Last updated: 7/10/2026
1. Who is the controller
EzTowForm ("we") operates the tow-authorization platform at ezetowauth.lovable.app. We act as data controller for account and billing data of the towing companies and drivers that use the Service, and as a data processor on behalf of those companies for the tow-authorization records they create (which contain end-customer data such as driver-license scans, signatures, and vehicle photos).
2. What data we collect
- Account data (from companies & drivers): name, email, phone, company details, license number, hashed password, role.
- Tow-authorization data (from end customers, uploaded by drivers): full name, address, driver-license or ID number and state, vehicle year/make/model/plate/VIN, pickup and drop-off locations, reason for tow, signed digital signature, signing date/time, IP address, GPS coordinates.
- Photos: driver license/ID capture, vehicle photos, existing-damage photos, VIN photos, license-plate photos.
- Usage & security data: log entries, error reports, device/browser metadata.
- Billing data: managed by Paddle (our reseller & Merchant of Record); see the Paddle privacy notice at paddle.com/legal/privacy. We store only the subscription status and Paddle IDs.
3. Why we process it (purposes & legal bases)
- Provide the tow-authorization workflow (contract with the towing company).
- Extract text from ID/license photos via an AI OCR provider so drivers can confirm the fields (contract; the extracted text is reviewed by the driver before being saved).
- Generate the signed PDF and enable download by the driver and the signing customer (contract, legitimate interest of the towing company to keep evidence of authorization).
- Prevent fraud, abuse, and non-payment; enforce the subscription paywall (legitimate interest, legal obligation).
- Comply with legal obligations (tax, accounting, responses to lawful requests).
4. Sensitive data & OCR
Driver-license / government-ID data is sensitive. We only process it because the driver actively uploads it as evidence of authorization for a specific tow. We do not use ID data to train AI models, we do not sell it, and we do not use it for advertising. OCR is performed by our AI provider (Google via Lovable AI Gateway) solely to extract the fields the driver then confirms.
5. Who we share it with
- Hosting, database & storage: Lovable Cloud / Supabase (EU/US), for application hosting, database, and encrypted file storage.
- AI OCR: Lovable AI Gateway (Google Gemini), only for ID extraction requests.
- Payments: Paddle.com Inc., Merchant of Record for all sales; Paddle receives the payer's billing details directly.
- SMS / messaging: your device's native SMS/WhatsApp/email app (the app opens a share link — we do not operate an SMS gateway).
- Authorities: when required by law, court order, or to protect our rights.
We do not sell personal data.
6. Retention
Authorization records are retained for as long as the towing company keeps its account active, plus a reasonable period afterwards for legal-defense purposes. Companies can delete individual authorizations from their dashboard at any time; deletion removes the record and its photos from our storage. Account/billing records are retained for the periods required by tax and accounting law.
7. Security
Data in transit is protected with TLS. Files are stored in access-controlled buckets accessible only to the owning company. The database enforces row-level security so that companies can only read their own data. Passwords are hashed. We check new passwords against known-breached-password lists.
8. International transfers
Our providers may process data in the United States and the European Union. Where required, transfers rely on Standard Contractual Clauses or equivalent safeguards.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict, port, or object to processing of your personal data, and to lodge a complaint with a supervisory authority. To exercise these rights against the towing company that collected your data, contact the towing company directly (their name and contact appear on the authorization form and PDF). To exercise rights against EzTowForm as an account holder, contact us at the address on our website.
10. Cookies
We use only strictly necessary cookies (session, authentication, language preference). We do not use advertising or third-party analytics cookies.
11. Children
The Service is not intended for children under 18.
12. Changes
We will post updates here with a new "Last updated" date.
See also: Terms of Service · Refund Policy