Privacy Policy

This Privacy Policy explains what information YardWyre ("YardWyre," "we," "us") collects when you use our software, including the YardWyre Field mobile app (together, the "Service"), how we use it, and who we share it with. YardWyre is based in New Jersey, USA.

1. Who Controls What

Two different kinds of information run through the Service, and it matters which is which.

Your business's own information — your account, your staff logins, your inventory — is information we hold to provide the Service to you. We decide, with you, how it is handled, and this policy governs it.

Your customers' information — the people who buy from your public storefront, ring your yard, or take a delivery from your driver — is yours. You are the business those people dealt with. We process it only on your instruction, to run the features you switched on, and we do not use it for our own purposes or for any other customer of ours. If one of your customers asks you what you hold about them, the answer is in your account, and we will help you produce or delete it.

2. Information We Collect

Account & business information: your name, business name, email, phone number, and login credentials when you sign up or we set up your account. Where you create additional logins for your staff, we hold the same details for each of them, along with a record of their active sessions so you can see who is signed in and remove access.

Inventory data: to provide the Service, YardWyre connects to your own Hollander/Powerlink AIM inventory database (hosted by you) to read parts inventory, pricing, photos, and vehicle fitment data. Where you use the features that create records, it also writes back to that same database on your instruction — vehicles and parts booked in through intake, photographs taken against them, work orders raised from marketplace orders, and related records. The database remains yours and stays your system of record. We keep only what the Service needs to do its job, such as the eBay listings and orders it manages and resized copies of part photos used in listings and your online store, not a separate copy of your inventory. If you ask us for a demonstration on your own inventory, we use a copy of your parts data for that demonstration. This connection is established over a private network tunnel and credentials are encrypted at rest.

Camera and photographs: parts of the Service use your device's camera — to read a VIN or a part tag from a barcode, and to photograph vehicles and parts. Your browser, or your phone for the YardWyre Field app, asks your permission first, and the camera is used only while one of those screens is open; we do not access it in the background, and those screens capture still images only, never audio. Photographs are uploaded and stored against the matching vehicle or part in your own Powerlink database. Because they are taken in a working yard, pictures may incidentally capture number plates, VINs, paperwork or people — you decide what is photographed and what is kept.

Data stored on your device: when you sign in, the Service stores a session token on that device so you stay signed in; choosing "Remember me" keeps you signed in until 30 days after your last visit. When you use the Service on a phone, your browser also caches the app's own files locally so it opens without waiting on a signal, and holds work done without a signal, including photos, until it can be sent. Signing out clears the session token; clearing your browser's data for the site removes the rest. Our Cookie Policy lists each item. What the YardWyre Field app keeps on the phone is described in section 3.

Information you send through our website: when you use a form on yardwyre.com to request access, ask for a quote or send us a message, we receive the details you fill in: your name, email address, business name, phone number, eBay store name and message, whichever of those the form asks for. We use them to reply to you and to follow up about YardWyre. They are emailed to our team, and we send you an automatic confirmation by email. We do not store your IP address with your message. If you arrived through a referral link, we also record which yard referred you, and that yard can see your business name, when you contacted us and how your enquiry is progressing.

Advertising cookie on our public website, only if you allow it: the public pages of yardwyre.com (such as the home, pricing and contact pages) can load the Google Ads tag, which sets a Google Ads cookie so we can tell which of our ads led someone to visit and to request access. It loads only after you choose to allow it in the cookie notice, and never if your browser sends a Global Privacy Control or Do Not Track signal. When it runs, Google receives the address and title of the page you are on, your IP address and browser details, and, when you send the request form on our home page, the fact that a request was sent, not what you typed. Google may use this to show our ads to people who have visited our website when they visit other websites. Our Cookie Policy lists each cookie and lets you change your choice. The signed-in app, your public parts store and your buyers' checkout never load it.

eBay account data: when you connect an eBay seller account, we store an encrypted OAuth refresh token and the business policy IDs you configure. We use this solely to publish/update listings and retrieve order information on your behalf, as authorized by you.

Public storefront and checkout: if you switch on your public parts store, buyers browse it without signing in and we log only the standard server request data described below. If you also switch on checkout, payment is taken through your own connected Stripe account — the buyer pays you directly and the money never passes through our balance. Stripe collects and holds the buyer's card details; we never see or store a card number. What we do receive back from Stripe, and store against the order, is the buyer's email address, name, and the billing and shipping address they gave at checkout, so the sale can be turned into a work order in your yard system. Where a buyer leaves a rating of your yard, we store that rating and any text with it.

Phone agent calls: if you switch on the AI phone agent, it answers calls to the number you point at it. To do that it processes the caller's phone number, the caller's side of the conversation as speech, and whatever they say — typically their name, their vehicle, and the parts they are asking about. The number is matched against your existing customer records so the agent knows whether it is talking to an existing customer. We store a written summary and a full text transcript of the call, together with the draft work order the agent prepares for your staff to approve. Your staff can read those transcripts in the Service. Speech is converted to text by our voice provider (see Third-Party Services below).

Delivery records: where you use delivery, the Service holds the delivery address and contact details of each stop, the drawn signature and printed name of whoever accepts the delivery, proof-of-delivery photographs taken at the stop, the amount collected and how it was paid (including a photograph of a cheque, where one is taken), and any notes your driver adds.

Driver location: while a driver has deliveries left that day, the driver's device reports its position — latitude, longitude, how accurate the reading is, speed and heading, which route it belongs to, and which version of the app sent it — so the run can be followed on a live map and stops can be routed. A stop can be marked delivered or not delivered only once the device has reported a position in the previous five minutes, and if the driver refuses or turns off location, the map shows that driver's location as off. This is location data about your employee, recorded while they are working. It is visible to you, their employer, and to us only as necessary to operate the Service. We keep two things. The first is each driver's most recent position, which each new report replaces, and which the live map shows. The second is a trail of where the driver went on a route: while a driver has stops left on a route assigned to them for that day, we also record a point from their reports at most once every 10 seconds, with the same latitude, longitude, accuracy, speed and heading and the time it was recorded, so the route's path can be drawn on the map and a delivery can be checked later. Within your business, the trail can be seen by the same staff who can see the live map, those with access to dispatch. Trail points are kept for 90 days and then deleted automatically, as described in section 7. The phone asks the driver's permission before the browser or the YardWyre Field app can read its position at all. In the browser, position is reported only while the page is open; the app can also report it in the background, as described in section 3.

Usage data: our servers keep standard logs (IP address, browser type, the page requested, the page you came from, and the time) for security and troubleshooting, for up to 90 days. When you are signed in, we also keep a record of the actions you take in the Service, with your IP address and browser, for 12 months, so you can see who did what and so we can investigate problems. We also count page views across our web pages, the app and public stores without using cookies: each page view is recorded with the page, the website or campaign that sent you, and the type of device, together with a one-way code made from your IP address and browser that changes every day, so it cannot be used to recognize you from one day to the next. Those individual records are deleted after 30 days; only daily totals are kept.

3. The YardWyre Field Mobile App

YardWyre Field is our app for iPhone and Android, used by your staff in the yard and on delivery runs. It is part of the Service: your staff sign in with the logins you give them, and it works on the same information described in section 2. This section covers what the app itself does on the phone. The app shows no advertising and contains no analytics or crash-reporting tools that we add or read. Some of the services it is built on — Expo for updates, and Google for barcode reading and notifications — do send those companies limited technical information, such as a random identifier for the app's installation, device details and error reports, as described below.

Location, including in the background: for a driver with a delivery route, the app shares the phone's location with your dispatchers while that driver has deliveries left today — that is, while any stop on that day's routes has not yet been marked delivered or not delivered. It sends the details listed under Driver location in section 2, at most once every 18 seconds. If the driver allows location "Always" (iPhone) or "Allow all the time" (Android), sharing continues when the app is closed or not in use, when the phone is locked, and while another app is open; before the phone asks for that permission, the app explains on its own screen what will be shared and when. On Android a notification stays on screen for as long as sharing runs, and an iPhone shows that an app is using location. Sharing stops by itself when every stop is recorded, at midnight, or when the driver signs out, and it never starts for staff who have no delivery route. Your business can switch background sharing off for an individual driver, in which case the app shares only while it is open on screen. Your staff who use dispatch see each driver's name, latest position and how long ago it was reported, and the trail of the route described under Driver location in section 2.

Camera and photo library: the app uses the camera to scan part tags and VINs, to photograph vehicles, parts, picked parts and deliveries, and to take your profile picture. It captures still images only, never audio. Barcodes are read on the phone itself, using Google's ML Kit, and the camera picture is not sent anywhere for that. ML Kit does send Google diagnostic information about how it runs — the phone's make, model and operating system version, the app's name and version, a random identifier for the app's installation, how long a scan took, the image format and size, and any error codes — but not the picture or what the barcode says; only where a barcode will not scan and the app reads a VIN or part tag from a photograph instead is that one picture sent, as described in section 4. Where you choose to add pictures from your phone's photo library — to a vehicle, a part, a delivery, your profile or a feature request — the app receives only the pictures you pick, not the rest of your library. A customer's signature at delivery is drawn on the screen and saved as a picture. Photographs and signatures are uploaded and stored as described in section 2.

Push notifications: if you allow notifications, the app registers the phone with Google Firebase Cloud Messaging, which gives it a device token. To do this, Google's Firebase software on the phone creates a random identifier for the app's installation and sends Google that identifier together with the phone's model, operating system version, time zone and language, and on an iPhone the token Apple's push notification service gave the phone. We store that token with your login, the type of phone (iPhone or Android) and the parts of the Service your login can use, and use it to tell you about new orders, new work orders and parts assigned to you to pull. Google delivers these notifications, and on an iPhone it hands them to Apple's push notification service; both receive the device token and the text of the notification, such as an order's title or a buyer's name. Turning notifications off on the app's Account screen, or signing out, removes the token from our records, and we also delete a token as soon as Google tells us it no longer works.

Data stored on the phone: the app keeps your sign-in token in the phone's secure storage (the iOS Keychain or Android's encrypted storage), readable only by the app and never copied to another device, and a copy of your name and permissions so it opens without a signal. It also keeps copies of the order and delivery pages and pull list you last opened, so they can be read with no signal; these are deleted whenever your session ends. Work done without a signal — photographs, scans, delivery outcomes and signatures among it — is held in the app's private storage until it can be sent, and is deleted from the phone once our servers have it. So that this work is not lost, it is kept through a sign-out, and is sent only when the same person signs in again on that phone; queued items can also be removed in the app. Deleting the app removes what it stored on the phone.

App updates: when it opens, the app can check whether we have published an update to its own code and download it, using the update service of Expo (650 Industries, Inc.). That check sends Expo the phone's IP address, a random identifier created when the app was installed, and technical details such as the app's version and whether the phone is an iPhone or Android, not your business's data. If the app closed because of an error the last time it ran, the next check also sends Expo the error message, cut to at most 1,024 characters, so that a faulty update can be withdrawn. The app also asks our own servers which app versions are still supported.

Signing out and deleting your login: signing out of the app stops location sharing, removes the push notification token from our records, and deletes the sign-in token, your saved profile and the offline copies of pages from the phone. Staff logins are created and removed by your business's administrator. To have a login deleted, along with the information held with it, ask your administrator, or ask us through the contact form and we will delete it for the records we hold, subject to section 7.

4. How We Use Information

• To operate, maintain, and improve the Service (e.g., publishing listings, syncing orders, generating sales reports).
• To communicate with you about your account, support requests, or service changes.
• To generate optional listing-title suggestions — only the specific part details needed for the title are sent, never your full database.
• To read a VIN plate or a part tag from a photograph when the barcode will not scan. The single picture you just took is turned into characters and used for that read alone. Typing the number in by hand is always available instead.
• To draft a reply to an eBay buyer's message or to a customer's warranty claim, when a member of your staff asks for one. The draft fills the reply box for your staff to read and edit; nothing is sent until they press Send, and YardWyre keeps neither the request nor the draft.
• To take payment on your public storefront, and to turn a paid order into a work order in your yard system.
• To answer calls on your behalf where you have switched the phone agent on, and to prepare a draft work order from what the caller said.
• To route, track, and evidence a delivery run.
• To detect, investigate, and prevent fraud, abuse, or security incidents.

We do not use your data, or your customers' data, to train artificial-intelligence models, and we do not sell it.

Optional: the anonymized sold-price benchmark

If — and only if — you switch it on (it is off by default), YardWyre adds the prices your parts sold for on eBay to a shared, anonymized benchmark, so that you and other participating yards can see a typical sold price for a given part type. It is optional, paying for the Service does not enable it, and you can turn it off at any time.

What is contributed is limited and aggregated. We use only the sold price, quantity, sale date, and the Hollander part type of parts sold through listings you published — never buyer information, and never your full sales history. A figure appears in the benchmark only as an aggregate (such as a median and quartiles) computed across several yards, and only once a part type has enough distinct contributors and sales to hide any single yard's numbers. Your yard is never identified and no individual sale is exposed. This is a benchmark for participating yards' own use; we do not sell it.

5. Third-Party Services

We share data only as needed to operate the Service:

• eBay Inc. — to publish/manage listings and retrieve orders via eBay's official APIs, under your authorization.
• Stripe, Inc. — to charge the payment card on your YardWyre account for your subscription, and to take payment on your public storefront where you have enabled checkout. When you add a card in the Service, Stripe's card form sets its own fraud-prevention cookies, listed in our Cookie Policy. Stripe collects and processes the buyer's card details directly under its own privacy policy and is the party that holds them; funds settle to your own connected Stripe account.
• Vapi — where you enable the phone agent, to answer the call, convert speech to text, and return the transcript and summary to your account.
• Our AI model provider — for the optional listing-title suggestions and the photograph-to-characters VIN/part-tag read described above, limited to the specific values needed for each request. For the optional reply drafts described above, it receives the text of the messages in that conversation (the buyer's or customer's messages and your staff's replies), with the listing, order or claim details needed to answer them and the reply guidance your admin has written; never your internal notes. The same provider's model also powers the phone agent: where you enable it, what the caller says is passed from Vapi to that provider so the agent can reply.
• Our email provider (Resend or SendGrid) — to deliver the emails the Service sends: to you (account email and storefront sale notices) and, where you have switched on the public storefront, to your buyers about their order (a pickup code, a shipping or refund notice, and a request to review the purchase). It receives the recipient's email address and the message.
• OpenStreetMap Nominatim — where you use delivery routing, to turn each stop's street address into map coordinates. It receives the address only, sent from our servers, and each address is looked up once and then cached.
• FedEx — where you connect your own FedEx account to quote or create shipping labels, to receive the shipment's details, including the recipient's name, address and phone number.
• Google LLC — only where you allow it, the Google Ads tag on the public pages of our website measures which of our ads lead to visits and access requests, and lets Google show our ads to past visitors. Google processes this under its own privacy policy.
• Google LLC (Firebase Cloud Messaging and ML Kit) — in the YardWyre Field app, Firebase Cloud Messaging delivers push notifications to the phones that have allowed them; it receives each phone's device token, a random identifier for the app's installation, the phone's model, operating system version, time zone and language, and the text of each notification. ML Kit reads barcodes on the phone itself and sends Google diagnostic information about how it runs, not the pictures. Google processes this under its own privacy policy.
• Apple Inc. — on an iPhone, Apple's push notification service delivers the notifications that Firebase Cloud Messaging hands it, and receives the same token and text.
• Expo (650 Industries, Inc.) — supplies updates to the YardWyre Field app's own code, and receives the identifier, technical details and any error message described in section 3.
• VIN decoding services (such as ChromeData, DataOne and the U.S. government's NHTSA vPIC service) — to turn a VIN into vehicle details. They receive the VIN being looked up, sent from our servers.
• Tailscale — provides the private network tunnel between YardWyre and your Powerlink database. Traffic through the tunnel is encrypted end to end; Tailscale handles setting up the connection.
• Infrastructure providers (e.g., our cloud hosting provider) — to run the Service. These providers do not have independent access to use your data for their own purposes.

We do not sell your data to third parties.

6. Data Security

We use industry-standard measures to protect your information, including encryption of stored credentials (database passwords, eBay tokens), TLS/HTTPS encryption in transit, private network tunnels for database connections, and access controls limiting who can view tenant data. Each customer's data is scoped to that customer's own account, and staff logins see only the areas and stores you grant them. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Data Retention

We retain your account and inventory-sync data for as long as your account is active, or as needed to provide the Service. You may request deletion of your account data through the contact form; some information may be retained where required by law or for legitimate business records (e.g., billing history).

Storefront orders, phone-agent transcripts, delivery signatures, proof-of-delivery photographs and each driver's most recent reported position are retained for as long as your account is active, so that they remain available to you as a record of the sale or the delivery. You can ask us to delete any of them at any time through the contact form. The trail of points recorded while a driver runs a route is kept for 90 days and then deleted automatically. A push notification device token is kept until notifications are turned off on that phone, its user signs out, or Google tells us the token no longer works.

Messages and requests sent through our website's forms are kept until you ask us to delete them. Server logs are kept for up to 90 days, the record of actions taken while signed in for 12 months, and the individual page-view records described above for 30 days.

8. Your Choices

You may disconnect your eBay account at any time from within the Service. You may request a copy of, correction to, or deletion of your account information through the contact form, or via section 12 below.

Camera access can be refused or revoked at any time — in your browser's site settings, or for the YardWyre Field app in the phone's Settings — and the scanning screens then let you type the VIN or part number instead. Access to your photo library is asked for only when you choose to add pictures from it, and can be refused or revoked the same way. Location access can be refused or revoked in the same places, which stops a driver's device reporting position; the rest of the delivery screens keep working, but a stop cannot be marked delivered or not delivered without a recent position, and the dispatch map shows that driver's location as off. In the app, a driver can also allow location only while the app is in use, in which case it shares only while the app is open on screen. Push notifications can be turned off on the app's Account screen or in the phone's Settings. Signing out clears the session token held on that device, and an administrator on your account can end anyone's session from the Service.

The Google Ads cookie is off unless you allow it, and you can change your choice at any time on our Cookie Policy page. You can also turn off ad personalization from Google at adssettings.google.com, or block or clear cookies in your browser; the website works the same without them.

Do Not Track and Global Privacy Control: if your browser sends a Do Not Track or Global Privacy Control signal, our website treats it as a choice not to allow the Google Ads cookie and never loads it. Apart from that, the Service does not change what it does in response to those signals.

Tracking across other websites: apart from Google Ads, which can collect information about your activity across different websites over time only if you allow it, and Stripe's fraud-prevention checks while a payment card is being added, we do not let other companies collect personal information about your activity on our website over time and across other websites.

The public storefront, storefront checkout, the phone agent, and delivery are each switched on per account. Where one is off, the information described above for it is not collected at all.

9. Your Customers' Rights

Where one of your customers exercises a right over their own information — to see it, correct it, or have it deleted — you are the business they will ask, and you can act on it in your account. Where you need us to help, tell us through the contact form and we will action it for the records we hold on your behalf.

10. Children's Privacy

The Service is intended for business use and is not directed to individuals under 18. We do not knowingly collect personal information from children under 13. If you believe a child has sent us information, tell us through the contact form and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we post the new version on this page and change the "Last updated" date above; a version takes effect on that date.

12. Contact Us

YardWyre is based in New Jersey, USA. Questions about this Privacy Policy, or a request about your information? Send them through our contact form and we'll get back to you.