Privacy Policy

MR Service, an auto repair shop based in São Paulo, Brazil, is the data controller under the Brazilian General Data Protection Law (LGPD, Law 13.709/2018).

For anything related to personal data, write to contato@mrservice.net.br.

MR Service ERP is an internal work tool used by the shop staff to record work orders, quotes, stock and payments.

It is not intended for the general public and does not create accounts on its own. Access requires a user created by the shop administration.

Staff sign-in data: name, username, e-mail or national ID, password (stored hashed), and sign-in timestamps.

Customer data entered by staff: name, tax ID, phone, address when provided, vehicle data (plate, make, model, year, mileage) and service and payment history.

Operational data: work order items, amounts, payment methods and tax documents issued.

Camera: only when you choose to take a photo to attach to a work order or document. The app never uses the camera in the background.

Files and storage: to attach documents and to save PDFs generated by the system to your device.

Network: to talk to the shop server.

The app does not collect location, does not read your contacts, does not access your messages and does not use the microphone.

Data is used solely to run the shop: issuing quotes and work orders, controlling stock and finances, issuing tax documents and communicating with the customer about their vehicle.

We do not use data for third-party advertising, we do not sell data, and we do not carry out automated profiling that produces legal effects on you.

Data stays on the shop’s own server. It is shared only as needed to deliver the service: with the Brazilian tax authorities when issuing an invoice, with the payment provider for card or Pix payments, and with WhatsApp when you choose to send a quote or notice to a customer through that channel.

Each recipient receives only the data needed for that purpose.

Tax and accounting records are kept for the period required by Brazilian law, currently five years.

Other operational records are kept while the customer relationship is active and may be removed on request, subject to legal retention duties.

The LGPD gives you the right to confirm processing, access your data, correct incomplete or outdated data, request anonymisation or deletion of unnecessary data, request portability and withdraw consent.

To exercise any of these rights, write to contato@mrservice.net.br. We answer within 15 days.

Access is protected by individual passwords and permission profiles, so each employee sees only what their job requires. Traffic between the app and the server is encrypted with HTTPS. Passwords are stored hashed, never in readable form.

Accounts are temporarily locked after repeated wrong password attempts.

The system is a professional tool and is not directed to anyone under 18.

If this policy changes, the update date below will change and the current version will always be available on this page.