When you create an account and use Vin Haus, we collect and store:

• Account information: Your name, email address, and password (hashed).
• Vehicle data: Registration numbers, make, model, year, mileage, MOT/tax/insurance dates, and any other details you choose to enter.
• Records: Service history, parts, modifications, faults, tyre records, mileage logs, track day records, and research notes.
• Uploaded files: Photos and documents you upload relating to your vehicles.
• Usage data: Login timestamps, IP addresses (stored in our audit log for security purposes).
• Terms acceptance: Date and time you accepted our Terms and Conditions.

• Your email address, name, vehicle registration, VIN, and insurance details are encrypted at rest using AES-128 symmetric encryption (Fernet). The encryption key is stored separately from the database.
• Passwords are hashed using Werkzeug's generate_password_hash and are never stored in plaintext.
• All connections to Vin Haus are encrypted via HTTPS/TLS.
• Our server is accessible only to authorised administrators.

• Contract performance: To provide you with the vehicle management features you signed up for.
• Legitimate interest: To maintain security, prevent abuse, and improve the Service.
• Consent: To send you email reminders for MOT, road tax, and insurance expiry (you control these dates and can delete them at any time).

Your private vehicle data is only visible to you when logged in. We do not sell, share, or transfer your personal data to any third party, except:

• Where required by law.
• Data you explicitly make public via the optional public vehicle profile page and QR code.
• Hetzner (hosting provider, EU) — stores your encrypted data on our behalf as a data processor.
• Bluehost (email provider) — used to deliver account and reminder emails on our behalf.
• DVLA / DVSA (UK Government APIs) — when you use our registration lookup feature, your vehicle registration number is sent to the DVLA and DVSA APIs to retrieve vehicle and MOT data. No personal account data is shared.

We use your email address to send:

• A welcome email when you create your account.
• Password reset emails when requested.
• Automated reminders for MOT, road tax, and insurance expiry dates you have entered.

We do not send marketing emails. Reminder emails are sent from alerts@vinhaus.co.uk and account emails from hello@vinhaus.co.uk.

• Your account and all associated data is retained for as long as your account is active.
• If you delete your account, all personal data and vehicle records are permanently deleted immediately.
• Audit log entries (IP addresses and actions) are retained for up to 12 months for security purposes.

• Session cookie: A single cookie is used to keep you logged in. It expires when you close your browser or after 30 minutes of inactivity.
• Theme preference: Your light/dark mode choice is saved in your browser's localStorage under the key pal-theme or pg-theme. This data never leaves your device.

No tracking, analytics, advertising, or third-party cookies are used.

You have the right to:

• Access — Request a copy of the personal data we hold about you (use the Export feature in Account Settings).
• Rectification — Correct inaccurate data (edit within the app at any time).
• Erasure — Delete your account and all data permanently (Account Settings → Delete Account).
• Portability — Export your data as an HTML report, CSV file, or download all uploaded photos (Account Settings → Export).
• Object — To any processing you believe is not in line with this policy.

To exercise any right or make a complaint, contact hello@vinhaus.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

We may update this policy from time to time. The date at the top of this page will reflect the most recent revision. Continued use of the Service constitutes acceptance of the updated policy.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

• Notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach.
• Notify affected users directly via email without undue delay, including the nature of the breach, data affected, and steps taken.
• Document all breaches internally regardless of severity.

Data Controller: One77 LTD
Trading as: Vin Haus
Email: hello@vinhaus.co.uk
Website: vinhaus.co.uk