Privacy policy
Your business. Your data.
This notice explains how Vehicle Handover uses account information and vehicle handover records.
Last updated: 24 September 2026
Who is responsible
Vehicle Handover is operated by Derek Wishart at the contact address below. We decide how to use account, subscription, security and support information to run the service.
The recovery or transport business recording a job decides why customer and vehicle information is collected and who receives it. For those handover records, that business is normally the data controller and we process the information on its instructions. Contact the business named on your report about its use of your information; we can help route a request.
Information used
- Business account: verified email address, business and driver names, account and business identifiers, and sign-in/session information.
- Handover records: customer and signatory names, customer email address, collection/delivery addresses, vehicle registration and description, mileage, condition notes, keys, fuel level, photographs, drawn signatures and confirmation dates.
- Reports and delivery: signed PDFs, report recipients, recipient corrections, delivery-service receipts, retry/error information and retention notices.
- Subscriptions: Apple product and transaction identifiers, signed purchase records, subscription dates/status and job-allowance use. Apple handles payment details; we do not receive your card number.
- Support and security: information you send us and the operational logs needed to investigate problems and protect the service. Hosting and email providers process IP addresses, technical request information, response timings, errors and delivery events to operate and protect the service. Account-linked actions also support job allowances, report delivery and abuse prevention.
Account information comes from you and the sign-in service. Handover information comes from the business operator and people signing or supplying details. Purchase status comes from Apple. The collection and delivery location you enter can identify the driver’s precise location at a handover. Hosting logs also record approximate location derived from the request’s IP address. The app does not request GPS access, read your contacts, or use advertising trackers. Original photos may contain camera metadata and incidental personal information; avoid including anything unrelated to the job.
Why we use it
We use account and subscription information to provide the service you request, authenticate access, manage allowances and respond to support requests. This is necessary for our contract with the account holder. We use proportionate security and abuse-prevention information for our legitimate interests in protecting accounts, records and the service. We may retain information needed to meet a legal obligation.
We store, generate and email handover evidence on the business’s instructions. That business must explain its own lawful basis to its customers and signatories. Signing a vehicle report records the handover; it is not consent to marketing. We do not sell handover data, use it for advertising, or use it to train AI models.
Who receives information
Signed reports are sent to the customer email entered for the job and the business’s verified operator address. A corrected recipient may receive a further copy. The business and its authorised account users can access their stored reports.
- Supabase: account authentication, database and private file storage. The project’s primary hosting region is Ireland.
- Resend: sign-in codes, report emails and retention notices. A report email includes the PDF attachment and its recipient address.
- Apple: app distribution, subscription payment and purchase verification, under Apple’s own privacy terms.
- Public website hosting: OpenAI Sites and its infrastructure providers handle requests to these support pages. Customer handover records are not embedded in this website.
Providers can use personnel or infrastructure outside the UK, including the EEA and US. Their applicable processing terms include safeguards for international transfers, including standard contractual clauses and the UK addendum where required. See Supabase’s processing terms and Resend’s processing terms; contact us for information about the safeguards relevant to your data.
Storage and retention
In the public service, cloud photos and reports are kept for 12 months from the latest confirmed handover for the job. Uploaded files for a job that is never confirmed are measured from its first reserved upload. The business receives an email notice before removal, with at least 30 days to download its reports. If a notice is delayed or cannot be sent, deletion is held for investigation rather than silently removing the data. The app shows the current cloud retention status.
Expiry removes the job’s cloud photos, signatures, PDFs, customer details and associated report-email records. Minimal job identifiers and allowance history remain while the business account exists to prevent duplicate charging or recreation of expired uploads. Account and subscription records remain while needed to provide and administer the account; an owner’s account deletion removes their owned business workspaces and associated cloud records. Staff account deletion removes their login and membership, while employer-controlled handover evidence and used-job history remain until that business’s retention or deletion rules apply. An account that owns one business and works for another follows both rules; the confirmation lists each affected workspace. A non-reversible digest of the deleted business’s random identifier prevents late Apple notifications recreating it.
Existing private-beta records have not been retrospectively enrolled into automatic public-service retention. Beta users can contact support to request export or deletion.
Original photos, drafts and device backups are separate from optimized cloud copies. Local data remains on the device until removed; deleting a public-service account clears the local databases for the workspaces listed in its deletion confirmation on the requesting device. Other offline devices, downloaded backups, recipient mailboxes and copies you shared must be managed separately. Providers’ restricted operational logs and backups can persist under their own limited retention schedules and are not used to restore a deleted account for normal service.
Your choices and rights
You can download signed PDFs and export your device backup. In the public app, you can request account deletion from My business without first cancelling a subscription; cancel Apple billing separately. A private receipt lets you check when cloud deletion has completed.
Depending on the circumstances, you can request access, correction, deletion, restriction or portability of personal information. You can object to processing based on legitimate interests. Contact us using the details below; we may need to verify your identity. For a handover record controlled by another business, we will help that business handle the request. Confirmed reports preserve what was signed, so a correction is recorded separately rather than silently rewriting the evidence.
You can complain to the Information Commissioner’s Office. You do not have to contact us first. We do not make solely automated decisions about people that have legal or similarly significant effects. Job-allowance calculations only control use of this service.
Required information and changes
A verified email and business details are needed to open an account. Required handover fields are needed to create a complete report. Without them, the related account or reporting feature cannot be provided. This service is intended for business users, not children.
We will update this page when the service changes and bring material changes affecting existing users to their attention.
Contact
Derek Wishart
84 Westlaw Place
Glenrothes
KY6 2RZ
United Kingdom