Privacy Policy

This policy explains how {COMPANY_LEGAL_NAME} ("we", "us"), a Delaware limited liability company at {COMPANY_ADDRESS}, handles personal data in connection with {PRODUCT_NAME} (the "Service") and our marketing website.

1. Two roles: controller and processor

We act in two different capacities, and this policy covers both:

• As controller, for: (a) data about the garage business itself and the people who use the Service on its behalf (account holders, staff logins, billing contacts), and (b) data collected through our marketing website (e.g. visitors, newsletter sign-ups, sales enquiries).
• As processor, for: the personal data of the garage's own customers (names, phone numbers, email addresses, vehicle registrations) that a garage uploads to run the Service. Here, the garage is the controller and decides why and how that data is used. Our processing terms for this role are set out separately in our Data Processing Agreement.

If you are a customer of one of our garage customers and want to know how your data is used, please contact that garage directly — they control it, and this policy's controller sections do not apply to you. Section 7 below explains how requests are handled in that case.

2. Data we hold as controller

3. Lawful bases (UK GDPR)

• Contract — account and billing data, to provide the subscription you signed up for.
• Legitimate interests — usage data, to maintain, secure, and improve the Service, and to prevent fraud and abuse; and preview data, to show a prospective business customer what the Service would find on their own list. Preview data is deleted on a 30-day schedule (Section 6) rather than kept for as long as it might be useful.
• Consent — marketing emails and newsletter sign-ups, where you have opted in; you can withdraw consent at any time.
• Legal obligation — retaining billing records for tax and accounting purposes.

4. How we use it

We use controller-role data to: run your account and subscription; process payments via Stripe; provide customer support; send service notices (e.g. trial ending, billing issues); improve and secure the Service; and, where you've opted in, send product updates and marketing.

We do not sell your data.

5. Sharing

We share data with the sub-processors and service providers listed in our Sub-processors page (Stripe for billing, Resend for email, Twilio for SMS, Convex for database/hosting, Vercel for hosting), and with DVSA/DVLA solely to look up vehicle records on your behalf. We may also share data if required by law, or in connection with a merger, acquisition, or sale of assets (with notice to you).

6. Retention

• Account data (controller role): kept for the life of your account, and for {X} months after closure for legal, accounting, and dispute-resolution purposes, then deleted or anonymised.
• Garage customer data (processor role): kept only for as long as your account is active, and deleted on account closure or earlier on your instruction. See the DPA for detail.
• Preview data (controller role): when a visitor pastes vehicle registrations into the free preview on our marketing site, we store those registrations and the public DVSA / DVLA records they return. We collect no names, phone numbers or email addresses at that point. A registration number can identify an individual indirectly, so we treat it as personal data; our lawful basis is legitimate interests (demonstrating the Service to a prospective business customer). An unclaimed preview is deleted automatically 30 days after it is created, by a scheduled job, without anyone having to ask. If the visitor starts a trial, the preview becomes part of that account's workspace data and the processor-role retention above applies instead.
• Billing records: kept as required by tax law (typically up to 6 years in the UK).

7. Your rights

Under UK GDPR you have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing. To exercise these rights over your own account data, contact us at {COMPANY_ADDRESS}.

If you are a customer of one of our garage customers, we process your data only on that garage's instructions as processor. Requests about your data should go to the garage directly. If you contact us instead, we will forward your request to the relevant garage and support them in responding, but we cannot act on it ourselves without their instruction.

You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been mishandled.

8. International transfers

Where personal data is transferred outside the UK (including to the United States), we rely on appropriate safeguards, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, as required by UK GDPR. Details of transfer mechanisms per sub-processor are available on request.

9. Security

We use encryption in transit and at rest, access controls limiting who can see personal data, and permanent suppression lists for opted-out contacts. See the DPA for the full security commitments that apply to garage customer data.

10. Children

The Service is a business tool and is not directed at children. We do not knowingly collect personal data from children through the Service.

11. Changes to this policy

We may update this policy from time to time. Material changes will be notified by email or in-app notice at least 14 days before they take effect.

12. Contact

Questions about this policy, or to exercise your rights: {COMPANY_ADDRESS}.

Last updated: {DATE}