Privacy Policy

CarFolio ("we", "us") is the controller of the personal data described in this policy for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. You can contact us about privacy at hello.menaidigital@gmail.com.

• Account data: email address, password (stored only as a secure hash by our authentication provider), and, if you sign in with Google, the basic profile details Google shares with us.
• Profile data: display name and chosen avatar, which are visible to other users on the leaderboard and collector profiles.
• Collection data: the vehicles you log, their make, model, year, rarity, XP, achievements, garage entries and timestamps.
• Photographs: images of vehicles you capture or upload. Number plates are detected and permanently masked on the image before it is saved, so we do not store the unmasked original.
• Technical data: limited log and error data needed to keep the Service secure and working.

We do not collect or store the GPS location of your spots, and we do not track your movements.

• To provide your account and collection - performance of our contract with you.
• To identify vehicles from your photographs - performance of our contract with you. Images are sent to our AI processing provider purely to return a make and model.
• To show leaderboards and public profiles - performance of our contract, using only the display name, avatar and collection stats you choose to build.
• To keep the Service secure, prevent abuse and fix faults - our legitimate interests.
• To comply with legal obligations - legal obligation.

Vehicle registration marks are personal data when they can identify an individual. That is why plates are masked at the point of capture and are not retained after identification.

We do not sell your personal data. We share it only with service providers who process it on our instructions: our hosting and database provider, our authentication and file storage provider, and our AI image-identification provider. Where a provider is outside the UK, transfers are protected by UK adequacy regulations or the International Data Transfer Addendum to the EU Standard Contractual Clauses. We may also disclose data where required by law or to protect our rights.

We use only strictly necessary storage: a secure session token so you stay signed in and local preferences for the app interface. We do not use advertising or third-party tracking cookies, so no consent banner is required.

Account, profile and collection data is kept while your account is active. If you delete your account, your profile, spots, garage entries and stored images are deleted, normally within 30 days, other than anything we must keep for legal reasons or in short-term encrypted backups which expire on their own cycle. Technical logs are kept for a limited period for security purposes.

Under UK GDPR you have the right to be informed, to access a copy of your data, to have inaccurate data corrected, to have your data erased, to restrict or object to processing, to data portability, and to withdraw consent where we rely on it. You also have the right not to be subject to solely automated decisions with legal or similarly significant effects - our vehicle identification does not have such effects.

To exercise any right, email hello.menaidigital@gmail.com. We respond within one month. If you are unhappy with our response you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

The Service is not intended for children under 13. If we learn that we hold data about a child under 13, we will delete it. Parents or guardians can contact us to request removal.

When you photograph a vehicle in a public place you may capture other people's data. Use the Service responsibly, avoid photographing people, and never use it to identify, follow or contact a vehicle owner. Our Terms of Service set out these rules in full.

Data is encrypted in transit, stored access-controlled with row-level security so users can only reach their own private records, and images are held in a private storage bucket. No system is perfectly secure, but we notify affected users and the ICO where legally required. We will post any updates to this policy on this page and tell you about material changes.