What we do with data, in the order it reaches us.

This policy applies to this website and to the CarHub API, SDKs and components. It describes two roles we hold at different moments.

• As a controller — for the account you open with us: who you are, which company you work for, what you were billed, and the support messages you send us. We decide what happens to that data, and this policy is the full description of it.
• As a processor — for everything that arrives through the API: vehicle photographs, videos, registration plates, VINs and lookup results. You decide what to send and why. We act on your instructions, and the binding terms are in the data processing agreement in your contract, which takes precedence over this page.

[Registered company name], trading as CarHub, registered at [Registered address] under [Company registration number].

Privacy questions, access requests and complaints: privacy@carhub.example. Suspected vulnerabilities: security@carhub.example. You can also complain to the data protection authority where you live.

Opening an account means giving us a work email address, a company name and a password. We add what the service generates on its own: the keys issued to you, the endpoints those keys called, the units metered against them, and the invoices that follow.

This site runs no advertising or cross-site tracking. There is no third-party analytics script on the page you are reading. We keep first-party server logs — IP address, timestamp, path, response status — because a service without request logs cannot be debugged or defended, and we treat them as security records rather than as an audience measurement.

The lawful basis is the contract you enter with us for account and billing data, and our legitimate interest in a service that stays up and unabused for the logs.

The API accepts vehicle media and vehicle identifiers, and returns inferences and normalised records. In the ordinary case none of that is personal data about a human — a photograph of a bumper is a photograph of a bumper. Three things change that, and they are the reason this section exists.

• Registration plates and VINs identify a vehicle, and a vehicle can be linked to a keeper. Treat them as personal data unless you know otherwise.
• People in the frame. The Capture SDK is used by non-experts in public places, so faces, bystanders and paperwork end up in shots nobody intended.
• Lookup results about ownership, mileage records, write-off status or outstanding finance say something about a person, not only about a car.

You are the controller for all of it. You choose the lawful basis, you tell the people concerned, and you send us the minimum the job needs. We do not use it for anything except running the endpoint you called.

Our models look at vehicles. They segment panels, grade damage, estimate severity and render images. We do not run face recognition, we do not attempt to identify anybody from your media, and we do not build profiles of the people who appear in it.

If a person is visible in a frame, that is incidental to the inspection and stays that way. Where your own basis requires it, mask or blur before upload — a redacted frame grades exactly as well as an unredacted one, because the damage is on the panel.

Layer 3 answers the questions a model cannot see — identity, specs, value, history, compliance, parts, risk — and it answers them by asking the best available provider in the country the vehicle belongs to, then normalising the reply into one schema.

That means a plate or VIN you send for a lookup leaves our systems and reaches that provider. We forward the identifier and the country, nothing else about you or your customer. We do not enrich, resell or retain provider responses beyond the record of the job that requested them, and we do not combine lookups across our customers to build a shadow dataset.

The current provider list is part of the data processing agreement, and we tell you before a new one is added.

Retention is set per account. The defaults are:

• Media and derived artefacts — uploaded photographs and videos, indexed frame sets and rendered output: 30 days, then deleted.
• Job records — status, timings, which endpoints ran, what they metered, without the media: 90 days.
• Account, contract and invoice records — as long as tax and company law require, then deleted.

Ask and we will shorten any of the first two for your account, including deleting media the moment a job completes. Backups roll off on their own schedule, which trails the live deletion by no more than 30 days.

We do not sell data, and we do not share it for anyone else's advertising. Data reaches four kinds of third party, all of them under contract and none of them free to use it for their own purposes:

• infrastructure providers that host the platform and store media;
• the per-country vehicle data providers behind Layer 3, for the lookups you request;
• payment and accounting providers, for invoicing;
• support and error-tracking tools that our own engineers use to fix what breaks.

We disclose data to authorities only against valid legal process, and we tell you when we are permitted to.

The platform is built to keep vehicle data close to the market it came from, but a stack with providers in many countries cannot promise that nothing ever crosses a border. Where a transfer leaves the EEA or the UK, we rely on an adequacy decision where one exists and on standard contractual clauses where it does not, with a transfer assessment on file.

Tell us if your own obligations pin processing to a region and we will confirm in writing whether we can meet it before you build against us.

Everything moves over TLS and is encrypted at rest. Keys are scoped to your account and can be rotated by you at any time; we never see your password, only a hash of it. Access to production data is limited to the engineers who need it, and is logged.

Presigned upload links are single-purpose and expire. If you believe a key has leaked, rotate it first and then write to security@carhub.example. We notify you without undue delay if a breach affects your data.

For data we hold as a controller — your account — you can ask for a copy, a correction, a deletion, a restriction, or a portable export, and you can object to processing based on legitimate interest. Write to privacy@carhub.example and we will answer within one month.

For data that reached us through a customer's account, the request belongs to that customer. If someone asks us directly, we identify the account, forward the request, and help them answer it. We do not delete or disclose a customer's data on a third party's instruction, because we have no way to verify what their basis was.

We update this page when the platform changes. Material changes are announced by email to account holders at least 30 days before they take effect, and the date at the top always tells you which version you are reading.

See also the terms of service, which govern the service itself, and pricing, which explains what the metered units in your job records mean.