; approval selections, typed names or drawn signatures, consent statements and associated audit evidence.
Technical information: browser and device characteristics, language, page and feature interactions, performance measurements, errors, network/request metadata, and security or abuse logs. Hosting and security providers may process IP addresses. The fields and retention depend on the service involved.
4. Where information comes from
We receive information from you, your shop and its authorized staff, customers using a Smart Link, suppliers or contacts entered by the shop, and providers you authorize to connect. If you choose Google or Microsoft sign-in, we receive the identity/profile information and permissions supplied for authentication, rather than your provider password. Configured Cloudflare Turnstile checks process browser/network signals to distinguish legitimate requests from abuse. We also generate session, delivery, payment-reconciliation, security, and operational audit records as the service runs.
Please provide only information needed for the task. Avoid including unrelated people, identity documents, full payment-card details, credentials, or sensitive information in notes, messages, photos, and support requests.
5. Necessary purposes and optional marketing
Necessary purposes are to create and secure accounts; administer shop access and subscriptions; operate scheduling, estimates, inspections, approvals, repair work, inventory, procurement, invoicing and enabled payments; deliver requested communications; provide support; reconcile transactions; prevent fraud and misuse; maintain service reliability; and meet legal, tax, accounting, and dispute-resolution obligations.
Optional purposes are sending product news or promotional communications when you choose to receive them. You may decline optional marketing without losing the core service, withdraw your choice through an unsubscribe instruction where supplied, or email privacy@torqueops.com. Necessary security, account, transaction, or requested service messages are separate from marketing.
This notice explains our practices; reading it or using the service is not blanket consent to every purpose or transfer. Where consent is legally required, it must be obtained through the relevant collection or authorization process. The shop is responsible for the notices and permissions required for information it submits.
6. Customer portal signatures and shop access
Smart Links provide scoped access to a shop’s published customer experience. Where required, email verification is used before protected records are displayed. Approval choices, the version presented, signatures, and related audit evidence may be retained to document authorization. A drawn signature is used as approval evidence, not to identify you through biometric matching.
Authorized shop staff can access records according to their roles and assignments. Customer-visible notes and published inspection or estimate details can be shared through the portal; internal notes are not intended for that audience. Treat links, verification codes, downloaded records, and exported files as confidential. Shop staff and recipients are responsible for copies they distribute outside TorqueOps.
7. Connected services and payment providers
When an authorized shop connects a service, we process the account identity, permissions, credentials or access tokens, connection status, and records necessary for that feature. Credentials are handled through restricted server-side systems. Disconnecting stops new authorized use subject to in-flight processing, but does not undo completed transactions or erase records that must be retained.
Stripe supports subscription billing and enabled customer-payment workflows. Other supported payment or marketplace integrations, including Clip, Mercado Pago, and Mercado Libre, are conditional on configuration, geography, permissions, and release availability. These services may receive billing/contact details, amounts, currency and transaction references, or return account, payment, refund, seller, item, and purchase data needed for the requested operation.
Where Google Places address suggestions are enabled, address search text and the selected place are exchanged with Google to help complete an address. Opening an external map sends the destination query to that map provider.
Payment credentials entered into provider-hosted or embedded payment components are handled by that provider. TorqueOps records transaction evidence and limited payment-method metadata where supplied; do not enter full card numbers or security codes in general application fields. Providers may act as independent controllers for their own fraud prevention, regulatory compliance, and account services. Review their notices when authorizing a connection or payment.
8. WhatsApp Meta and communications
If a WhatsApp connection is enabled, TorqueOps and the relevant messaging providers process the connected business/phone identifiers, access permissions, customer phone numbers or channel identifiers, message text, supported attachments where available, timestamps, delivery or read status, and conversation/job context needed to send, receive, and organize communications. Meta and any selected messaging partner process data under their own applicable terms and privacy notices.
This is limited to the connected business workflow; it does not authorize access to unrelated personal chats. Production availability and development/test connections are separate. Optional marketing requires the appropriate permission; a channel connection or service conversation is not consent to unrelated advertising.
To stop future channel access, the authorized shop can disconnect the integration and revoke permissions with the provider where available. To request deletion of WhatsApp/Meta data held by TorqueOps, email privacy@torqueops.com with the subject “WhatsApp data deletion”, the affected phone number/account, and shop name. Do not send access tokens or verification codes. We verify the request, coordinate with the responsible shop where necessary, and explain any legally required retention. Disconnecting alone is not a deletion request.
11. Retention deletion and backups
Retention depends on the purpose, the responsible shop’s lawful instructions, account status, unresolved payments or disputes, fraud/security needs, and applicable tax, accounting, and legal obligations. Closing an account, archiving a customer, disconnecting a provider, or removing a staff member does not automatically erase invoices, authorization evidence, communications, or audit history.
Some records are deliberately preserved as historical evidence. Deletion requests require a review of the data category and legal duties; where immediate deletion is not permitted, we explain the reason and restrict further use as applicable. Unneeded information should be deleted or irreversibly anonymized through the responsible operational process. Backups and provider records may follow separate expiration cycles and are not represented as instantly erased.
12. Privacy requests and ARCO rights
You may request access, rectification, cancellation, or opposition (ARCO), withdraw consent where it is the basis for processing, or ask to limit use or disclosure. Email privacy@torqueops.com with your name, a way to receive our response, the right you want to exercise, the affected account/shop and records, and details that help locate them. For correction, describe the change and supporting evidence.
We will request proportionate proof of identity or representative authority through an appropriate channel before disclosing or changing protected information. Do not include passwords, verification codes, card details, or unnecessary identity documents in the initial email. If the records belong to a shop, contact that shop first; you may also contact us so we can identify and coordinate with the responsible party.
For Mexican ARCO requests, the applicable law generally provides 20 business days to communicate the determination and, if appropriate, 15 business days to implement it after the response. A justified extension may apply as allowed by law. We will explain a refusal, limitation, or necessary extension and how to challenge it. Exercising rights is generally free, subject to legally permitted reproduction or delivery charges.
Cancellation and consent withdrawal are not retroactive and may be limited by legal retention duties or another permitted basis. We explain effects on the requested service. If you disagree with the handling of your request, you may seek protection from Mexico’s Secretaría Anticorrupción y Buen Gobierno or the competent privacy authority. Additional rights may apply under the law of your location; we evaluate requests under the law that applies.
13. Security and international processing
Our safeguards include authenticated access, shop/role-based authorization, restricted operational storage, controlled file access, server-side handling of provider credentials, and security/audit records. No system guarantees absolute security. We assess incidents and provide notifications when required by applicable law.
Cloud providers and authorized subprocessors may process or access information outside Mexico, including in the United States or other countries where their infrastructure and support operate. Foreign laws may permit access by local authorities. Applicable contractual and legal safeguards must accompany processing and transfers; this notice does not promise Mexico-only storage. Contact the privacy team for information relevant to your service.
14. Sensitive data children and automated decisions
TorqueOps is a business service and is not directed to children under 18. It is not designed to collect health information, racial or ethnic origin, religious beliefs, sexual orientation, biometric identification templates, or other sensitive personal data. Ordinary vehicle photos and approval signatures may still identify a person; avoid unrelated people or sensitive details in uploads. If such data is submitted unnecessarily or by a child, contact us so we can assess the appropriate action.
The service uses business rules for access, availability, workflow status, and payment reconciliation. This notice does not authorize credit scoring, biometric identification, sale of customer profiles, or training general-purpose AI models on shop records. Any future materially different use requires a separate assessment and notice or consent where applicable.
15. Changes and contact
We will publish changes at https://www.torqueops.com/privacy and https://www.torqueops.com/es/privacidad with a revised date and provide additional notice or obtain consent where a material change or applicable law requires it. Last revised: November 2, 2026.
Privacy contact: the company’s support team at privacy@torqueops.com — DISTRIVALEN COMERCIO Y SERVICIOS, S.A. DE C.V., TorqueOps, Mexico. The Spanish and English versions describe the same practices. For records managed by your shop, its own notice and lawful instructions also apply.