Privacy policy
This policy explains what personal data VehicleHub collects, why, and what you can do about it. We keep it plain-English and honest — including the parts about third parties.
Who we are
VehicleHub is operated by [LEGAL NAME] ("we"), based at [ADDRESS]. For any privacy question or request, contact us at [email protected].
What data we collect
- Account data — your name, email address and password (stored only as a hash).
- Vehicle data — registration, make, model, colour, mileage, tax/MOT status, purchase/finance details and photos of the vehicles you add.
- Records you create — fuel fill-ups, services, expenses, insurance policies, build-log entries, custom reminders and any receipts or documents you attach.
- Trip data — GPS routes recorded when you use the mileage tracker, if you choose to record them.
- Billing data — handled by our payment providers (below). We never see or store your full card details.
Where your data goes: third parties we use
We only share what each provider needs to deliver its function:
- DVLA & DVSA — when you add a vehicle by registration, we look up its details and MOT history from government vehicle data using your registration number.
- AI document analysis — when you scan a receipt, invoice or document, the image is sent to a third-party AI provider (ImageRouter) to read it and extract the fields. Images are used to process your request; please don't scan documents containing more personal data than needed.
- Stripe — web subscription payments and the customer portal where you manage or cancel your plan.
- RevenueCat — subscription management for purchases made inside the Android app through Google Play.
- SMTP2GO — delivery of transactional email (reminders, verification, password resets, mileage reports).
- Analytics — none today. If we later enable privacy-friendly, cookie-less analytics, it will only load with your consent (see Cookies) and this policy will be updated first.
Some of these providers may process data outside the UK. Where they do, we rely on the UK international data transfer addendum / equivalent safeguards offered by those providers.
Cookies
VehicleHub uses the minimum cookies needed to function:
- auth_token (strictly necessary) — keeps you signed in. No consent needed; you can clear it by logging out or via your browser.
- Cookie preference — stored locally on your device so we don't ask you again.
We run no advertising cookies and no third-party trackers. When you first visit, a banner lets you choose essential only or accept all. Since the only optional thing that could ever load is the analytics described above (currently off), both choices give you the same experience today.
Why we process your data
- To provide the service (contract) — storing your vehicles and records, reminders, lookups, reports and billing.
- To send service emails (contract / legitimate interest) — renewal reminders you configured, verification and security emails. Every reminder email includes opt-out controls in the app.
- To keep the service working and safe (legitimate interest) — rate limiting, abuse prevention, diagnostics.
- To comply with law (legal obligation) — e.g. tax and accounting records for payments.
How long we keep data
Your data is kept while your account is active. When you delete your account (any time, in Settings), your personal data and records are deleted from the live database. We may retain minimal billing and audit records where legally required.
Your rights (UK GDPR)
You have the right to:
- Access — ask what data we hold about you.
- Rectification — correct inaccurate data (most of it you can edit yourself in the app).
- Erasure — delete your account and data, self-serve in Settings.
- Object / restrict — object to processing based on legitimate interests.
- Portability — ask for a copy of your data in a machine-readable format.
To exercise any right, email [email protected]. We respond to requests within one month. You also have the right to complain to the Information Commissioner's Office (ICO).
Security
Data is transmitted over HTTPS, passwords are hashed, and API access is authenticated. Uploads and records are scoped to your account and are not visible to other users.
Changes to this policy
If we make material changes (for example, switching on analytics or adding a new processor), we'll update this page and the date above.