Privacy Policy

1. Who we are

RevMate is run by [to be added], [to be added] (the "data controller"). ICO registration number: [to be added]. Contact us about privacy at [to be added].

2. What we collect

• Account details: email address, password (stored only as a secure hash), username and date of birth. Your date of birth is private and never shown to anyone.
• What you choose to share: profile photo, cover photo, bio, social links, garage cars, mods, posts, comments, reactions, photos, videos, stories, polls, listings, meets, group memberships and entry answers.
• Messages you send to other members.
• Location — only when you choose: if you add a location to a post or use "Near you", we use your device's location, rounded to about 1 km. We never track your location in the background.
• Activity: follows, likes, saves, watchlists, profile and listing views (counted once a day), streaks and notification settings.
• Safety records: reports you make or that are made about your content, blocks, and moderation decisions.
• Car care: MOT and road tax due dates you add, so we can remind you.
• Your area — only if you add it: the first half of your postcode (e.g. LS6). We use it to work out rough distances to adverts, car meets and local businesses, to start your adverts' location, and to show local offers. It's never shown to other members — they only ever see a rounded distance.
• Business reviews and reports you write. Reviews are public; reports are only seen by RevMate's team.
• Buy & Sell: if you add a postcode to an advert we keep only the first half (e.g. LS6) and its rough centre, to show buyers how far away it is. Offers you make or receive are only seen by you and the other person. Saved searches are private to you. If a seller marks you as the buyer, you can leave a public review of the seller. The postcode you use to search "near me" stays on your device.
• Consents: which version of our Terms and this policy you agreed to, when, and your marketing choice.
• Technical data: our hosting providers process your IP address, browser type and request logs to deliver the service and protect it from attacks. If you turn on phone notifications, we store your browser's push subscription.
• Payments: if you buy something (for example RevMate Plus or a featured advert) we keep what you bought, the amount, the date and a Stripe reference, so we can provide it and keep accounts as the law requires. Card details go straight to Stripe; we never see or store them.
• Where you came from: if you arrive from one of our TikTok posts or ads, we note the campaign name (for example "fuel" and "tiktok") with your account when you sign up, and count visits to our campaign pages without recording who you are. This is in our legitimate interest in knowing which adverts work.
• TikTok Pixel: only if you allow ad cookies, TikTok receives information about your visit (such as pages viewed and that you signed up) to measure our ads. You can withdraw this at any time in Settings → Privacy or the Cookie policy.
• Store orders: your name, delivery address, phone number, email and what you ordered, so we can deliver it. We share the delivery details with the supplier, partner or courier sending your order, and keep order records for six years as tax law requires.
• Auctions: the bids you place. Other members see bids as "Bidder 1, 2…", never your name. When an auction ends, the winner and seller can see each other's username so they can arrange the sale.
• Feed: which posts you've already seen in your feed, for 30 days, so we can show you something new each time. It's never shown to anyone.
• Deals: when you tap a deal we count the click, without recording who you are. The partner's own privacy policy applies on their site.

3. Why we use it, and our lawful basis

• To provide RevMate (your account, feed, garage, groups, meets, messages, Buy & Sell and notifications) — contract.
• To keep people safe: age limits, moderation, handling reports, preventing spam, scams and abuse, and meeting our duties under the Online Safety Act 2023 — legal obligation and legitimate interests.
• To personalise your feed ("For You" ranks posts using the makes you follow and what you engage with) and to improve RevMate — legitimate interests. You can always switch to another feed tab, such as Following, instead.
• Sponsored posts: we choose which ones to show you using your area (if you've added it) and the type of car in your garage (for example electric) — legitimate interests. Advertisers never receive your personal data; they only see how many people saw and tapped their ad.
• Marketing emails — only if you tick the box, and you can withdraw at any time in Settings — consent.
• Location and phone notifications — only when you turn them on — consent.

We don't use your data for advertising profiles, we don't sell it, and we don't make decisions with legal or similarly significant effects about you by automated means.

4. What other people can see

Your username, profile photo, bio, garage, public posts, comments, reactions, follower counts and active listings are visible to other members. Listings, link previews of shared posts, and the profiles and garages of members aged 18 or over can also be seen by people who aren't signed in and by search engines such as Google. Profiles of members under 18 are never shown to people who aren't signed in or to search engines. Followers-only posts, private groups and messages are not public. Never put your phone number, address or bank details in a public post or listing.

5. Who we share it with

We use trusted providers who process data for us under contract:

• Supabase — database, sign-in, file storage and emails
• Cloudflare — hosting, content delivery and protection against attacks
• Lovable — the platform used to build and deploy the app
• Your browser's push service (e.g. Google, Apple or Mozilla) — only if you turn on phone notifications
• Google Maps — only when you tap to show a map on a meet
• Stripe — card payments, receipts and managing subscriptions, only if you buy something
• TikTok — ad measurement, only if you allow ad cookies
• Anthropic — only if you use "Ask RevMate AI" in Fix a problem: your answers, the car and anything you type are sent to generate the diagnosis. Don't include personal details.

Some providers may process data outside the UK. When they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement/Addendum to protect it. We may also share information with the police or regulators where the law requires it, or to protect someone from serious harm.

6. How long we keep it

We keep your information while your account is open. When you delete your account in Settings, your profile, garage, posts, comments, listings, messages you sent and other personal data are permanently deleted straight away. Copies may remain in encrypted backups for a short period before they're overwritten. We may keep a minimal record of serious safety breaches (such as a ban for illegal content) where we need it to protect others or meet a legal obligation.

7. Children and teenagers

You must be 13 or older to use RevMate. We ask for your date of birth when you join and refuse sign-ups from anyone younger. If we learn an account belongs to someone under 13, we delete it. For members aged 13–17 we apply extra protections: selling on Buy & Sell, hosting meets and adding a location to posts unlock at 18, and direct messages unlock at 16. Adults can't start private conversations with members under 16.

8. Your rights

You have the right to:

• access your data and get a copy (Settings → Download my data)
• correct it (edit your profile, garage and posts at any time)
• delete it (Settings → Delete account)
• restrict or object to how we use it
• data portability (the download is in a machine-readable format)
• withdraw consent at any time (Settings → Privacy)

To use any right, use Settings or contact us at [to be added]. We'll reply within one month. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

9. Security

Data is encrypted in transit (HTTPS) and at rest. Access is controlled by row-level security, so members can only reach data they're allowed to see, and passwords are stored only as secure hashes. No system is perfect: use a unique password, and tell us straight away if you think your account has been compromised.

10. Cookies

RevMate doesn't use advertising or analytics cookies. See our Cookie Policy for the small amount of storage we use to keep you signed in and remember your settings.

11. Changes

We'll update this page when things change and show the new date at the top. If a change is significant, we'll ask you to review it in the app.