Who is responsible for data
The controller of account, billing, security and our own communication data is myrepair s.r.o., registration number 23521414, VAT number CZ23521414, Zengrova 2990/32a, 703 00 Ostrava–Vítkovice, Czech Republic. Send requests to support@myrepair.app or the registered office. This policy covers mydiagnostics.app, workspace.mydiagnostics.app, support.mydiagnostics.app and the related agent.
Data categories and sources
You provide your name, email, language, company and tax details, address and communications. We store a password hash, Apple/Google account identifier, verification status, accepted terms, plan, usage and payment details. Browsers and agents generate IP addresses in operational logs, security events, station identifiers and technical errors. ARES, RÚZ and VIES supply company and tax verification.
Diagnostics may include serial number, IMEI, UDID or ECID, model, system, available battery and parts information, results, times and notes. A device identifier can be personal data if linked to a person. The service is not intended to store photos, messages, contacts, medical records or other unnecessary private content.
MyRepair sign-in takes place at secure.myrepair.app. After signing in, you select an active repair shop you can access and expressly authorise transfer of your permanent account identifier, name, email, verification status and available company details for the selected shop (identifier, name, registration number, tax number and billing address). These data support sign-in, company prefilling and access checks; MyDiagnostics accounts, diagnostics, licences and payments remain separate. Passwords, jobs and customers are not transferred. A new member of an already connected shop receives normal access without automatic permission to change payments; initial workspace creation requires company details and terms to be confirmed. MyRepair is a trusted identity provider within our services. After valid sign-in and access approval, MyDiagnostics does not require another email verification; an existing account with the same email is linked automatically. Separate email-and-password registration still requires email verification. Access tokens are encrypted and valid for at most 7 days. Expired encrypted values are removed during daily automatic maintenance; disconnecting removes the stored access token immediately. Access permissions are checked during use with a cache of at most 60 seconds. The connection can be removed in MyDiagnostics settings without deleting existing diagnostic history. MyRepair uses a necessary sign-in cookie and a temporary __Host-mr_md_request cookie lasting at most 10 minutes.
Why we use data
Accounts, email verification, support, subscriptions and service messages are processed for contract performance or pre-contract steps under GDPR Article 6(1)(b). For customer employees or representatives who are not contracting parties, operation and communication rely on legitimate interests under (f). Tax documents and statutory verification rely on (c).
Security, preventing misuse and defending claims rely on legitimate interests under (f). Necessary registration data are required for a company account; the service cannot be activated without them. Accepting terms is not marketing consent. In the current project we do not send marketing campaigns or conduct advertising profiling; any future use requires its own lawful basis and information.
Data about repair shop customers
When a repair shop tests customer or employee devices, the shop determines the purpose and lawful basis for diagnostic data. Myrepair s.r.o. processes them on documented instructions under the data processing agreement. Send requests first to the relevant repair shop; we help identify the controller and provide assistance when necessary. MyDiagnostics accounts and database records are separate from MyRepair accounts, without changing the operating company’s identity.
Who receives data
Authorised provider and company staff access data as necessary. Váš Hosting s.r.o., registration number 24742252, hosts the application and databases in the Czech Republic. Service email delivery uses Seznam.cz, a.s. SMTP, receiving delivery addresses, delivery information and message content. Stripe processes billing and transaction data and may act as an independent controller for its statutory payment purposes. MyDiagnostics does not receive full card numbers or CVC.
Apple and Google participate when you choose their sign-in: we receive verified email, provider identifier and available name. We do not request access to iCloud, email content or contacts. Accountants, legal advisers and public authorities may also receive data where their role or the law requires. Diagnostic data are not provided to advertising systems or other repair shops.
Apple may independently process device technical data during activation, installation or app authorisation under its own rules.
Czech hosting and international transfers
The main MyDiagnostics databases and server infrastructure are in Czechia. This does not mean separate Apple, Google or Stripe services process all data only there. International transfers may occur according to their roles and rules. Transfers for which we are responsible must meet GDPR Chapter V, such as an applicable adequacy decision or standard contractual clauses and necessary supplementary measures. Request details and copies of safeguards from support@myrepair.app.
Optional providers Google and Meta may process data outside the EEA, including the USA, under applicable mechanisms and their own rules. Refusing or withdrawing consent stops new measurement on these domains but does not automatically delete data already lawfully received. Send rights requests to support@myrepair.app.
How long we retain data
We retain accounts and diagnostic history while the account is provided and according to lawful customer instructions. History has no plan-based time limit, but this does not remove erasure rights or necessity requirements. After termination and an erasure instruction, unnecessary data are deleted or anonymised; backup copies age out in the normal cycle without further active use. We explain the process and relevant deadline when handling the request.
Tax documents are retained for 10 years after the relevant tax period ends. Contract evidence, accepted terms and necessary communications may be retained until claims and applicable limitation periods are settled, or litigation ends. Ordinary web logs normally rotate within 15 days. Security counters, temporary authorisation records and technical email-queue records are cleaned 30 days after their relevant completion. Specific incident evidence may remain while it is resolved.
Optional server records for conversion delivery and order consent are retained for at most 30 days and are not sent without valid browser consent. The browser session stores only markers preventing duplicate event counting.
Operational logs of signed-in accounts
For security, reliable service operation and troubleshooting, we record ordinary server requests from signed-in users: account and selected company, time, page path without secret parameters, HTTP method and result, server processing time, IP address, HTTP User-Agent, browser, operating system and estimated device type. We use the existing sign-in session; we add no tracking cookie, browser fingerprinting, screen recording or form-content recording. Only authorised administrators can access these logs and their access is audited. IP addresses and full User-Agent values are encrypted at rest. These operational records rely on our legitimate interest in protecting and properly providing the service under GDPR Article 6(1)(f), are automatically deleted after 30 days and are not shared with advertising providers. You may object at support@myrepair.app. Optional analytics and advertising continue to require separate consent.
Cookies and browser storage
The table below lists storage for sign-in, security and your selected language. Clearing or blocking it may remove sign-in or language preferences. Fonts, Trustpilot stars and images load from our domains, so viewing a page alone does not send them to their original providers. App Store, Trustpilot and social links open external services only when clicked.
With consent, mydiagnostics.app, support.mydiagnostics.app and workspace.mydiagnostics.app use Google Analytics 4 (Google Ireland Limited) for visits and conversion journeys, and Meta Pixel (Meta Platforms Ireland Limited) for advertising measurement and personalisation. The lawful basis is consent under GDPR Article 6(1)(a). Providers may receive IP address, browser information, cookie identifiers, visited page and permitted events including a confirmed purchase value. We do not transmit form contents, emails, names, company or tax numbers, IMEI, serial numbers or diagnostic results.
Optional measurement loads only after separate consent for the relevant category. Refusing does not limit accounts or diagnostics. Cookie settings can be reopened and consent withdrawn at any time.
Auth.mydiagnostics.app also provides sign-in and registration, including an embedded registration window. Cross-domain sign-in uses a one-time code valid for at most 90 seconds bound to the necessary __Host-md_login_binding cookie (at most 30 minutes). The __Host-md_session cookie is separate for each domain. With analytics consent, we also store a permitted event type, random deduplication identifier, time and, for signed-in users, a link to the company account, for at most 90 days. These internal statistics contain no form contents or diagnostic results. Authorised administrators see client operational statistics, onboarding completion and billing details to operate the service; access and pricing or promotion changes are secured and logged. Sign-in is remembered after closing the browser. It lasts for at most 7 days of inactivity and renews during use. Signing out, changing the password or revoking access ends it sooner.
| Storage | Purpose | Duration |
|---|---|---|
__Host-md_session | Sign-in, form protection and account security. | Sign-in is remembered after closing the browser. It lasts for at most 7 days of inactivity and renews during use. Signing out, changing the password or revoking access ends it sooner. |
__Host-md_oauth_binding | Temporary binding of an Apple/Google/MyRepair sign-in attempt to your browser. | 10 minutes. |
__Host-md_login_binding | Secure sign-in handover between auth and workspace. | At most 30 minutes. |
md_locale | Remembering your language across MyDiagnostics domains. | At most 1 year. |
localStorage: mydiagnostics.locale | Local language preference; no advertising identifier. | Until website data is cleared in the browser. |
md_consent | Sign-in, security, language and remembering this choice. Always active. | At most 180 days. |
_ga, _ga_19TC4C08ZF | Google Analytics 4: visits, interactions and steps from registration to confirmed payment. | At most 180 days. |
_fbp, _fbc | Meta Pixel: advertising and conversion measurement; may support personalised advertising. | At most 90 days. |
sessionStorage: md_measurement:* | Google Analytics 4: visits, interactions and steps from registration to confirmed payment. | Until the browser session ends. |
Optional measurement loads only after separate consent for the relevant category. Refusing does not limit your account or diagnostics. Reopen cookie settings at any time to withdraw consent.
Security and automation
We use HTTPS, password hashing, company record separation, restricted access, form protection, one-time verification links and sign-in attempt limits. Sensitive links in the email queue are encrypted. No measure guarantees absolute security; incidents are handled under GDPR. Technical diagnostics, allowance checks and VAT verification are not decisions about a person with legal or similarly significant effects under GDPR Article 22.
Your rights and requests
Under the conditions of GDPR you have rights to information and access, rectification, erasure, restriction, portability and objection to legitimate-interest processing. Consent can be withdrawn at any time without retrospective effect. Statutory duties and others’ rights may limit some requests. Email support@myrepair.app; we normally respond within one month and explain lawful extensions in time. Identity verification is limited to necessary data.
You may complain to the Czech Office for Personal Data Protection, uoou.gov.cz, or the competent authority where you habitually reside, work or the alleged breach occurred. You do not have to exhaust discussions with us first.
Updates and related rules
This version describes the current MyDiagnostics service, not every MyRepair product. We appropriately announce material changes to purposes, recipients or lawful bases before new processing and request consent where required. A separate data processing agreement supplements customer diagnostic-data processing. External provider rules are linked below.