Privacy Policy.

• Name, date of birth and phone number. Must you? Yes, to hold an account. If you do not: we cannot open an account. Date of birth is how we check you are 18 or over.
• Email address, or a sign-in with Apple or Google. Must you? Yes. If you do not: we cannot sign you in or send you the confirmation, invoices and receipts the law requires your operator to give you, which we send for them.
• Where you are, and where the vehicle should go if it needs moving. Must you? Yes, to request help. If you do not: nobody can quote for the job or come to you. You can type an address instead of sharing your device's location.
• Vehicle registration and details. Must you? Yes. If you do not: operators cannot tell what they would be dealing with, so they cannot quote.
• A short description of what has gone wrong. Must you? Yes, always. Your answers to the questions about it, including whether the vehicle has crashed or hit anything, are needed too, unless you choose to skip the questions and go straight to recovery. If you do not: operators cannot quote fairly, and your description is also what protects you if the job turns out to be different (Terms of Use, clause 5.3).
• Payment card. Must you? Yes, to accept a quote. If you do not: we cannot hold or take payment, so no operator can be booked. Your card details go straight to our payment provider, Stripe. We never see or store your full card number. If you pay with Apple Pay or Google Pay, Apple or Google passes Stripe a payment token in place of your card number.
• Photographs or a short video of the problem. Must you? For some kinds of roadside repair. If you do not: you can go straight to recovery instead, which does not need them.
• Anything about a disability or access need. Must you? No, it is entirely your choice. If you do not: nothing, except that we will not know to make the adjustment in advance.

• Name, contact details, date of birth and profile photograph. Why: to run your account, check you are 18 and show who you are to the operator you choose. Legal basis: contract; for your date of birth, our legitimate interests in confirming you are an adult who can make a binding contract.
• How you sign in, and the devices you use. Why: to keep your account secure and to send notifications and ring calls to the right device. We keep your notification and call tokens, and a one-way scrambled record (never the address itself) of the email address and internet address behind each sign-in attempt and whether it worked, so that someone guessing a password can be locked out. Legal basis: contract; legitimate interests in keeping accounts secure. If you sign in with Apple on an iPhone, we keep, encrypted, the token Apple gives us for your sign-in, only so that when you delete your account we can tell Apple to end Recovru's access to your Apple ID. Legal basis: our legitimate interests in doing what Apple requires of apps that delete accounts, and yours in that access ending.
• Where you are, and where you want the vehicle taken. Why: to find operators near you, let them quote, and show you the one you choose and their approach. Legal basis: contract. Section 2.1 has the detail.
• Vehicle details from the registration. Why: so operators know what they would be dealing with, to stop a vehicle recorded as stolen being added, and to show the operator whether a vehicle is recorded as stolen, whether its tax and MOT are valid and when the MOT runs out, and whether it has an open recall. Legal basis: contract; legitimate interests in preventing crime and keeping people safe.
• Vehicles and places you save, and your saved cards' type, last four digits and expiry date. Why: so the app can fill in a request and a payment for you. If you enter the name of a vehicle's registered owner, we keep that too. Legal basis: contract.
• Your description, your answers, your photographs and any video. Why: so operators can quote fairly and arrive prepared, so the app can suggest recovery where your answers point to a risk, and as the record of what you told us if the job turns out to be different. Legal basis: contract.
• What your operator records about the job. Before and after photographs, a note if the work could not be completed, and, if they claim the attendance and assessment fee, their reason, note and photographs, and a record of the keys and the vehicle's condition if your vehicle is taken to a workshop. Why: as the record of what was found and done, and to decide any dispute. Legal basis: contract; legitimate interests in resolving disputes with evidence.
• The quotes you are sent and the one you accept. Why: to show you your choices and to form your contract with the operator. Legal basis: contract.
• Payment details, holds, charges, refunds, plan payments and receipts. Why: to take payment as your operator's agent and issue their invoices, receipts and credit notes, run your plan if you have one, and keep the accounting records the law requires. Legal basis: contract; legal obligation.
• Messages, photographs and the record of in-app calls with an operator who has sent you a quote, before and after you choose. Why: so you and an operator can talk without swapping phone numbers, and to resolve disputes. We record that a call happened, when and how it ended, never what was said. Legal basis: contract; legitimate interests in resolving disputes with evidence.
• Reports you make about a message, photo or video. We keep the report, your reason and any note, and a copy of what was sent, who sent it and when, and we open a support case you can follow in the app. Why: so our staff can review it, remove what breaks our Terms of Use (clause 14A) and deal with any complaint. If the person you reported asks for the information we hold about them, we do not tell them who reported them. Legal basis: legitimate interests in keeping people safe and dealing with complaints.
• People you block. We keep a record of whom you blocked, so that messages, calls and matching between you stay off. Legal basis: contract.
• The word filter. An automatic filter replaces listed offensive words with **** before a message is delivered. It makes no decision about you. A photo or video our staff remove after a report is kept for their review, but neither of you can open it in the app again. Legal basis: legitimate interests in keeping messages free of abuse.
• Live chat and emails with our staff, and the reports you send. When you report a problem about a job we copy the job's main details into the case, including the addresses, the vehicle and its registration, the price and the job's status, with your app version and device type, so our staff can see what you are asking about. Why: to help you, and to resolve complaints and disputes. Legal basis: contract; legitimate interests in resolving problems with a record of what was said.
• Ratings and compliments you give. Why: so other customers can see who is coming, and so our staff can review how operators perform. Legal basis: legitimate interests in a trustworthy network.
• Fraud and safety signals. Why: to protect customers, operators and the payments we handle. Legal basis: legitimate interests; legal obligation where one applies.
• Our own usage analytics. What we record: the screens you open and the main steps you take, such as asking for help, accepting a quote, paying or cancelling, with the service and the amount where relevant, tied to your account, your app version and your device type; and, under Share trip data, a technical note when the app hits an error. Why: to see where people get stuck. Legal basis: legitimate interests. It runs unless you switch it off in the app (section 5 explains how), and we keep it for 12 months.
• Crash reports, provided by Google. Why: to fix what breaks. Legal basis: your consent. They are off unless you switch Crash reporting on, and you can switch it off again at any time.
• The latest position the app shares while it is open, only if you switch on Share live location. Why: so our staff can see how Recovru is being used and where, and can help you if you contact them. Legal basis: your consent, which you give by switching Share live location on. It is off unless you do, and you can switch it off at any time, which deletes it straight away. Section 2.1 has the detail.
• Marketing analytics, provided by Google. Why: product research. Legal basis: your consent. It is off unless you switch it on, and you can switch it off again at any time.
• Your acceptance of these documents. We record which document and version, when, how (sign-up, booking or a later update), the app version and platform, your email address, your internet address and your browser or device details. Why: to show what you agreed to, and when. Legal basis: our legitimate interests in being able to show what you agreed to, and when.

Where we rely on legitimate interests we have weighed our reasons against your rights, and you can ask us for that assessment or object at any time. Improving Recovru, and understanding demand. What we use: how jobs actually ran, which screens you used, and what you booked. Why: to make the service work better and to better understand our customers, so there is an operator near you when you need one. Legal basis: our legitimate interests, weighed against your rights, and set out in full in section 5, which also tells you how to object.

• When the app reads it. Only while the app is open on your screen: when you choose a pickup point on the map or ask for help near you, and, only if you have switched on Share live location, about every 45 seconds while the app is open (the next point explains). We do not track you in the background. You can type an address instead.
• What we keep. The pickup point and the drop-off point you choose, as part of the job. Separately, if you switch on Share live location in the Privacy screen, which is off until you do, then while the app is open on your screen it sends us your device's position about every 45 seconds, with its accuracy, direction, speed and whether you are on iPhone, Android or the web, and our staff can see it beside your name and email address on the operations page, so they can see who is using Recovru and where, and help you if you contact them. Operators never see it. Your consent, given by switching it on, is what allows us to do this. We keep only the latest position, each one replacing the last, and a daily clear-out deletes it once it is more than 24 hours old. Switching Share live location off stops it and deletes it straight away.
• The route to you. While your operator is on the way, their position is recorded against your job about every ten seconds, and the last position and planned route stay with the job record. Why: to show you where they are, to prove they attended, and to work out a cancellation charge from what was actually driven.
• Who sees it before you choose a quote. Every operator who is sent your request sees the pickup and drop-off points, so they can quote. They do not see your name.
• Who sees it after you accept a quote. The operator you chose, who navigates to you. Your operator's app may ask Google for an aerial picture of your pickup address, and they may open your pickup point in Google Maps, Apple Maps or Waze on their own phone to navigate; that app then holds it under its own privacy policy. You see where that operator is on the map, and their arrival time, until the job ends. No other customer or operator sees where you are.
• Who else receives it. To find operators who can reach you, and to measure a tow, our servers send the pickup point and the drop-off point, as map coordinates with no name or account attached, to a routing service to work out driving times and distances. Maps, address searches, routes and arrival times come from Google Maps. If our servers cannot name the street for a position, your phone's own address service (Apple's on an iPhone, Google's on Android) is asked to. Section 9 names each of them.
• How long. The pickup and drop-off points stay with the job record for 6 years (section 8). If you delete your account, they are reduced to the first half of the postcode.

• Buying a plan in the app. On an iPhone, Apple sells the plan to you and takes the payment; on Android, Google does. Each is a controller in its own right, under its own privacy policy. We never see your card or your Apple or Google account. To link a purchase to your Recovru account we give Apple or Google a random number that stands for your account, never your name or email address, and they tell us what we need to give you the plan: which plan, when it started and renews, whether it is paid, cancelled or refunded, and their reference for it. Legal basis: contract.
• Buying a plan in the web app. Stripe takes the payment for us, as it does for a rescue (section 6). Legal basis: contract.
• Your plan's record. Which plan you have, who bills it, its dates and what happened to it, so that the app gives you what you paid for wherever you sign in, and to settle any question about a payment. Legal basis: contract; legal obligation, for the accounting records.
• Reminders. Your vehicle's MOT and tax due dates, which we look up from its number plate from time to time (section 9 says who from), and the insurance renewal date you enter. Why: to remind you before they run out, in the app and, unless you switch Vehicle reminders off in the app's settings, by notification. Legal basis: contract.
• The document vault. The files you choose to keep there, which may include a copy of your driving licence, insurance certificate or logbook. They are stored privately for you, and only you can open them, in the app, through links that last a minute. Our staff do not open them, and nobody else on Recovru can, including your family and any organisation that provides your plan. Legal basis: contract.
• Accident reports. What you record about an accident: who was driving, when and where it happened, what happened and the conditions, any police attendance, the damage, photographs, your vehicle's details (copied from your saved vehicle), and the names, contact and insurance details of up to 5 other people involved and up to 5 witnesses. You need those details to make a claim, which is why we keep them for you. We do not contact those people or use their details for anything else, and the report asks nothing about anyone's injuries. Legal basis: contract; for the other people's details, our legitimate interest, and yours, in you being able to make a claim.
• Vehicle history checks, when we offer them (we have not started yet, and we will tell you in the app before we do). The number plate you check and the result: whether the vehicle is recorded as stolen (with the date and the police force that recorded it), as written off (with the category, date and cause), as scrapped, exported or imported, or with finance outstanding, how many keepers it has had and when the last one changed, and any plate or colour changes, where the records show them. A check can be of a vehicle you do not own yet, so we keep only what a buyer needs: for finance, only that it is recorded, the kind of agreement and the finance company, never its dates, its term, its agreement number or anyone's contact details. Legal basis: contract; for what the records say about a vehicle's keeper, our legitimate interest, and yours, in knowing whether a vehicle you may buy is stolen, written off or still under finance.
• Family. Who is in your family, who invited whom and when, and the email address of anyone you invite, until they join or the invitation ends, and which vehicles are shared with it. The holder and the members see each other's names and the vehicles shared with them, and can follow the rescues of a shared vehicle. Nobody sees anyone else's documents, reports or checks. Legal basis: contract.
• Live trip sharing. A link you choose to send while an operator is on the way to you. Whoever opens it sees your operator's first name, their vehicle, where they are and when they should arrive, and nothing about you: not your name, your address or anything about money. We keep only a scrambled copy of the link, and delete it within minutes of the link stopping working, which is 12 hours after you made it at the latest. Legal basis: contract.
• Messages about your plan. Notices about your plan, your family, reminders and checks, by notification and email (section 2 explains our service messages). Legal basis: contract.

If you think your details are in someone else's accident report, family invitation or vehicle check, email privacy@recovru.com and we will tell you what we hold, correct it or delete it. We hold those details only for the report, invitation or check they were entered for, we do not contact the people named in a report, and an invitation holds the invited person's email address only until they join, the invitation is withdrawn or it ends, 7 days at most.

This applies if an organisation, such as your employer, a police force or a council, offers you a place on its Recovru plan (Terms of Use, clause 7A). The organisation is a separate controller of what it receives from us, under its own privacy notice, which should also tell you what it does with it.

• Where your details came from. The organisation gave us your work email address, or asked our staff to offer you a place and gave them details we used to find your Recovru account, so that we could offer you a place. We never tell an organisation whether someone has a Recovru account before they join.
• What the organisation sees. The work email it gave us, if it gave one; whether you joined, said no or let the offer run out; once you have joined, your name and that you are on its plan; and, for each rescue billed to it, the date and time, the service, the vehicle's registration if it is one of the organisation's own vehicles (or "own vehicle" if not), the postcode districts the rescue started and ended in, which are the first half of each postcode, such as SW1A (the full pickup and drop-off addresses for the organisation's own vehicles), the price, its references, the operator's business name and how the job ended.
• What it never sees. Your live location or route, your messages or calls, your ratings, any rescue you pay for yourself, your own plan or payments, your family, or any other organisation you belong to.
• Why, and what allows us to. To offer you a place, using the details the organisation sent: our legitimate interests in running the plan it bought. To run the plan once you join, and to bill the organisation for its rescues: your contract with us, which includes the organisation receiving the details above. Joining is your choice, and you can leave at any time in the app, which stops the organisation receiving details of any new rescue.
• A police force's own vehicles. When a member of a police force asks for help with one of the force's vehicles, the force's references and handling notes are the force's information: we hold them for the force, on its instructions, and keep them apart from what we keep for billing, safety and legal claims.
• How long. The organisation's plan, its statements and the rescues billed to it: 6 years after the organisation's agreement ends, because they are contract and tax records. An offer you said no to, or that ran out or was withdrawn: 12 months.

Some information, such as information about your health or a disability, gets extra protection in law. We never ask you for it, and you never need to give it to get help.

• An access need you choose to tell us about. When it arises: only if you mention a disability or a health condition in your request description, in a message or to our staff, so that your operator arrives able to help you. Who sees it: every operator who is sent your request sees your description (section 6), and a message is seen by whoever you send it to. What we do with it: we use it only to make the adjustment and to deal with that job. It is not copied onto your profile, and it plays no part in which operators are sent your request or what they charge. What allows us to: the law treats it as health information. The app does not ask for your explicit consent when you write it, so we do not rely on consent. We pass it to operators so the adjustment can be made under the Equality Act 2010, relying on paragraph 6 of Schedule 1 to the Data Protection Act 2018, and we are adopting the appropriate policy document that paragraph requires. We keep it with the job record because a claim about the job could rest on it, relying on the condition for legal claims (UK GDPR Article 9(2)(f)). If you would rather it was not kept, tell our staff and we will take it out of the job. Section 8 says how long it is kept otherwise.
• Choosing a mobility vehicle service. If you ask for recovery or repair of a mobility vehicle, such as a wheelchair accessible vehicle, we record the vehicle type and the service, like any other, so that your request goes to operators equipped for it, and every operator sent the request sees them. We do not treat that choice as information about anyone's health, and we do not use it to work out anything about you or anyone who travels in the vehicle. If you also tell us about a disability, the point above applies.
• Something sensitive in a photograph or message. If a photograph or message you send happens to show or mention something sensitive, we do not go looking for it, we do not use it for anything other than the job, and it is kept and deleted with the job's photographs or messages (section 8). Tell our staff if you want it taken out sooner.

We do not carry out any biometric processing on customers. Operators go through an identity check that does involve biometric data; that is covered in the Operator Privacy Notice, not here.

Some things in the app happen without a person looking at them at the time. Most of them decide nothing about you as a person. Three of them can affect you directly, so the law treats them as automated decisions, and you have the safeguards at the end of this section for each: a cancellation charge is worked out, and taken, by software; a vehicle recorded as stolen cannot be added; and repeated wrong sign-in attempts lock the account for a short time.

• Prices. We do not set them. Each operator sets their own price for your job. We show operators a guide to what similar jobs usually cost, which they are free to ignore.
• Which operators are sent your request. Your request goes first to verified operators within 5 miles and 15 minutes' drive of you. If none of them has quoted within 45 seconds, it goes to operators within 10 miles and 25 minutes, then 15 miles and 35 minutes, then 20 miles and 45 minutes, then 25 miles and 45 minutes, each 45 seconds after the last. Nobody more than 45 minutes' drive away is sent it. Every request is sent out the same way, whatever plan you are on, except that a booking for an organisation that has set requirements, such as a police force, goes only to operators who meet them (Terms of Use, clause 7A). Nothing is decided about you: it is about who is nearby.
• The order quotes are shown in. The quotes you can see are ordered using the operator's arrival time, their price, their rating, their record of completing jobs, their distance, and whether they are verified for the work, so the cheapest is not automatically first. You can choose any of them, or none.
• Recovery suggestions. If your answers point to a risk, for example a tyre that has blown and is still being driven on, a tyre or wheel that is hot or smoking, or damage after an impact, the app suggests recovery. The suggestion is worked out from your own answers by fixed rules. It is not made by AI and it is not an assessment of you. It only suggests: you decide what to request, and nothing is refused or charged because of it. If you tell us the vehicle has crashed or hit anything, the request is for recovery, because an accident is always recovery (Terms of Use, clause 4).
• Cancellation charge. It is calculated from the distance and time your operator actually travelled. You see the figure before confirming, and a person reviews it if you challenge it.
• Vehicle warnings. If the vehicle records say a vehicle is stolen, the app will not add it. A person will look at it if you tell us the record is wrong.
• Sign-in lockout. After 5 wrong attempts to sign in with an email address within 15 minutes, further attempts are refused for 10 minutes, to stop someone guessing a password. It ends by itself, and our staff can help you in the meantime.
• Limits on how often some things can be done, such as looking up a vehicle from its number plate each day (Terms of Use, clause 7), and how often some other things can be sent, to stop misuse. If a limit stops you, tell our staff in live chat and they will help.
• Fraud and safety checks. They flag unusual activity for a person to look at. A person always makes the decision.

No account is closed or suspended by software alone. A person decides, you will be told, and you can ask for it to be looked at again. For anything decided automatically, including the three decisions above, you can ask us why it happened, tell us what you think, and have a person look at it again and change it if it was wrong: ask in the app, in live chat or at privacy@recovru.com.

• Operators who are sent your request. What they get, before they quote: your vehicle and its number plate, its MOT, tax, stolen and recall status, your description and answers, your photographs and any video, the road you are on and how safe it is, and the pickup and drop-off points. Why: an operator cannot quote fairly for a job they cannot see, and every operator who is sent your request needs the same information, whether or not they quote or are chosen. We do not show them your name or contact details at this stage, and the Operator Terms forbid them keeping what they saw or using it for anything else.
• An operator who has sent you a quote, before you choose. What they get: anything you write or send to that operator in the app. Only that operator sees it, whether or not you choose them, and the thread closes when you choose someone else. Why: so you can ask a question before you accept.
• The operator whose quote you accept. What they get, in addition: your name and profile photograph if you have one, which plan you are on (Free, Plus or Family, shown beside your name), the messages and in-app calls you have with them, and any access note. They do not get your phone number. After the job they can read the invoice, receipt or credit note we issue in their name, which shows your name and email address, because it is their document. Why: they cannot help you otherwise. For the job itself they are responsible for your information too, as a controller in their own right, and the Operator Terms require them to use it only for your job. When we issue an invoice, receipt or credit note in your operator's name, the operator is a controller of it in its own right, and we keep our own copy for our accounts and for the periods in section 8 as a controller too. Your profile photograph is stored where anyone who has its exact address can open it.
• Our payment provider, Stripe. What they get: what is needed to hold and take payment, run your plan and prevent fraud. Stripe also uses some of it as a controller in its own right, for fraud prevention and its own legal duties, under its own privacy policy at stripe.com/privacy.
• Google Maps. What they get: the map views, searches, addresses and map points needed to show maps and work out routes and arrival times. Google uses it as a controller in its own right, under its own privacy policy.
• Apple or Google, if you buy a plan in the app. What they get from us: only a random number that stands for your Recovru account (section 2.2). They already hold your payment and account details as the seller, as controllers in their own right.
• Your family, if you are in one, and anyone you send a trip link to. What they get: only what section 2.2 describes.
• An organisation whose plan you join. What it gets: only what section 2.3 describes.
• The companies that host and run Recovru for us. What they get: only what each needs to do its part, on our instructions. Section 9 names each one.
• Insurers, auditors and professional advisers. What they get: information about a specific claim, dispute, audit or piece of advice. Why: only where there is one.
• Our VAT return, only if we bill you for a plan. What it involves: your name, what you paid and the VAT in it, on the list of our own sales in our quarterly VAT report, which we email through Brevo to our own finance inbox, run under our Webmasters LDN name (another trading name of Dapper Trading Ltd), so that our VAT return can be made. Why: tax law requires us to keep and report our VAT records.
• Police, the courts, HMRC or a regulator. What they get: what they are legally entitled to require. Why: where we must, or where someone is at risk.
• A buyer of our business. What they get: your account and records, if Recovru is sold or merged, on the same terms as this policy. We will tell you first.

We do not sell your personal information, and we never will.

• Your account details. How long: for as long as you keep your account. When you delete it, section 10.1 applies.
• Job records, including your description and answers, the quotes you were sent, the pickup and drop-off points and cancellation records. How long: 6 years after the job. Why: tax and accounting law, and the time limit for bringing a claim. They are deleted automatically when that period ends, unless a legal hold or an open dispute applies.
• Invoices, credit notes and payment records. These are tax records. How long: until the end of the sixth year after the accounting year they fall in. Deleting them then is not yet automatic; none falls due before 2032.
• Photographs and video of the problem and the finished work, and photographs sent in messages. How long: 12 months after the job, or until a dispute about it ends if that is later. Why: they are the evidence of what was found and what was done. They are stored privately, and only the people this policy names can open them. When the period ends the links to them are removed automatically. Removing the files from our storage provider is not yet automatic: ask us at privacy@recovru.com and we will delete them by hand. An open dispute or legal hold prevents removal.
• Messages and in-app call records with an operator. How long: 90 days after the job closes, or until a dispute about the job ends if that is later. Why: support and disputes. A photograph sent in a message is covered by the point above, and one our staff removed after a report is deleted with the rest of the chat.
• Reports you make, with the copy of what was reported. How long: until the case they opened is closed and any complaint or claim that could rest on them has ended, and never more than 6 years after the case closes.
• Whom you blocked. How long: until you unblock them, or either of you deletes your account.
• Live chat with our staff. How long: 12 months from your last message for a general question or a problem with the app, or 6 years where it concerns a charge, a refund, a dispute or a decision about you. Why: to help you if you come back to us, and because a conversation about money or a dispute is evidence for as long as a claim can be brought.
• The positions recorded while your operator is on the way. How long: 90 days after each point, or until a dispute about the job ends if that is later. The last position and planned route stay with the job record.
• Saved vehicles, saved places and card details. How long: until you delete them or your account.
• Sign-in attempt records. How long: 30 days. Why: to lock out password guessing.
• Messages from the contact form on recovru.com. How long: 12 months from our last reply, or 6 years if it becomes a complaint or a dispute.
• Health or access information you put in your description or a message. How long: as long as the description or message it is in (the points above and below), unless you ask us to take it out sooner, which we do. Why: your description is the record of what you asked for, and a claim about the job could rest on it for 6 years. The law allows health information to be kept for as long as it is needed to make or defend a legal claim, and we keep it for nothing else.
• Our own usage analytics. How long: 12 months.
• The latest position the app shares while it is open (section 2.1). How long: until the next one replaces it, and never more than two days after the last one.
• Your plan's record: which plan, who billed it, its dates, payments and refunds. How long: 6 years after the plan ends. Why: they are purchase records, and settle any question about a payment. If you delete your account, your name is taken off it. They are deleted automatically when that period ends.
• Documents in your vault, accident reports and their photographs, vehicle history check results, reminder dates and your family. How long: until you delete them, or your account. A Free plan can still open, download and delete them.
• Live trip links. How long: until the link stops working, 12 hours after you made it at the latest.
• Records of what you accepted, and any request to delete your account. How long: 6 years after your account closes. Why: to show what you agreed to, and that we did what you asked. They are deleted automatically when that period ends. The settings you chose on the Privacy screen are deleted with your account.
• Information we need for an open dispute, chargeback, fraud or safety investigation, legal claim or request from the police or a regulator. How long: until it is resolved, even if a period above has passed. Why: it is evidence, and deleting it could harm you or someone else.

Information in a backup is kept beyond use: it is not used for anything, it is not restored into the live service except to recover from a failure, and it disappears when that backup expires in the normal cycle. If we ever have to restore a backup, we delete again anything that had already been deleted.

Some of the companies that help us run Recovru are outside the United Kingdom. That is allowed, but only if the information is protected to the standard UK law requires. Below is every company that receives information about you, what it does, where the information goes and what protects it. Where the honest answer is that something is still being confirmed, we say so rather than leave a comforting gap.

• Our database, sign-in, file storage and servers. Who: Supabase, Inc. What it holds: everything in your account and your jobs. Where it goes: stored in Frankfurt, Germany. Supabase is established in the United States and its staff can reach the data from outside the UK and Europe. What protects it: Supabase's data processing agreement, with the EU Standard Contractual Clauses and the UK Addendum approved by the Information Commissioner.
• Taking payment, holds and refunds, customer plans, and paying operators. Who: Stripe. What it gets: your card, payment and billing details, the job's amount, our internal references to your account, the job and your operator, and what the operator will be paid. Stripe also receives a payment token, in place of your card number, if you pay with Apple Pay or Google Pay; Apple or Google is a controller of the wallet in its own right. Where it goes: the UK, Europe and the United States. What protects it: Stripe relies on the UK Extension to the EU-US Data Privacy Framework, with the UK International Data Transfer Addendum in its data transfer terms behind it.
• Push notifications about your quotes and your operator. Who: Google (Firebase Cloud Messaging). What it gets: your device's notification token and the text of each notification, such as your operator's name and arrival time, or the start of a message sent to you. On an iPhone, Google passes each notification to Apple's push service to deliver, and in a web browser to that browser's push service. Where it goes: Google's infrastructure, including the United States. What protects it: Google's Firebase data processing terms; Google LLC is certified under the UK Extension to the EU-US Data Privacy Framework.
• Ringing an iPhone for an in-app call. Who: Apple. What it gets: when someone rings you in the app, our servers may send the ring directly to Apple's push service, with the caller's name, a short label for the job such as "Blue Ford", a reference to the caller's photograph and the call reference; Apple holds your phone's call-ringing token for this. Where it goes: Apple's infrastructure, including the United States. What protects it: Apple is a controller in its own right for delivering the notification, under its own privacy policy.
• Crash reports, only if you have switched Crash reporting on. Who: Google (Firebase Crashlytics). What it gets: a technical report of the crash, with no account identifier. Where and what protects it: as for push notifications.
• Marketing analytics, only if you have switched it on. Who: Google (Google Analytics for Firebase). What it gets: how the app is used, with an identifier for your device that Firebase creates for the app, never your device's advertising identifier. Where and what protects it: as for push notifications.
• Maps, address and place search, routes and arrival times. Who: Google (Google Maps Platform). What it gets: from your device, its internet address and the area of the map on screen; from our servers, the addresses, searches and map points needed for a route, including Google's aerial view of an address; from our website's servers, the town, position or place a visitor types (section 2.4); and, on Android, what Google's navigation map software uses to draw the map. Where it goes: Google's infrastructure, including the United States. What protects it: Google acts as a controller in its own right under the Google Maps Platform controller data protection terms, and Google LLC is certified under the UK Extension to the EU-US Data Privacy Framework.
• Working out driving times to find operators near you, and the length of a tow. Who: our own routing server, which runs the open-source OSRM software on the server in Manchester, England, that Hostinger provides (hosting, below); and, once we switch it on, Google (the Routes API), for the driving times, with live traffic, of the operators about to be sent your request. What it gets: map coordinates only (your pickup and drop-off points and operators' positions), with no name, account or job reference. Where it goes: the United Kingdom; for Google, as for maps, above. What protects it: our own server is in the UK, and Hostinger's data processing terms bind it to act only on our instructions; for Google, as for maps, above.
• Sending your confirmations, receipts, invoices and sign-in codes, and the messages sent from the contact form on recovru.com. Who: Sendinblue SAS, trading as Brevo (France). What it gets: your name, email address and the content of the email. A message from the contact form is delivered to our own inbox, which we run under our Webmasters LDN name (section 2.4). Where it goes: servers in the European Union. What protects it: the EU is covered by UK adequacy regulations. Some of Brevo's own suppliers can reach data from outside the UK and Europe, and we are obtaining written confirmation of the safeguard Brevo relies on for that.
• Telling our staff when you report a problem, make a complaint or raise a dispute. Who: Slack Technologies, LLC (part of Salesforce). What it gets: the kind of report, its subject and what you wrote, your email address, and short references to the report and the job. Where it goes: Slack's infrastructure, including the United States. What protects it: Slack's data processing terms; we are obtaining written confirmation of the transfer safeguard it relies on.
• Hosting app.recovru.com, the web app, and WM HQ, the operations system our staff use. Who: Hostinger International Ltd, on a server it provides to us in Manchester, England. What it gets: your internet address and browser details when you use the web app; the information our staff look at in WM HQ passes through it. Where it goes: the United Kingdom. What protects it: the server is in the UK, Hostinger is established in the European Union (Cyprus), which UK adequacy regulations cover, and its data processing terms bind it to act only on our instructions.
• Connecting an in-app call when a direct connection will not work. Who: Cloudflare, Inc. What it gets: both people's internet addresses and how long the call lasted. It cannot listen to the call: the audio is encrypted between the two devices before it gets there. Where it goes: Cloudflare's global network, including the United States. What protects it: Cloudflare is certified under the UK Extension to the EU-US Data Privacy Framework, and its data processing terms add the Standard Contractual Clauses.
• Hosting recovru.com, and our own staff console. Who: Vercel Inc. What it gets: your internet address and browser details when you visit recovru.com; the information our staff look at in our own console passes through it. Where it goes: the website runs on Vercel's global network, and our own console in Frankfurt, Germany. What protects it: Vercel is certified under the UK Extension to the EU-US Data Privacy Framework.
• Our quarterly VAT report, only if we billed you for a plan. Who: our own finance inbox, which we run under our Webmasters LDN name (another trading name of Dapper Trading Ltd), so that our VAT return can be made. What it involves: your name, what you paid and the VAT in it. Where it goes: sent by Brevo (above) to that inbox.
• Filling in your vehicle from its number plate, the stolen, tax and MOT checks, the MOT and tax dates behind your reminders, and vehicle history checks. Who: OneAutoAPI, a UK vehicle data provider, which uses the official vehicle records and, for history checks, Experian. What it gets: the number plate only. If our own copy of its picture of your vehicle could not be made, your device loads the picture from the provider's servers, which then see your device's internet address. Where it goes: OneAutoAPI is a UK provider. What protects it: UK law applies to it; we are obtaining written confirmation that the number plate does not pass, through its image or history suppliers, to anyone outside the UK.
• Selling a plan in the app. Who: Apple (the App Store) on an iPhone, or Google (Google Play) on Android. What it gets from us: only a random number that stands for your Recovru account, never your name or email address. They are controllers in their own right for the purchase, under their own privacy policies.
• Signing in with Apple or Google, only if you choose to. Who: Apple or Google. What it gets: the fact that you are signing in to Recovru, and, if you signed in with Apple and delete your account, the token Apple gave us, so that Apple ends Recovru's access to your Apple ID. They are controllers in their own right under their own privacy policies.
• Drafting a written agreement, only if our staff prepare one for you. Who: Google (Gemini). What it gets: our staff member's instructions and the name of the person or business the agreement is with. Nothing is sent without a member of staff choosing to, and a person reads and edits every draft before it goes anywhere. Where and what protects it: Google's infrastructure, under Google's terms for that service, and the UK Extension to the EU-US Data Privacy Framework.

Some services we use receive nothing about you at all: the fuel prices used to work out a cancellation charge come from the price files fuel retailers publish, and vehicle pictures come from Wikipedia and Wikimedia Commons, looked up by make and model only. Where a company is outside the UK, putting your data on a European server does not by itself solve the problem, because the company can still reach it from where it is: that is why each entry names a safeguard rather than resting on where the server is. Ask us at privacy@recovru.com for a current copy of this list and the safeguard for each.

• See everything we hold. How: Access your data, in the app, gives you a copy straight away of your account, vehicles, saved places, jobs, messages, payments, ratings, plans, the documents you accepted, your settings, the invoices and receipts we issued, live chat with our staff, call records, usage analytics, the latest shared job position, the quotes you were sent, the people you blocked and the reports you made. Reports other people made about you are held back, as complaints made by others are, and our staff send you what can be shared. Email privacy@recovru.com for anything the copy does not include. Free, normally within one month.
• Get a copy to take elsewhere. How: the same place produces a file you can keep or share.
• Correct something wrong. How: edit it in the app, or tell us.
• Delete it. How: Delete account, in the app. Section 10.1 explains what happens.
• Object, or ask us to restrict use. How: email us and tell us why, or use the switches described in section 5.
• Withdraw consent. How: in the app, for crash reporting and marketing analytics. For an access need you have told us about, ask our staff and we will remove it. Withdrawing does not undo what we did before.
• Complain. How: to us first, then to the Information Commissioner (section 12).

If you cannot use the app to exercise a right, email or write to us and we will do it for you. No right is only available through the app, and using any of them costs nothing. We may need to check it is really you before we act, and we will ask for no more than we need to do that. If a request is complex we may take up to two further months, and we will tell you within the first month if so.

• Section 9: the driving times we use to find operators near you, and to measure a tow, are now worked out by our own routing server, on our server in Manchester, England, instead of the public server of the Project OSRM. Once we switch it on, Google also works out, with live traffic, the driving times of the operators about to be sent your request.

The changes made by earlier versions are kept with those versions: ask us at privacy@recovru.com for a copy.