Privacy Policy

Deleting your account and data

You can delete your account in the app: Profile, then Privacy & data, then Delete my account.

Your account is deactivated immediately. After 30 days it is permanently erased, including your email, name, vehicles, records and documents. During those 30 days you can log in and restore it.

If you no longer have the app, you can ask us to delete your account at https://carrvo.app/delete-account/ or by emailing support@carrvo.app from the address on your account.

Copies in our database provider’s routine backups are overwritten on their normal schedule.

Who we are

Carrvo is a car-ownership app for keeping vehicle details, key dates and service and cost records in one place. The company responsible for your data (the “controller”) is Syncsol Ltd, registered in England and Wales, company number 14890302, registered office 23 Holly Lane, Dunstable, Bedfordshire, LU5 7AW, United Kingdom. Contact details are at the end of this policy.

What we collect

You do not have to give us anything beyond what the app asks for, but we need an email address and password to make your account, and the app cannot work without them.

Account: your email address, an optional name, and your password. Passwords are handled by our authentication provider and stored in a hashed form; we cannot read them.

Vehicles: registration number, make, model, year, fuel type, mileage, colour, and the MOT, road tax and insurance dates and insurer name if you enter them.

Records: the type, date, title, cost, mileage, garage and notes of each service or expense you add.

MOT history: when you add a car with Find my car, or tap Refresh on its MOT history, we fetch the car’s MOT tests from the DVSA (GOV.UK) and keep them with the car: the test dates, results, odometer readings and any advisories or failures, plus the engine size, first-used date and whether there is an outstanding recall.

Documents: photos and PDFs you choose to add (for example receipts, invoices, the V5C or an MOT certificate), with a title and type. Photos are shrunk on your phone before upload. They can contain hidden details such as where they were taken, so only add photos you are happy to store.

Look-ups: when you tap Find my car, we keep a log of that look-up (the registration number, the time and the answer from the GOV.UK MOT service) so we can investigate faults and misuse.

Notifications: if you allow them, we keep an address for your phone (a token from Apple or Google), its type, the app version and time zone, and your alert choices (push on or off, MOT results, safety recalls). We use it only to send the alerts you have switched on.

Fuel prices: your favourite stations and your fuel filter choices are saved to your account so a new phone starts with them.

Only on your phone: saved places, the parked-car spot, a sign-in token kept in your phone’s secure storage, and your reminder preferences. These are not sent to us.

The camera and photo library are used only when you tap to add a document, and only the file you choose or capture is used. A document is shared with an AI service only if you tap Read with AI after giving permission. Your phone location is read only when you tap Add current location on a record, or open Fuel prices, and the Fuel nearby tile on Home uses it too once you have allowed location (never in the background). A place added to a record is stored only with that record, where you can remove it. For Fuel prices, only your position rounded to about a kilometre is sent to our server to find nearby stations, and it is not stored. Your phone looks up a readable address for the spot with its own maps service (Apple Maps or Google); we do not send it anywhere else. We do not collect your contacts or microphone data. The app contains no advertising or analytics tools.

How we use it

To run your account and show your vehicles and records.

To email you one-time codes when you sign up or reset your password.

To show reminders on your phone before your MOT, road tax and insurance dates, and to send a push alert when a new MOT result or an outstanding safety recall is found for a car you added (if you allow notifications and keep these alerts on).

If you choose Read with AI, to have a document read so a record can be pre-filled for you to check. This uses your explicit permission, which you can withdraw in Profile.

Our lawful basis is performing the service you asked for (contract) and, for reminders, your permission to send notifications and, for a place on a record, your permission to read your phone location. We keep the log of look-ups, and take steps to keep the service safe, because we have a legitimate interest in fixing faults and preventing misuse.

Where your data is stored and who handles it

Supabase provides our database, authentication and private file storage. Your data and documents are stored in the European Union (Frankfurt, Germany).

Resend delivers the one-time code emails, so it handles your email address for that purpose.

Anthropic, an AI company, reads a document only when you tap Read with AI and have given permission. That one document is sent to it and details are sent back to help fill in a record. Anthropic is based in the United States, so that document leaves the UK and the EU; it is sent only because you asked and gave permission. Anthropic handles it under its own terms and privacy policy (anthropic.com/legal/privacy).

Apple and Google (Firebase Cloud Messaging) deliver push notifications to your phone. They receive your phone’s address and the text of the notification, such as “Your car failed its MOT”.

The DVSA MOT history service (GOV.UK) supplies a vehicle’s make, model and MOT history when you tap Find my car. Only the registration number you typed is sent, through our server. We save the result only if you add the vehicle.

Some of these providers are based in, or process data in, the United States. Where data leaves the UK or the EU we rely on the safeguards UK data protection law allows, such as an adequacy decision or the approved standard contract terms.

These providers act on our instructions to run the service. We do not sell your data and do not share it for advertising.

We may disclose data if the law requires it.

Notifications

Reminders, and the “Still parked here?” nudges for a saved parking spot, are local notifications created on your phone. They never leave it.

If you allow notifications we may also send push alerts from our server: when a new MOT result is found for a car you added, or when the DVSA lists an outstanding safety recall for it. You can switch these off in Profile, or in your phone’s system settings.

How long we keep data

We keep your data while your account exists. You can delete individual vehicles, records and documents at any time. Each account can hold up to 200 files or 150 MB.

The log of Find my car look-ups is kept while your account exists and is deleted with it. Your phone’s notification address is removed when it stops working or when your account is erased.

If you delete your account, it is permanently erased after 30 days (see the top of this policy).

Your rights

Under UK data protection law you can ask to access, correct, delete, restrict or object to the use of your data, and ask for a copy of it. Most of this you can do in the app, including a free copy of your data (Profile, then Export my data); for anything else, contact us.

Where we rely on your permission (Read with AI, notifications, your phone location) you can withdraw it at any time: Read with AI in Profile, and notifications or location in your phone’s settings. This does not affect what was done before you withdrew it.

We do not make decisions about you by automated means, and we do not profile you. Read with AI only pre-fills a record that you check and save yourself.

You can complain to the Information Commissioner’s Office (ico.org.uk) if you are unhappy with how your data is handled.

Security

Data is encrypted in transit. Every account is limited by database access rules to its own data, and your sign-in token is kept in your phone’s secure storage. No system is perfectly secure, so please use a strong, unique password.

Children

Carrvo is not intended for children under 13 and we do not knowingly collect their data.

Changes to this policy

If we change what we collect or how we use it, we will update this policy and tell you in the app.

Contact

Syncsol Ltd, company number 14890302, 23 Holly Lane, Dunstable, Bedfordshire, LU5 7AW, United Kingdom.

Questions about privacy or your data: support@carrvo.app.