MOTORVAULT
Privacy notice
Last updated 10 November 2026
MOTORVAULT is a private garage for your cars with an optional community. Your garage is private by default. Nothing from it is shown to anyone else unless you choose to share it. This notice explains what we hold, why, who can see it and what you can do about it.
Who we are
MOTORVAULT (https://motor-vault.co.uk) is run by Yohann Ifrah, who is the data controller for the personal information described here.
Privacy questions and requests: privacy@motor-vault.co.uk.
What we collect and why
| Information | Why | Lawful basis |
|---|---|---|
| Email address and password (stored only as a secure hash) | To create your account, sign you in and send account emails (confirmation, password reset) | Contract |
| Your name, if you give it, and your distance unit | To personalise your garage. Shown only to you | Contract |
| Vehicles: make, model, year, colours, registration, mileage, purchase date and price, your story | To run your garage, ownership records and Passport | Contract |
| Running costs, servicing (including provider and notes), modifications, milestones, finance agreements and payments | To calculate ownership costs, finance progress and your vehicle timeline | Contract |
| Photographs of your cars and modifications | To show in your garage and, if you choose, on your Passport or public car profile | Contract |
| Community profile (if you create one): username, name, bio, profile photo, posts, photos, captions, comments, likes, stories, follows, blocks and messages | To run the community features you choose to use | Contract |
| Reports you make, reports about content or accounts, and our moderation decisions | To keep the community safe, handle appeals and meet our legal duties | Legitimate interests; legal obligation |
| How often you post, comment, follow and message | To limit spam and abuse (counted automatically, never shown to anyone) | Legitimate interests |
| Technical data: IP address, browser, pages requested, timestamps, errors | To run the service securely, prevent abuse and fix problems | Legitimate interests |
We do not use your information for advertising. We do not sell it, and we do not send marketing emails. We do not ask for special category information (such as health or religion), and please don’t include it in posts or notes.
What other people can see
- Your garage is private. Registration numbers, prices, costs, finance, service providers, notes and purchase details are never shown to anyone else.
- Vehicle Passport (only if you switch it on for a car): anyone with the link can see the make, model, year, colours, transmission, the car’s photographs, and the story, installed modifications and service and milestone titles you mark as public. Mileage is shown only if you choose. Passport pages are hidden from search engines.
- Community (only if you create a profile): signed-in members can see your username, name, bio, photo and follower counts. Your posts, stories and public cars are visible to members, or only to followers you approve if your account is private. People you block cannot see you. Messages are seen only by you and the other person; we look at them only if needed to investigate a report or meet a legal duty. People who aren’t signed in can’t see community content.
- Photographs: we remove location and camera details from every photo before it is uploaded. Anything visible in the picture itself (number plates, faces, houses, street names) remains visible to anyone who can see the photo, so please check before sharing.
Who we share it with
We use these service providers (processors) to run MOTORVAULT. They act on our instructions under contract:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, sign-in, photo storage | Ireland (EU) |
| Vercel | Hosting the website; request logs | Servers in Dublin (EU); global delivery network; US company |
| Resend | Sending account emails | United States |
| ImprovMX | Forwarding emails sent to our support and privacy addresses | France (EU); delivery partly via the United States |
| Google (Gmail) | The inbox where we read and answer your emails | United States and other countries |
| Cloudflare (Turnstile) | Security check on sign-up, sign-in and password reset, to tell people from automated bots | Global network; US company |
| GitHub | Storing encrypted database backups | United States |
| Backblaze | Storing encrypted photo backups | Canada |
Where information is processed outside the UK, it is protected by the UK’s adequacy regulations (including the UK–US data bridge where the provider is certified) or by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. Ask us for details.
We may disclose information if the law requires it, to protect people from harm, or to respond to valid requests from the police or regulators.
Cookies
We use only cookies that are strictly necessary to keep you signed in and to complete sign-in securely (set by Supabase, named sb-…-auth-token and, briefly during email links, …-code-verifier). We do not use analytics, advertising or tracking cookies, so there is nothing to consent to. The security check on sign-up, sign-in and password reset (Cloudflare Turnstile) looks at your browser to tell people from bots; it is used only for security, not for advertising or tracking. If any of this changes, we will ask you first.
How long we keep it
- Account, garage and community content: until you delete it, or delete your account.
- Deleting your account removes your profile, cars, records, photos, posts, comments, likes, follows and conversations immediately. Conversations are removed for both people.
- Stories: hidden from everyone after 24 hours. The files are deleted the next time you post a story, or when you delete your account.
- Reports and moderation records: kept for 12 months after they are closed, including those about accounts that have since been deleted, so repeated abuse can be recognised.
- Backups: encrypted database backups are kept for 14 days. The photo backup holds a copy of current photos; photos you delete stay in it for up to 30 days, then are removed.
- Provider logs (requests, sign-ins, email delivery): kept for short periods set by each provider.
- Emails you send us: kept in our inbox for as long as needed to deal with your request.
Your rights
You have the right to:
- see a copy of your information (access);
- correct it: most of it you can edit yourself in Settings and Edit profile;
- delete it: delete individual items, or your whole account in Settings;
- receive it in a portable format;
- object to, or ask us to restrict, how we use it.
Email privacy@motor-vault.co.uk from the address on your account. We will reply within one month. You can also complain to the Information Commissioner’s Office at ico.org.uk, though we would appreciate the chance to put things right first.
Age
MOTORVAULT is for people aged 18 and over. We delete accounts we find belong to anyone younger.
Security
Access to your information is restricted in the database itself, so each account can only reach its own private records. Connections are encrypted, and passwords are never stored in readable form. No system is perfectly secure: if something goes wrong that puts you at risk, we will tell you and the ICO as the law requires.
Changes
If we change this notice in a way that matters, we will tell you by email or in the app before the change applies.