Privacy Policy

Overview

AutoSpect is available as a website and as an iOS app, and is built with privacy as a core principle. Browsing the site and running a free vehicle lookup are anonymous — you do not need an account, and we never ask for your name. We collect the minimum needed to provide the service.

To buy a paid report on the web you create an account (an email and password, or sign in with Google or Apple). This lets us link that purchase to you so you can return to your reports, saved vehicles and recent lookups from any device. On iOS, purchases go through your Apple ID and are linked only to an anonymous device identifier. For the purposes of the UK General Data Protection Regulation (UK GDPR), the data controller is AUTOSPECT LTD, a private limited company registered in England and Wales under company number 17262131, whose registered office is 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. AUTOSPECT LTD is registered with the Information Commissioner's Office (ICO) as a data controller, registration number ZC236002.

Data We Do Not Collect

AutoSpect does not collect or store:

• Your name
• Location data
• Your payment card details (these are handled directly by our payment providers — see Payments & Purchases)
• Photos or camera images from the iOS app. Inspection photos you take in the iOS app are stored only on your device, as part of your inspection record, and are deleted when you delete that record. Photos you take during a guided inspection in a web browser are different — those are stored on our servers so your report is complete on every device you sign in on, and are covered under Storage & Report Recovery below
• Advertising identifiers, or any data used to track you across other apps or websites — except, on this website and only with your consent, the Google Ads conversion tag described under Analytics below

If you create a web account we do hold your email address, and if you buy a report we hold a record of that purchase — see Accounts and Payments & Purchases below.

Accounts (Web)

You can browse AutoSpect and run free lookups without an account. You only need to sign in to buy a paid report, and being signed in is what lets us save your purchased reports, your vehicles and your recent lookups so you can return to them.

Web accounts are provided through Amazon Cognito (part of Amazon Web Services). When you sign up with an email and password, we store your email address and a securely hashed password — we never see or store your password in plain text. If you choose to sign in with Google or Apple instead, we receive your email address and a provider identifier from them; their handling of your data is governed by Google's and Apple's own privacy policies.

We use your account only to sign you in, link your purchases to you, and show you your saved vehicles and recent lookups. We do not sell your data, and we do not use your email address for marketing without your consent. You can change your password or request deletion of your account at any time from Account settings — see Your Rights & Data Erasure below.

Vehicle Lookup Processing

When you enter a UK vehicle registration mark (VRM), we send that registration to third-party UK vehicle data APIs (DVLA and DVSA-connected services) solely to retrieve publicly available vehicle records such as MOT history, tax status, and vehicle specification. A registration you look up may be cached briefly on our infrastructure to serve repeat lookups without re-querying those providers; that cache is keyed to the vehicle, not to you, and expires automatically.

If you are signed in, the vehicles you look up are also saved to your History so you can return to them — these entries are linked to your account, contain the vehicle's public details, and expire automatically after 180 days (or sooner if you delete your account). Standard AWS infrastructure logs may be retained for a limited period (typically up to 30 days) for security and operational purposes only, after which they are automatically deleted.

AI Processing

AutoSpect uses large language model APIs to generate vehicle-specific insights. Prompts sent to these services contain only vehicle make, model, year, and MOT history — no personal data, and never your email or account details. Responses are cached (on your device in the iOS app, or against the vehicle on our servers on the web) for performance. We do not use your queries to train AI models, and we do not share them with anyone.

We do keep a record of the questions you type into the Advisor, alongside the registration they were asked about, so we can see what the report failed to answer and improve it. Questions are truncated, held in our own server logs on a limited retention period, and never sold, shared or used for training. Notes you write to yourself during an inspection are not recorded this way. If you would rather we did not keep your questions, email support@autospect.co.uk and we will remove them.

Payments & Purchases

On the web, payments are processed by Stripe. AutoSpect never receives or stores your card details — Stripe collects and handles them directly under its own privacy policy. We retain only a record that a purchase was made (the product, amount, Stripe payment reference and date), linked to your account, so we can confirm your entitlement and let you re-open the report you paid for.

On iOS, purchases are processed entirely through Apple's App Store using StoreKit. AutoSpect never receives, processes, or stores your payment card details or Apple ID. The app sends Apple's cryptographically signed transaction record (product, transaction identifier, date) to our server solely to verify the purchase is genuine before running the paid check.

Storage & Report Recovery

On the web, your purchases, the reports they unlock, your saved vehicles and your recent lookup history are stored on our servers (AWS DynamoDB) linked to your account, so you can return to them from any device you sign in on. The sensitive provenance data behind a paid report (finance, write-off, stolen and mileage checks) is encrypted at rest. Recent-lookup history entries expire automatically after 180 days; purchase records are kept while your account is active so your reports remain available.

Inspection photos taken in a web browser are stored on our servers (AWS S3, UK region), encrypted at rest, in a private area of storage reserved for your account. They are not public, are never indexed by search engines, and no link to them works without you being signed in as their owner. We use them only to show your own inspection findings back to you inside your report — we do not use them to train models, and we do not share them with third parties. They are kept for as long as the report they belong to, and are deleted when you delete that report or your account.

On iOS, inspection records and lookup history are stored on your device using Apple's SwiftData framework and iCloud (if enabled; iCloud sync is subject to Apple's Privacy Policy). Purchase reports are also stored on our servers linked to an anonymous device identifier so you can recover them after reinstalling. Reports are retained for 24 months after your last activity, then automatically deleted.

You can delete your web account and its data from Account settings, or all local iOS data from the app's Settings screen — see below.

Analytics & Crash Reporting

AutoSpect uses TelemetryDeck, a privacy-focused analytics service, to understand how the app's features are used. Signals are anonymised before they reach TelemetryDeck and include events such as app launches, lookups performed (vehicle make and year, never the registration), paywall views and inspection activity. No names, email addresses, registrations, free-text notes or advertising identifiers are sent, and the data cannot be used to track you across other apps or websites.

On this website we use Plausible Analytics, an EU-hosted, privacy-focused service. Plausible sets no cookies, stores nothing on your device and collects no personal data, so there is nothing here to consent to and nothing that can follow you to another website. We record page views and a small number of product events — a registration being submitted, which report tab was opened, a checkout being started — so we can see which parts of the site people find useful and where they get stuck. The registration itself is never sent to Plausible.

We also use PostHog, hosted in the European Union, to understand how people move through the site — which we cannot learn from page counts alone. It receives the same product events as Plausible, plus which links and buttons were clicked.

PostHog stores nothing on your device by default. It holds an identifier only in the memory of the browser tab you are using, which is discarded when you close it. That means no cookie, nothing in browser storage, and no way for us to recognise you on a later visit or on another site — so, as with Plausible, there is nothing here for you to consent to. If we ever ask permission to remember your browser between visits, that will be an explicit choice you make, and declining it changes nothing about how the site works.

Session replay. PostHog also records a reconstruction of the pages you saw and how you moved through them — scrolling, taps and clicks, and the order you did things in. We use it to find where the site is confusing or broken, which is difficult to see any other way. It is a rebuilt picture of the page rather than a video of your screen, and it captures nothing outside this website. Text and form fields are masked before the recording leaves your browser, so a registration you type, and any other text on the page, is replaced with placeholder characters and never reaches PostHog. The registration is also removed from the web address before it is sent. Recordings are deleted automatically after 30 days.

We may use automated tools, including AI, to review these recordings and flag patterns worth looking at — for example, people repeatedly failing to complete a step. That analysis is carried out on the masked recording described above and produces summary observations about the site, not conclusions about you.

Google Ads. When we run search advertising, a Google tag on this website measures whether a visit that came from an advert led to a checkout being started, so we know which adverts work. By default it stores nothing on your device: it sends Google only cookieless, aggregated signals, using Google’s consent mode. We do not currently show a consent prompt, so the tag stays in that cookieless mode for everyone. If we ever ask permission to remember your browser, accepting would also let Google set its advertising cookies for this measurement; declining would change nothing about how the site works. Google’s own policy is at policies.google.com/technologies/ads.

If you would prefer not to be included, most ad and tracker blockers stop both Plausible and PostHog, and we do not treat blocked analytics as a reason to limit anything on the site. Browsers that send a Do Not Track or Global Privacy Control signal are respected. You can also ask us to delete recordings associated with you using the contact details below, though because we deliberately hold no identifier for you, we may need you to tell us roughly when you visited in order to find them.

We also receive Apple's built-in, aggregated crash and usage reports if you have opted in via iOS Settings → Privacy & Security → Analytics & Improvements.

Your Rights & Data Erasure (UK GDPR)

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the right to:

• Access: request a copy of any personal data we hold about you
• Erasure (Right to be Forgotten): request deletion of your data from our servers
• Rectification: request correction of inaccurate data
• Portability: receive your data in a machine-readable format
• Object: object to processing in certain circumstances

Web account: to delete your account and everything linked to it (your purchases, saved vehicles, lookup history and any inspection photos you took in the browser), use Delete my account & data in Account settings, or email us at support@autospect.co.uk from your account address. We process validated deletion requests within 30 days.

iOS: to delete on-device data, use the Delete All Data option in the app's Settings screen. To request erasure of report data associated with your anonymous device identifier stored on our servers, contact us at support@autospect.co.uk.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Children's Privacy

AutoSpect is not directed at children under the age of 13. We do not knowingly collect any data from children.

Changes to This Policy

We may update this Privacy Policy to reflect changes in the app or applicable law. The "Last updated" date at the top of this page will be revised accordingly. Where changes materially affect how data is processed, we will notify you on this website and in the app before those changes take effect.

Contact

If you have questions about this Privacy Policy, please contact us at support@autospect.co.uk.