This policy explains what personal data Capital Garage collects, why we collect it, how long we keep it and what control you have over it. It covers the Capital Garage mobile app and the capital-garage.com website.
Capital Garage is operated by Alex Hoyle, a sole trader registered in the United Kingdom, who is the data controller for the purposes of UK GDPR.
The short version. We collect your email address, the vehicles you choose to track, and basic technical data needed to run the app. We do not sell your data, we do not share it with advertisers, and we do not use it to build advertising profiles. You can delete everything from inside the app at any time.
01What we collect
| Data | Why we hold it |
|---|---|
| Email address | To create and identify your account, to sign you in, and to contact you about your account or subscription. |
| Password | Stored only as a secure hash. We never see or store your password in readable form. Not collected if you sign in with Apple or Google. |
| Name, where you give it | To personalise the app. Supplied by you, or returned by Apple or Google on first sign in. |
| Profile photograph, optional | Only if you choose to set one. Selected by you from your device photo library. |
| Vehicle records | The cars you add, with make, model, year, condition, purchase price, purchase date and any finance details you enter. This is what the app exists to track. |
| Push notification token | To send notifications you have opted into, such as valuation movements and auction alerts. Only collected if you grant notification permission. |
| Subscription status | To know whether your account has premium access. Handled through our payments provider. |
| Technical and diagnostic data | Device type, operating system version, app version and crash reports, used to fix faults and keep the app working. |
We do not collect your location, your contacts, your browsing activity outside the app, or any payment card details.
02Legal basis for processing
- Performance of a contract. Holding your account, your vehicle records and your subscription status is necessary to provide the service you signed up for.
- Legitimate interests. Diagnostic data and crash reports, used to keep the app secure and working, balanced against your privacy.
- Consent. Push notifications and access to your photo library. You can withdraw either at any time in your device settings.
- Legal obligation. Records we are required to keep, such as those relating to tax on subscription revenue.
03Who we share data with
We do not sell your personal data and we do not share it for advertising. We use a small number of processors who handle data on our behalf under contract:
- Supabase, for database hosting, authentication and file storage.
- RevenueCat, to manage subscription entitlements. It receives an anonymous account identifier and your subscription status, not your email or your vehicle records.
- Apple and Google, who process subscription payments through their app stores under their own privacy policies. We never receive your card details.
- Expo, for delivering push notifications to your device.
We may disclose data if required by law, court order or a valid request from a public authority.
04Where your data is held
Data is stored on servers operated by our hosting providers, which may be located outside the United Kingdom. Where data is transferred outside the UK, it is protected by appropriate safeguards, such as the UK International Data Transfer Addendum or an adequacy decision.
05How long we keep it
We keep your account data for as long as your account is open. If you delete your account, your profile, vehicle records and photographs are deleted from our live systems promptly, and removed from routine backups within 30 days.
We may retain a limited record of subscription transactions where we are legally required to do so for tax purposes.
06Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you.
- Have inaccurate data corrected.
- Have your data erased.
- Restrict or object to processing.
- Receive your data in a portable format.
- Withdraw consent where processing relies on it.
You can delete your account and all associated data yourself, at any time, from your profile inside the app. To exercise any other right, or to request deletion without using the app, email support@capital-garage.com. We will respond within one month.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.
07Security
Data is encrypted in transit using TLS and encrypted at rest by our hosting provider. Passwords are stored only as salted hashes. Access to production systems is restricted and protected by multi factor authentication.
No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify you and the Information Commissioner's Office as required by law.
08Children
Capital Garage is not intended for anyone under 18 and we do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
09Changes to this policy
We may update this policy. The date at the top of this page shows when it last changed. If a change materially affects how we use your data, we will tell you in the app or by email before it takes effect.
10Contact
For any privacy question or request, email support@capital-garage.com.