Privacy policy
This policy explains what personal data Tickover collects, why, and what you can do about it. We keep it plain-English and honest — including the parts about third parties.
Who we are
Tickover is operated by Quayside Computing & Design Ltd ("we"), based at Tonnage Warehouse, St Georges Quay, Lancaster, LA1 1RB (company number 10785820). For any privacy question or request, contact us at [email protected].
What data we collect
- Account data — your name, email address and password (stored only as a hash).
- Vehicle data — registration, make, model, colour, mileage, tax/MOT status, purchase/finance details and photos of the vehicles you add.
- Records you create — fuel fill-ups, services, expenses, insurance policies, build-log entries, custom reminders and any receipts or documents you attach.
- Trip data — GPS routes recorded when you use the mileage tracker, if you choose to record them.
- Billing data — handled by our payment providers (below). We never see or store your full card details.
- Notification data — your reminder and notification preferences and, if you enable push notifications in the Android app, a device push token.
- Feedback data — only when you choose to send feedback: your message, an optional screenshot of the app, and technical details such as the app version, device/OS, current screen and recent in-app errors. It is used to diagnose problems and is never shared with third parties.
Where your data goes: third parties we use
We only share what each provider needs to deliver its function:
- DVLA & DVSA — when you add a vehicle by registration, we look up its details and MOT history from government vehicle data using your registration number.
- AI document analysis — when you scan a receipt, invoice or document, the image is sent to a third-party AI provider (ImageRouter) to read it and extract the fields. Images are used to process your request; please don't scan documents containing more personal data than needed.
- Stripe — web subscription payments and the customer portal where you manage or cancel your plan.
- RevenueCat — subscription management for purchases made inside the Android app through Google Play.
- Google Play & Firebase Cloud Messaging — Google Play processes in-app purchases in the Android app; Firebase delivers push notifications you opt in to, using a device push token.
- SMTP2GO — delivery of transactional email (reminders, verification, password resets, mileage reports).
- Analytics — none today. If we later enable privacy-friendly, cookie-less analytics, it will only load with your consent (see Cookies) and this policy will be updated first.
Some of these providers may process data outside the UK. Where they do, we rely on the UK international data transfer addendum / equivalent safeguards offered by those providers.
Cookies
Tickover uses the minimum cookies needed to function:
- auth_token (strictly necessary) — keeps you signed in. No consent needed; you can clear it by logging out or via your browser.
- Cookie preference — stored locally on your device so we don't ask you again.
We run no advertising cookies and no third-party trackers. When you first visit, a banner lets you choose essential only or accept all. Since the only optional thing that could ever load is the analytics described above (currently off), both choices give you the same experience today.
Why we process your data
- To provide the service (contract) — storing your vehicles and records, reminders, lookups, reports and billing.
- To send service emails (contract / legitimate interest) — renewal reminders you configured, verification and security emails. Every reminder email includes opt-out controls in the app.
- To keep the service working and safe (legitimate interest) — rate limiting, abuse prevention, diagnostics.
- To comply with law (legal obligation) — e.g. tax and accounting records for payments.
How long we keep data
Your data is kept while your account is active. When you delete your account (any time, in Settings), you verify the request by email and then type DELETE; your personal data, vehicles, records, reminders, uploaded files and feedback reports are then deleted from the live database, and Stripe subscriptions are cancelled. Some payment records may remain with Stripe or Google Play under their own policies; you must cancel a Play Store subscription in the Play Store.
Your rights (UK GDPR)
You have the right to:
- Access — ask what data we hold about you.
- Rectification — correct inaccurate data (most of it you can edit yourself in the app).
- Erasure — delete your account and data, self-serve in Settings.
- Object / restrict — object to processing based on legitimate interests.
- Portability — ask for a copy of your data in a machine-readable format.
To exercise any right, email [email protected]. We respond to requests within one month. You also have the right to complain to the Information Commissioner's Office (ICO).
Security
Data is transmitted over HTTPS, passwords are hashed, and API access is authenticated. Uploads and records are scoped to your account and are not visible to other users.
Changes to this policy
If we make material changes (for example, switching on analytics or adding a new processor), we'll update this page and the date above.