SHOPRPM
Privacy Policy
Effective October 23, 2026
The short version
- ShopRPM only reads from Tekmetric. It can't create, change, or delete anything in your shop's account.
- We pull only what the board shows: repair orders, appointments, employee names, and basic customer and vehicle info.
- Your data is shown only on your shop's private board. It's never shown to another shop, sold, shared, or used for marketing.
- Almost everything lives in memory and refreshes every minute. The only things saved to disk are customer names, phone numbers, and vehicle descriptions, so the board loads quickly. Those are deleted automatically after 90 days of not appearing on any repair order or appointment.
- If you cancel, we delete your shop's data within 30 days.
Who we are
ShopRPM ("ShopRPM," "we," "us") provides live dispatch boards for auto repair shops that use Tekmetric. ShopRPM is operated by Nick Carducci, a sole proprietor in New York, USA. Questions about this policy go to [email protected].
ShopRPM is an independent product. It is not owned or operated by Tekmetric.
Who this policy covers
This policy covers two groups:
- Shops that subscribe to ShopRPM and connect their Tekmetric account. Your use of the service is also covered by our Terms of Service.
- Visitors to shoprpm.app, including the public demo.
Shops' own customers never interact with ShopRPM directly. Their information reaches us only through the shop's Tekmetric account, and we handle it on the shop's behalf, only to display it on that shop's board.
Data we read from Tekmetric
Once a shop authorizes ShopRPM, we use Tekmetric's API with read-only requests to get the following for that shop only:
| Data | What the board uses it for |
|---|---|
| Repair orders: status, jobs, labor and parts status, labels, promise times, assigned tech and advisor, and RO totals | Showing where every car stands, tech workloads, parts holds, overdue promise times, and shop gauges |
| Appointments: times, titles, and status | Today's arrivals, waiters, and no-shows |
| Employees: names and IDs | Showing which tech or advisor owns each job |
| Customers: first and last name, primary phone number, and customer type | Labeling each car on the board so staff know whose it is, and giving advisors a callback number |
| Vehicles: year, make, model, sub-model, and license plate | Labeling each car on the board |
We don't request payment card data, customer addresses, or email addresses from Tekmetric, and we never write anything back to Tekmetric.
How we store it
- In memory, briefly. Repair orders, appointments, and employee lists are kept in the server's memory and replaced on every refresh (about every minute for active work). They aren't written to a database, and they're gone when the server restarts.
- On disk, minimal and self-expiring. To avoid looking up the same customer again and again, we save customer name, primary phone, customer type, and vehicle description on disk, keyed by Tekmetric ID. Each shop's saved data is kept in its own folder, readable only by the ShopRPM service. An entry that hasn't appeared on any of the shop's repair orders or appointments for 90 days is deleted automatically.
- Tekmetric credentials are stored on the server with owner-only file permissions. They are never sent to the board or to any browser.
- Server backups. Our hosting provider keeps rolling server backups for disaster recovery. Backups age out on a rolling basis, usually within a few weeks.
Who can see it
- Your shop. Each shop has its own private board link. Opening it saves an access key in that browser. Without your shop's key, your board and its data can't be loaded, and one shop's key can't open another shop's board. If a link is ever shared by mistake, we can issue a new one and the old one stops working right away.
- ShopRPM's operator. Only to set up, support, and fix your board.
- No one else. We don't sell, rent, or share shop or customer data. We don't use it for advertising or to contact your customers, and we don't use it to train AI models. We don't combine one shop's data with another's.
We'll disclose data only if required by law, such as a valid subpoena, and where allowed we'll tell the affected shop first.
Service providers
- Vultr hosts the server in the United States.
- Cloudflare provides DNS, encryption, and protection against attacks. All traffic to shoprpm.app passes through Cloudflare.
- Stripe processes subscription payments. When your shop pays, Stripe collects the billing contact, email, and card details directly. We see the name, email, and payment status, but never your full card number.
- Tekmetric is where the data comes from. Its handling of your data is covered by your agreement with Tekmetric.
Security
- All traffic is encrypted with HTTPS in transit at every step: browser to Cloudflare, Cloudflare to our server (with a verified certificate), and our server to Tekmetric.
- The server accepts web traffic only from Cloudflare. Admin access requires an SSH key, with password logins turned off.
- The service runs as a limited, non-root user. Board access keys are kept in secure, HttpOnly cookies that page scripts can't read.
- Tekmetric access is read-only, rate-limited, and scoped to the shops that have authorized ShopRPM.
No system is perfectly secure. If we learn of a breach affecting your shop's data, we'll notify you promptly, tell you what happened, and explain what we're doing about it.
Visitors to shoprpm.app
- We use Cloudflare Web Analytics, which counts page views and load times without cookies or tracking across sites.
- Like most web servers, ours keeps short-term access logs with IP addresses, browsers, and pages requested. We use them for security and troubleshooting, and they rotate out after about two weeks.
- The public demo uses made-up sample data and never connects to Tekmetric.
- The only cookie we set is the board access key, and only on a shop's own board. We use no advertising or tracking cookies.
- If you email us, we use your message only to reply.
Cancellation and deletion
When a shop cancels, its board is turned off, and its settings, logo, and saved data are deleted within 30 days. Copies in rolling backups age out after that. A shop can also revoke ShopRPM's access in Tekmetric at any time, which stops all data from flowing right away. To request deletion sooner, email [email protected].
Children
ShopRPM is a business tool. It isn't directed at children and doesn't knowingly collect data from them.
Changes
If we change this policy, we'll update the date at the top. For material changes, we'll email subscribing shops before the change takes effect.
Contact
Nick Carducci, ShopRPM: [email protected]