Collision Repair AI

Privacy Policy

Last updated: September 10, 2026

Introduction

Collision Repair AI ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services, including CRAIG (Collision Repair AI Genius) and related tools.

Information We Collect

Account Information

When you create an account, we collect:

  • Email address
  • Password (stored securely using industry-standard hashing)

Service Usage Data

When you use our services, we collect:

  • PDF files you upload for analysis (estimates and related documents)
  • Additional text or context you provide with your submissions
  • Analysis results and responses generated by our AI systems
  • Usage history, including timestamps and submission details

Technical Information

We automatically collect certain technical information:

  • IP address
  • Browser type and version
  • Device information
  • Usage analytics (via Google Analytics)
  • Error logs and diagnostic data

How We Use Your Information

We use the information we collect to:

  • Provide, operate, and maintain our services
  • Process your estimate analysis requests
  • Authenticate your account and manage your credits
  • Store your analysis history for your reference
  • Improve our services and develop new features
  • Monitor and analyze usage patterns
  • Detect, prevent, and address technical issues
  • Comply with legal obligations

Private Product Usage Measurement

We record when signed-in users open the workspace, view an analysis result, or successfully copy an estimate note. These events help us understand whether the product is useful and where the experience needs improvement.

This measurement stays on our hosting infrastructure. It uses a pseudonymous account identifier, a short-lived session identifier, event times, a broad screen-size category, and internal analysis or finding identifiers. These events do not include customer names, email addresses, VINs, claim or policy numbers, filenames, estimate text, copied notes, or search terms, and are not sent to third-party analytics services.

We schedule these product-usage events for deletion after 90 days through daily cleanup. The browser keeps temporary deduplication information for a session that expires after 30 minutes of inactivity. Existing analysis and billing records follow their separate retention policies.

Website Traffic Measurement

We measure visits using a random first-party browser identifier (up to 90 days), a session identifier, pages viewed, broad device/browser details, connection IP address, approximate IP-derived city/country, referring website, and campaign labels. A signed-in visit may be linked to your account for internal reporting. An IP location is approximate, not a precise position or proof of identity.

Traffic records are transferred over an encrypted connection from our hosting server to our private internal reporting server. Detailed records are retained for up to 90 days, with local recovery copies for up to 7 additional days. Temporary hosting copies are normally retained for up to 30 days; untransferred records may be kept longer to recover an interrupted transfer. We do not record form contents, estimate text, customer details, filenames, or arbitrary URL query values in this traffic system, and we do not sell these records. We do not add account identities or IP addresses as Google Analytics event fields; Google separately receives network connection information when its analytics script loads.

Our traffic script respects Global Privacy Control and Do Not Track signals. You can also disable this browser's optional traffic measurement: . Necessary account, security, and service records are separate.

Data Storage and Security

We implement appropriate technical and organizational measures to protect your personal information:

  • Encrypted data transmission (HTTPS/TLS)
  • Secure password storage using industry-standard hashing
  • Access controls and authentication mechanisms
  • Regular security assessments
  • CSRF protection for form submissions

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.

Third-Party Services

We use the following third-party services:

Firebase Authentication

We use Google Firebase Authentication to manage user accounts. Firebase processes your email and password according to Google's Privacy Policy. Your authentication data is stored securely by Firebase.

Google Analytics

We use Google Analytics to understand how visitors interact with our website. Google Analytics may use cookies and collect pseudonymous usage data. You can opt out of Google Analytics tracking using browser extensions or settings.

OpenAI API

When you submit estimates for analysis, we send your files and context to OpenAI's API to generate AI-powered analysis. OpenAI processes this data according to their Privacy Policy and Terms of Service. We do not use your data to train OpenAI's models.

Data Retention

We retain your information for as long as necessary to provide our services and fulfill the purposes outlined in this policy:

  • Account information is retained while your account is active
  • Analysis history is stored for your reference and may be retained after account deletion for a reasonable period
  • Uploaded files are processed and may be temporarily stored, then deleted after analysis completion
  • You may request deletion of your data at any time (see "Your Rights" below)

Your Rights

You have the right to:

  • Access your personal information and account data
  • Correct inaccurate or incomplete information
  • Delete your account and associated data
  • Export your data in a portable format
  • Opt out of certain data processing activities
  • Withdraw consent where processing is based on consent

To exercise these rights, please contact us at info@collisionrepairai.com.

Cookies and Tracking

We use cookies and similar tracking technologies to:

  • Maintain your authentication session
  • Remember your preferences
  • Analyze website traffic and usage patterns

You can control cookies through your browser settings. However, disabling cookies may affect the functionality of our services.

Children's Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.

Accessibility

We are committed to making our Services accessible to all users, including those with disabilities. We strive to follow Web Content Accessibility Guidelines (WCAG) 2.1 Level AA standards.

If you experience any difficulty accessing any part of our website or Services, or if you have suggestions for improving accessibility, please contact us at info@collisionrepairai.com. We will work with you to provide the information or service you need through an alternative communication method or one that is accessible for you.

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

Email: info@collisionrepairai.com
Website: collisionrepairai.com