Privacy Policy

EthicalMechanic.org is operated by an independent administrator dedicated to consumer protection in the automotive repair industry. References in this policy to “we,” “us,” and “Ethical Mechanic” refer to that operator. The site is located at ethicalmechanic.org.

The categories of information we collect depend on how you interact with the site.

Account information (when you sign up)

• Email address and password (passwords are hashed; we never see the plaintext)
• Display name (if you provide one)
• Date you signed up, last time you signed in, and basic session metadata

Mechanic profile information (if you list a business)

• Business name, type (shop / mobile / both), owner name, phone, email, website
• Street address, city, state, ZIP, hours of operation, public description
• Business photo (uploaded by you, or auto-discovered from your public business website’s social-share image when no photo is on file)
• Pricing, service-area, and credential details you choose to publish

Verification documents (if you claim or submit a listing)

• Government photo identification
• Business license, EIN letter, DBA filing, sales tax permit, address proof, ASE / mechanic / insurance certificates — whichever you upload

These documents are used solely to verify your identity and the legitimacy of the business. They are stored in a private bucket and reviewed by a human administrator. They are never published, never sold, and never shared with third parties except as described in § IV.

Customer-side data (when you verify a mechanic, file a scam report, or browse)

• The business name, location, and details you submit through the public “Verify a Mechanic” tool
• The contents of any scam report you file (incident category, narrative, supporting evidence)
• If you choose to submit a scam report non-anonymously: your email address
• Search activity (which businesses are searched, when, in aggregate)
• Basic technical data: IP-adjacent information, user agent string, referrer, timestamps — the same data every web server sees

Operational data (generated by the platform)

• Verification reports produced through cross-referencing publicly available records — state license registries, Better Business Bureau records, news coverage, court filings, and consumer complaint records
• Trust score history, claim-request history, credential review history, audit logs of administrator actions
• Designation records for businesses confirmed as Verified Scammers, including evidence URLs, summaries, and identification photos sourced from public records

• To run the platform. Authenticate you, render your dashboard, send transactional email (claim invitations, verification reports, password resets, scam-report receipts).
• To verify mechanics. Cross-reference what you submit against publicly available records and surface inconsistencies for human review.
• To protect consumers. Maintain the public directory, the Verified Scammer designation register, and the audit trail required to defend designations against documented evidence.
• To enforce designations. When a mechanic is designated a Verified Scammer, we lock the linked account, refuse new signups using the same identifying information, and preserve the audit trail intact.
• To investigate misuse. Detect fraud, defend against abuse, and respond to legal process where required.

We do not use your information for behavioral advertising. We do not sell it. We do not run ad networks on the site.

We do not sell your personal information, and we do not share it with anyone except as described below.

Service providers we rely on to operate

Running the platform requires a small set of vendors that provide the infrastructure underneath: cloud hosting and storage, user authentication, email delivery, automated analysis tools that help us verify business information against public records, and access to public archives. Each provider is bound by their own privacy and security obligations and is contractually limited in how they may use the information they receive. We do not disclose the specific identity of these providers in this policy — both for our own operational security and to protect the integrity of the consumer-protection mission.

Sensitive uploaded documents — government identification, business licenses, insurance certificates — are stored in private, access-restricted storage and are never transmitted to automated analysis services. They are reviewed only by a human administrator.

Public information by design

Mechanic listings — including business name, address, phone, website, hours, photo, trust score, and any Verified Scammer designation — are publicly visible on the directory. That visibility is the point. If you list a business with us, expect that information to be indexed by search engines and visible to anyone who visits the site.

Legal disclosure

We will disclose information when required by valid legal process, when necessary to investigate fraud or abuse on the platform, or when necessary to protect the safety of users or the public.

• Account data: kept while your account is active. Deleted within 30 days of account deletion, except where retention is required to defend a designation or comply with law.
• Verification documents: kept for the life of the related claim, and for a reasonable period afterward to support the audit trail.
• Verification reports: kept indefinitely. They form the historical record used to detect repeat fraud patterns.
• Verified Scammer designation records: kept indefinitely. The designation is permanent, and so is its evidence trail.
• Operational logs: kept for a rolling window appropriate to the kind of log (typically 30–180 days for technical logs).

You can:

• Access the information on file about you by signing into your account or by emailing us.
• Correct inaccurate information — through your portal, the public “Submit a Correction” tool on a listing, or by emailing us.
• Delete your account through your portal settings, or by emailing us. Deletion is subject to one important limit: accounts linked to a Verified Scammer designation cannot be deleted while the designation stands. The audit trail must remain intact for the public record.
• Opt out of marketing email. Transactional email (claim invitations, password resets, verification reports you requested) is operationally required and cannot be unsubscribed from while you have an active account.
• Object to specific uses of your information by writing to us at the address below.

We will respond to verifiable requests within a reasonable time and free of charge. We may ask you to verify your identity before acting on a request.

We use cookies and similar browser storage strictly to keep you signed in and to remember basic preferences. We do not run third-party tracking pixels, behavioral advertising tags, or cross-site trackers on this site.

The vendors we use to run the platform may also set cookies as part of operating the underlying infrastructure (for example, to maintain your authenticated session). You can clear or block cookies in your browser settings; doing so may prevent you from staying signed in.

The site is intended for adults — business operators, customers, and other adult visitors. We do not knowingly collect personal information from anyone under the age of 18. If you are under 18, please do not create an account or submit information to us. If you are a parent or guardian and you believe a minor in your care has provided us with personal information, please contact us at the address below and we will delete it.

If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas, or another U.S. state with a comprehensive privacy law, you may have additional rights including the right to know what information we have about you, the right to correct or delete it, and the right to opt out of certain uses. To exercise these rights, write to us at the address below. We do not sell personal information and we do not engage in cross-context behavioral advertising.

When this policy changes materially, we will update the “Last updated” date at the top of this page and, where appropriate, notify account holders by email. Continued use of the site after an update means you accept the revised policy.

Questions, requests, or disputes about your information? Send us a message and we’ll respond personally within 5 business days.

Send a message →