Effective date: 17 March 2026

Axiom Forge Software ("we", "us", "our") operates the AutoSpotter mobile application and website. This Privacy Policy explains how we collect, use, and protect your information when you use our services.

1. Information We Collect

Account Information

When you sign in with Google, we receive and store:

• Your name
• Email address
• Profile photo URL
• Google user ID

This information is stored securely in Google Cloud Firestore.

Vehicle Images

When you capture or upload a photo for identification, the image is sent to a secure AI service (Google Gemini) for analysis. Images are processed transiently and are not stored on our servers. Temporary files created during processing are deleted immediately afterwards. The AI provider's use of this data is governed by their own privacy policy.

Number Plates (Vehicle Registration Marks)

If a UK number plate (VRM) is visible in your photo, it may be read by the AI. We treat VRMs as personal data under UK GDPR when linked to other identifying information. Here is how we handle VRM data:

• Scan history — If you save a scan, the VRM is stored in your personal scan history for up to 90 days, after which it is automatically deleted. You can manually delete individual scans at any time.
• Vehicle data cache — When a valuation is fetched, the vehicle data is cached using a one-way cryptographic hash (SHA-256) of the VRM as the lookup key. The plaintext VRM is not stored in the cache. This cache is used solely to reduce redundant third-party API calls.
• Shared reports — If you choose to share a vehicle report, the VRM is included in the shared report and is accessible to anyone with the link. Shared reports expire and are automatically deleted after 30 days. You can delete a shared report at any time before it expires.
• Valuation lookups — When you request a valuation, the VRM is sent to a third-party UK vehicle data API. This transmission uses HTTPS encryption.
• AI inaccuracy reports — If you report an inaccurate AI result, the vehicle identification data (excluding the VRM) is stored for service improvement. These reports are automatically deleted after 180 days.

Usage Data

We record basic usage information such as scan timestamps and plan usage counts to manage your subscription and improve the service.

2. How We Use Your Information

• To provide AI-powered vehicle identification
• To retrieve UK vehicle valuations using detected number plates
• To maintain your user account and subscription
• To investigate and resolve reported issues with AI results
• To cache vehicle data and reduce redundant third-party API calls

3. Third-Party Services (Data Processors)

We share data with the following third-party services to provide the app's functionality. Each acts as a data processor on our behalf:

• Google Firebase — authentication, encrypted data storage (Firestore), and AI processing (Gemini). Data is encrypted at rest and in transit. Governed by Google's Data Processing Terms.
• UK Vehicle Data Global API — vehicle valuation and MOT history lookups using registration numbers. VRMs are transmitted via HTTPS. Only the VRM is shared; no user identity is sent.

We only share the minimum data necessary for each service to function.

4. Data Retention

Data Type	Retention Period
Account information	Until account deletion
Saved scans (inc. VRM)	90 days, then auto-deleted
Shared reports (inc. VRM)	30 days, then auto-deleted
Vehicle data cache	90 days (VRM stored as irreversible hash only)
AI inaccuracy reports	180 days, then auto-deleted
Vehicle images	Not stored (transient processing only)
Usage data	Until account deletion

You may delete your account and all associated data at any time (see section 7).

5. Data Security

All data transmitted between the app and our servers is encrypted in transit using HTTPS/TLS. Data stored in Firestore is encrypted at rest by Google Cloud. Vehicle data cache entries are indexed by a one-way SHA-256 hash so the registration number cannot be recovered from the cache index.

6. Your Rights (UK GDPR / Data Protection Act 2018)

Under UK data protection law, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate data (you can also edit scan details directly in the app)
• Erasure — request deletion of your data (see section 7)
• Portability — request your data in a portable format (Trader plan users can export data as CSV)
• Object — object to processing of your data
• Restrict — request restriction of processing

To exercise any of these rights, please contact us at the email address below. We will respond within one month as required by law.

7. Account and Data Deletion

You can delete your account and all associated data at any time:

• In the app: Go to Settings > Delete Account
• Via the web: Visit our account deletion page

Deletion removes your profile, scan history, shared reports, AI reports, usage data, and all associated data from our systems. This action is permanent and cannot be undone.

8. Children's Privacy

AutoSpotter is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the app or by updating the effective date at the top of this page.

10. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us:

11. Lawful Basis for Processing

We process your personal data on the following lawful bases under UK GDPR:

• Consent — you consent to data processing when you sign in and accept our terms
• Contract — processing is necessary to provide the service you requested (identification, valuation)
• Legitimate interest — caching vehicle data to reduce API costs and improve response times; processing AI reports to improve service accuracy