Privacy Policy

This policy explains what personal data VeeFive (“we”, “us”, the “app”) collects, why we collect it, who we share it with, and the rights you have over it. It applies to the VeeFive mobile and desktop apps and the VeeFive cloud service.

1. Who we are

The data controller responsible for your personal data is VeeFive LTD. You can contact us about privacy or to exercise your rights at privacy@veefive.com.

VeeFive LTD is registered with the Information Commissioner’s Office (ICO), the UK’s data protection regulator, under registration number ZC248202.

2. The short version

3. What data we collect

Account & identity

• Your name and email address.
• Your password, which is never stored in readable form — it is protected using a strong one-way hash (Argon2id). You may optionally enable two-factor authentication (a time-based code from an authenticator app).
• Authentication session tokens that keep you signed in.

Your vehicles

• The vehicle registration mark (number plate / VRM) you add.
• Vehicle information retrieved using that registration — for example make, model, colour, fuel type, and registration date.
• MOT history and test results, vehicle tax status, outstanding safety recalls, and service / maintenance history.

VeeFive Fleet sign-up (veefive.com/fleet)

• When you set up a Fleet on this website we collect your business name, your name, your work email address and a password (stored only as a one-way hash), the plan and number of vehicles you choose, and any vehicle registration marks you ask us to add. If you turn on the authenticator app second step, we store the secret needed to check its codes and a one-way hash of your recovery codes; the codes themselves are shown to you once and are never stored in readable form.
• We use these to confirm your email address, secure your account, set up your Fleet and tell you about your payments. Registration marks are looked up with the same free vehicle registers the app uses.
• Your card or bank details are entered only on our payment provider’s own page. VeeFive never sees or stores them; we receive confirmation that a payment or Direct Debit was set up, the last four digits of a card, and the dates and amounts involved.

Dealer interactions

• Service or appointment bookings you make with a dealer, including the chosen service, date and time.
• The contact and vehicle details you share with a dealer when you book or consent to share them.

Consent & audit trail

• A record of the consents you give and withdraw (such as agreeing to share your data with a dealer), with timestamps, so both you and we have an accurate history. You can read this history in the app at any time.

Notifications

• MOT and tax reminders are generated on your own device from your vehicles’ existing MOT and tax dates — we don’t create a separate profile to do this.

Technical & diagnostic data

• Basic device and app information and diagnostic logs used to diagnose crashes, lock-ups and errors and to keep the service secure. You control when full logs leave your device: you can export them, and where the app offers to send a log report for support, that is your choice.
• Automatic error reports. When the app hits an error, or shows you an error message, it sends a short report so we can find and fix the fault: what kind of error it was, the screen you were on, the app version and your phone’s operating system and, for a failed request to our servers, which part of the service it was, the result and how long it took. The report is linked to your account and the car you were using by internal identifiers only. It never includes your email address, name, phone number, address, registration number, password, sign-in token or anything you typed into the app; personal details that turn up in error text are removed before the report is sent and again when we receive it. A report made before you sign in (for example a failed sign-in) is not linked to any account. We use error reports only to find and fix problems, and keep them in our cloud logs for that service’s retention period (30 days by default).

4. Why we use your data, and our legal bases

Under UK GDPR we rely on the following legal bases:

We do not make decisions that produce legal or similarly significant effects about you using solely automated processing.

5. Who we share it with

We share data only as needed to provide the service, with:

• Our infrastructure provider. We host the app and database on Google Cloud (Google), which provides hosting (Cloud Run) and the database (Cloud SQL). Google acts as our processor under our instructions.
• Our payment provider. Fleet plans are paid for through Stripe, which collects your card or Direct Debit details on its own page and acts as an independent controller for them. We share with Stripe the amount, the plan and the email address on your Fleet account so that it can take and confirm the payment and send you receipts.
• Automotive data providers. When you add a vehicle, we send its registration mark to third-party vehicle-data services to retrieve details, MOT and tax status, recalls, valuations and service history. We send the registration to obtain data, not your identity.
• Dealers. When you book with, or consent to share your data with, a particular dealer, the relevant details are shared with that dealer so they can serve you. You choose this, and can withdraw it.
• App stores. The app is distributed through Google Play, which processes data under its own privacy policy when you download or update the app.
• Advertising measurement. Anonymous install attribution is always on and does not depend on any setting or permission. So that we know which advertisement led to an install, the app tells the ad network, once, that this install and its first opening happened. It does not use your device's advertising identifier and sends no purchase, sign-up or vehicle information. On iOS this uses Apple's privacy-preserving install attribution (a report signed by Apple, which can arrive late) together with the Meta SDK started with advertising-identifier collection switched off. On Android it uses the Meta SDK's install and app activation report with advertising-ID collection and automatic event logging switched off, and the Google Play install referrer supplied by Google Play. This is separate from the optional ad-measurement preference described next. The optional ad-measurement preference in Settings controls only what goes beyond that anonymous install count. On iOS, that extra measurement requires your saved ad-measurement preference to be on, Apple's current App Tracking Transparency permission to be authorised, and the app to be active in the foreground. With all three conditions met, VeeFive uses the Meta SDK and your device's advertising identifier for acquisition and app-activity measurement. This includes confirmed purchase events with the VeeFive product code, and account-registration events. The SDK may process device and session information. VeeFive's explicit purchase and registration conversion events do not forward purchase amounts, currency, account identifiers or vehicle identifiers. If the preference is off, or Apple's permission is not authorised, none of those extra events and no advertising identifier is used; anonymous install attribution continues unchanged. Apple can send delayed install reports to the ad network. Turning the preference off prevents new extra measurement requests; it cannot recall an install report or Apple postback already sent. SDK requests admitted while both consent and permission were granted may finish after you turn the preference off. On Android, nothing beyond the anonymous install and app activation report is collected: Android keeps advertising-ID collection disabled, and VeeFive does not forward purchase or sign-up conversions from Android. You can change the ad-measurement preference in Settings.
• Affiliate partners. The app shows affiliate offers for products relevant to your vehicle (for example insurance or breakdown cover). If you tap one, you are taken to that provider's own website and we may earn a commission. We do not pass your account details to affiliates — the link carries only a click reference so that we can be credited.

We do not sell your personal data. Advertising measurement follows the platform-specific choices described above.

6. Where your data is stored

Your data is stored and processed on Google Cloud infrastructure in the United Kingdom (London region). Where any provider processes data outside the UK, we rely on appropriate safeguards (such as adequacy decisions or standard contractual clauses) as required by UK data protection law.

7. How long we keep it, and deleting your account

We keep your personal data for as long as you have an account, and only as long as needed for the purposes above.

You can delete your account and erase your personal data at any time:

• In the app: open the app and go to Settings → Delete account, then confirm.
• If you no longer have the app installed: email privacy@veefive.com from your registered email address and we will delete your account and personal data for you.

When you delete your account, we erase your personal data: your account and sign-in are removed, your active sessions are revoked, and your vehicle records are deleted. Where you had shared data with a dealer through a booking, that booking is anonymised — the dealer keeps a record that a service occurred, but your identifying details are removed. Diagnostic logs are retained only for as long as needed to investigate issues and keep the service secure, then deleted. Automatic error reports (section 3) are kept in our cloud logs only for that service’s retention period (30 days by default), linked to your account only by an internal identifier, and then deleted automatically; deleting your account does not shorten that period. We complete deletion requests within 30 days.

8. Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent at any time (without affecting processing already carried out); and
• complain to the ICO.

How to exercise these in VeeFive:

• Access & consent history: view your consent and audit trail directly in the app.
• Erasure: delete your account in the app — this removes your personal data as described in section 7.
• Anything else (correction, portability, restriction, objection, or questions): contact us at privacy@veefive.com and we will respond within one month.

9. Sharing your data with dealers

VeeFive only shares your personal data with a dealer when you actively choose to — by booking with them or by giving consent to share. That consent is recorded with a timestamp in your audit trail. You can withdraw it at any time; withdrawing stops future sharing, and erasing your account anonymises the data previously shared through bookings.

10. Security

We protect your data with measures including hashed passwords (Argon2id), encryption of data in transit (HTTPS/TLS), session controls, and restricted access to production systems. No system is perfectly secure, but we work to protect your data and to limit what we collect in the first place.

11. Children

VeeFive is intended for users aged 18 and over and is not directed at children. We do not knowingly collect personal data from children.

12. Cookies & local storage

The sign-in page uses local storage that is strictly necessary to sign you in securely (our own email + password sign-in, with optional two-factor authentication). The Fleet sign-up pages on this website use the browser’s tab storage (session storage, not a cookie) that is strictly necessary to carry your sign-up from one step to the next; it holds a temporary sign-up token and the choices you have made, and it is cleared when you finish or close the tab. These pages set no cookies. The app stores data locally on your device to work offline. We do not use web advertising or cross-site tracking cookies. Native iOS and Android advertising measurement follows the platform-specific preference, permission and event boundaries described in section 5. Anonymous install attribution is always on and uses no advertising identifier. On iOS, the extra SDK measurement (advertising identifier and conversion events) requires both saved consent and current ATT authorisation while the app is active. Android keeps advertising-ID collection disabled.

13. Changes to this policy

We may update this policy from time to time. We will change the “Last updated” date above, and for significant changes we will provide a more prominent notice. Please check back periodically.

14. Contact & complaints

For any privacy question or to exercise your rights, contact privacy@veefive.com.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ICO): ico.org.uk, helpline 0303 123 1113. We would, however, appreciate the chance to address your concerns first.