Privacy Policy
Last updated: 4 July 2026
This policy explains how Recovify ("we", "us") collects, uses and shares your personal data when you use the Recovify app and website (the "Platform"). Recovify is the data controller for this data. We comply with the UK GDPR and the Data Protection Act 2018. Contact: support@recovify.app.
1. Data we collect
- Account data — name, email address, phone number, password (stored as a secure hash), your role (customer, business or driver), and if you sign in with Google, your Google account identifier.
- Job data — vehicle registration and details, pickup and delivery addresses, scheduling, quotes, payments status, cancellation reasons and job history.
- Vehicle lookup — when you enter a registration number we query the DVLA/DVSA vehicle enquiry services to fill in make, model and technical details.
- Business verification documents (Operators) — driving licence, insurance certificates, proof of address, vehicle photos and similar documents you upload to earn the verified badge.
- Payment data — processed by Stripe. We store payment references, amounts and status; we never store full card numbers. Operators onboarding for payouts provide identity and bank details directly to Stripe.
- Messages and media — in-app chat messages and photos exchanged about a job.
- Location data — while a job is active, the operator's or assigned driver's device broadcasts its live location so the customer can track the recovery. Location sharing stops when the job ends. Addresses you type are sent to Google Places for autocomplete.
- Device and usage data — push notification token, notification preferences, and technical logs (such as IP address and request logs) used for security and troubleshooting.
- Reviews — ratings and comments left after completed jobs.
2. How we use your data
| Purpose | Legal basis |
|---|---|
| Creating and managing your account; matching jobs with operators; processing quotes, bookings, payments, refunds and payouts; chat and live tracking | Performance of a contract |
| Verifying operator documents and displaying the verified badge; preventing fraud and abuse; securing the Platform; resolving disputes between users | Legitimate interests (running a safe, trustworthy marketplace) |
| Keeping transaction and payment records; responding to lawful requests | Legal obligation |
| Service notifications (new quotes, payment and job updates) | Performance of a contract; you can disable non-essential categories in settings |
| Marketing communications (if any) | Consent — off by default, opt-in in notification settings |
3. Who we share data with
Other users
- Operators browsing open jobs see the job details (vehicle, locations, timing) but a customer's contact details are only shared with the operator whose quote was accepted, after payment.
- Customers see the quoting business's name, rating, reviews and verification status, and the assigned driver's name and contact number once booked.
- Reviews you leave are shown on the other party's public profile.
Service providers (processors)
- Stripe — payment processing and operator payouts (Stripe is an independent controller for the data it collects during payment and onboarding).
- Google — sign-in, maps, address autocomplete and route calculation.
- DVLA / DVSA — vehicle detail lookup by registration number.
- Brevo — transactional email delivery (verification and password-reset codes).
- Expo — push notification delivery to your device.
- IONOS — our servers are hosted in IONOS data centres in the EU. Uploaded files (chat photos, verification documents) are stored on our own server, not a third-party cloud.
We do not sell your personal data. We may disclose data where required by law, or to establish or defend legal claims.
4. International transfers
Our servers are in the EU (covered by UK adequacy regulations). Some providers, such as Stripe, Google and Expo, may process data in the United States or elsewhere; where they do, transfers are protected by the UK Extension to the EU–US Data Privacy Framework or standard contractual clauses with the UK addendum.
5. How long we keep data
- Account data — for as long as your account exists.
- Account deletion — deleting your account removes your profile and personal details, and your user record is anonymised. Records of completed jobs, payments and reviews are retained in anonymised or minimal form because financial records must be kept for up to 6 years (HMRC requirements) and reviews reflect other users' genuine experiences.
- Chat messages and photos — retained while the related job records are retained, so they are available if a dispute arises.
- Verification documents — retained while you operate on the Platform; deleted when your account is deleted.
- Live location — only the most recent position is kept while a job is active for tracking continuity; it is not retained as a movement history.
6. Security
All traffic is encrypted in transit (HTTPS/TLS). Passwords are hashed with bcrypt. Access to payment operations is verified against Stripe before any money moves, and money paid for a job is held by the platform and only released when both sides confirm completion. Access to production systems is restricted and key-based.
7. Your rights
Under the UK GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased (see the retention limits above);
- restrict or object to certain processing;
- receive your data in a portable format;
- withdraw consent at any time, where processing is based on consent.
To exercise any of these rights, email support@recovify.app. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).
8. Children
The Platform is not intended for anyone under 18, and we do not knowingly collect data from children.
9. Changes to this policy
We may update this policy from time to time. Material changes will be notified through the app or by email, and the "Last updated" date above always reflects the current version.