Legal
Privacy Policy
Marked Complete is run by MurkyThud LLC. This policy says what we collect, why, who sees it and for how long. It is written for the shops that use the software and for their customers, who may reach it from a quote, an invoice or a text message.
The short version. We collect what a shop needs to run its business in the software and what we need to bill the shop and keep the service safe. We do not sell anyone's information, we do not use it for advertising, and we do not share mobile numbers with anyone for marketing. Each shop's data is kept apart from every other shop's. You can export it, and when a shop leaves we delete it.
1. Who we are and who this is for
MurkyThud LLC ("we", "us") operates Marked Complete, shop management software for repair and service businesses ("shops"). Shops use it to write quotes, book work, keep records of customers and their vehicles or other units, send invoices, take payments, and, if they choose, run payroll and keep their books.
Three kinds of people are covered here:
- Shop users: owners, office staff and technicians who sign in.
- Shop customers: the people whose cars, furnaces, boats or properties the shop works on. Their information is entered by the shop, and the shop decides what to do with it. We process it for the shop.
- Visitors to markedcomplete.com.
2. If you are a shop's customer
If you reached this page from a quote, an invoice, a booking page, a text or an email, a shop you do business with uses our software to keep its records. That shop is responsible for your information. We hold it only on the shop's behalf and only to provide the service to them. If you want to see, correct or delete what a shop holds about you, or to stop receiving messages from it, contact the shop directly. Its contact details are on every message it sends you. We will help the shop fulfil your request if it asks us to, and if you cannot reach the shop, write to us at the address in section 14 and we will put you in touch.
3. What we collect
From shops and their users
- Account details: shop name, trade, address, the owner's name and email, and the names, emails and roles of each user. Passwords are stored only as salted hashes; we cannot read them.
- Billing details: plan, billing email, invoices and payment history. Card numbers are entered on and held by Stripe, our payment processor. We see the last four digits and the card brand, not the number.
- Business records the shop enters: customers, units and their identifiers such as VINs or serial numbers, quotes, jobs, invoices, parts, purchases, vendors, photos, inspection results, signatures, time clock entries, and, where those modules are on, pay plans, pay runs and ledger entries. Payroll records may include employee pay rates and hours. Shops decide what to enter.
- Activity records: an audit trail of significant actions (who issued an invoice, who changed a permission), sign-in events with the IP address and browser used, and the shop's own notification and messaging logs.
- Support correspondence: what you send to support@markedcomplete.com or through Help in the app.
About shop customers, on the shop's behalf
- Name, phone, email, address, the units you own and their service history, quotes and invoices, photos the shop took of the work, messages exchanged with the shop, your approvals and signatures, and your texting consent and stop requests.
- When you pay online, the payment is processed by Stripe under the shop's account. We record that it happened and the amount, not your card number. If you choose to keep a card on file with the shop, Stripe holds it and gives us a reference to it.
- When you open a link from a shop (a quote, an invoice, a photo gallery, a booking page), we record that it was opened, when, and from which IP address, so the shop knows its message arrived and so that we can detect abuse of those links.
From visitors to markedcomplete.com
Our web server keeps ordinary access logs: the IP address, the page requested, the time, and the browser. We do not run analytics or advertising scripts on the site.
From third-party sign-in
If a shop user signs in with Google or Microsoft, we receive their name, email address and the provider's identifier for them, and nothing else. We do not receive their password or access to their mail or files.
4. Why we use it
| Purpose | What it involves |
|---|---|
| Providing the service | Storing and displaying a shop's records, producing its documents, sending the emails and texts it asks us to send, processing payments it takes, and keeping each shop's data separate from every other's. |
| Billing | Charging the plan, sending receipts, and handling failed payments. |
| Security | Detecting and limiting sign-in attacks, locking accounts after repeated failures, verifying links and webhooks, and investigating abuse. IP addresses are used for this. |
| Support | Answering questions. Our staff can look at a shop's account to help with a request; each such access is recorded with the reason and is visible in that shop's audit log. |
| Communicating with shops | Service notices, security alerts, billing messages, and changes to our terms. Product announcements go only to shop owners and each one carries an unsubscribe link. |
| Improving the service | Using figures that identify no shop or person, such as how many invoices were issued across the service last month. |
| Legal | Keeping the records the law requires us to keep, and responding to lawful requests as described in section 5. |
We do not use anyone's information to build advertising profiles, we do not sell it, and we do not train machine learning models on shop or customer data.
5. Who we share it with
- Subprocessors. Companies that handle data for us to run the service: our hosting provider, our email and texting carriers, our payment processor, and the integrations a shop chooses to connect. The current list, with what each one does, is at markedcomplete.com/subprocessors. Each is bound to use the data only to provide its service to us.
- The shop. If you are a shop's customer, the shop sees the information it holds about you.
- Services a shop connects. If a shop connects QuickBooks, its accounting data goes to Intuit. If it connects Stripe, payment data goes to Stripe. The shop chooses these and can disconnect them.
- Legal requirements. We disclose information when the law requires it, such as a valid subpoena, or when necessary to protect the safety of a person or the security of the service. Where we are allowed to, we tell the shop first.
- A change of ownership. If MurkyThud LLC or the Marked Complete service is acquired or merged, the data goes with it to the new owner under this policy, and shops are told before it happens.
We do not share, sell or rent any personal information, including mobile phone numbers and texting consent, to third parties or affiliates for their marketing or promotional purposes. That sentence is also a requirement of the mobile carriers, and we mean it.
6. Text messages
Shops can text their customers through the service from a phone number assigned to the shop. The messages are about the customer's own business with the shop: a quote to approve, a job that is ready, an invoice, a reminder the customer agreed to receive.
- Messages about your own job are sent to the mobile number you gave the shop. Reminders and offers are sent only after you have agreed to receive them.
- Reply STOP to any message to stop all texts from that shop. Reply START to resume. Reply HELP for help. The service honors these automatically and the shop cannot override them.
- Message and data rates may apply. Message frequency varies with the work the shop is doing for you.
- Mobile numbers and consent records are not shared with third parties or affiliates for marketing or promotional purposes. They are shared with our texting carrier only to deliver the message.
7. Cookies
The application uses two cookies and no others:
| Cookie | Purpose | Lifetime |
|---|---|---|
| shop_session | Keeps a signed-in user signed in. It is a random token, marked HttpOnly and Secure, and it is revoked when you sign out, when a password is changed, or when the session expires from inactivity. | Session, extended while in use |
| shop_lang | Remembers whether you chose English or Spanish. | One year |
The marketing site at markedcomplete.com sets no cookies. We do not use advertising, tracking or analytics cookies anywhere, and we do not respond to Do Not Track signals because there is nothing to turn off.
8. How we protect it
- All traffic is encrypted in transit with TLS. Links sent to customers use long random tokens and expire.
- Every shop's data is isolated at the database level by row-level security, so a request from one shop cannot read another shop's rows even if the application had a bug. This is tested on every release.
- Passwords are hashed with scrypt. Sign-in is rate-limited by address and by account, and accounts lock after repeated failures. Two-factor authentication is available to every user and required for our own staff.
- Permissions inside a shop are granular and scoped to a company or location, so a technician sees their jobs and not the books.
- Card numbers never touch our systems; they go directly to Stripe.
- The database is backed up nightly and the backups are restore-tested weekly. Access to servers is by key only.
- Our staff's access to shop accounts is logged with a reason, and the shop can see that log.
No system is perfectly secure. If we learn of a breach affecting personal information, we will notify affected shops without undue delay and give them what they need to notify their customers where the law requires it.
9. How long we keep it
- While a shop is active, we keep its records for as long as the shop keeps them. Shops delete or anonymize records themselves using the tools in the app.
- After a shop cancels, pauses for non-payment, or lets a trial lapse, we keep its data for ninety days so it can export or return. After that we delete it from the live service, and it ages out of backups on their normal rolling schedule. A shop may ask us to delete sooner.
- Sign-in and security logs are kept for ninety days.
- Our own billing records, such as the invoices we issued to a shop, are kept for as long as tax and accounting law requires, usually seven years.
- Email and text delivery records are kept so that stop requests and bounces stay honored; a stop request is kept for as long as the number or address could be messaged again.
10. Your choices and rights
Shop users can see and change their own details in the app. Owners can export the shop's data under Admin at any time, and can close the account from Billing.
Shop customers should contact the shop, which holds your data and can view, correct, export or delete it with the tools we provide. You can stop texts by replying STOP and stop emails with the unsubscribe link in any non-transactional message.
Depending on where you live, you may have legal rights to access, correct, delete or receive a copy of your personal information, to limit how it is used, and not to be discriminated against for exercising those rights. Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with privacy laws have such rights. We do not sell personal information or share it for cross-context behavioral advertising, so there is no sale or sharing to opt out of. To exercise a right against us directly, write to the address in section 14. We will verify that you are who you say you are, respond within the time the law allows, usually forty-five days, and you may appeal a decision by replying to our response. If a request concerns data we hold for a shop, we will refer it to the shop and help the shop respond.
11. Where it is stored
The service runs on servers in the United States, in Amazon Web Services' Ohio region. If you use it from outside the United States, your information is transferred to and stored there. The service is intended for businesses in the United States.
12. Children
The service is for businesses and is not directed at children. We do not knowingly collect information from anyone under 13, and shop users must be at least 18. If you believe a child's information has reached us, write to us and we will delete it.
13. Changes to this policy
When we change this policy we update the date at the top. For a change that affects what we collect or how we use it, we email shop owners at least thirty days before it takes effect. Earlier versions are available on request.
14. Contact
MurkyThud LLC
[Mailing address]
support@markedcomplete.com
See also the Terms of Service and the list of subprocessors.