Privacy Policy · VehiGo Mobile
Version: 2026-09-25 · Effective date: 25 September 2026
This policy applies exclusively to the VehiGo Mobile app. The VehiGo web platform for workshops (vehigo.ro) has its own privacy policy.
1. Data controller
Webatelier SRL, Str. Brașovului Nr. 4, Biroul 15, Miercurea Ciuc, Harghita County, Romania, 530003. Data protection contact: office@vehigo.ro.
2. What data we process
Data you provide:
- Account data: name, email address, password (stored only encrypted/hashed), phone number (optional).
- Vehicle data: make, model, year, VIN, licence plate, mileage, photos.
- Documents and records: vehicle documents, expenses, fuel-ups, maintenance, tyres, deadlines, receipts and their photos.
- Photos for AI scanning: photos you choose to scan, your registration certificate, vehicle identity card, insurance policies (RCA/CASCO), periodic technical inspection (ITP) document, road vignette or receipts. They are deleted immediately after processing, unless you keep a registration certificate or vehicle identity card scan as a vehicle document, or save a receipt as an expense attachment (see section 4).
- Location of your parked car ("Find My Car"): coordinates and the street address derived from them on your device, saved only when you explicitly tap to save a parking spot, together with the time, a note and a photo of the spot, if you add them. The feature is optional and requires location permission, which you can decline or revoke at any time.
Data collected automatically:
- Technical device data (model, OS version, installation identifiers) and error logs (via Sentry).
- App usage data (screens viewed, features used), only with your consent, via Firebase Analytics; you can withdraw consent at any time in the App settings.
- Push notification token, if you enable notifications.
- Sign-up trial abuse-prevention record: the free trial is granted automatically when you first confirm your email address at sign-up. At that moment your email address and (if available) your device's installation identifier are hashed and checked against, and added to, a ledger used solely to prevent the same person from receiving the free trial more than once, including after deleting and recreating an account. We never store the plain email or device identifier in this ledger, only a keyed hash.
We do not track your position continuously and we do not collect location data in the background. The position is read only at the moment you save a parking spot. When you ask the App to navigate to the saved spot, the coordinates are handed, through the operating system, to the map application installed on your own device, and that application's own privacy policy continues to apply.
3. Purposes and legal bases (Art. 6 GDPR)
| Purpose | Legal basis |
|---|---|
| Providing the service (account, digital garage, reminders, notifications) | Performance of a contract (Art. 6(1)(b)) |
| AI scanning of documents you photograph | Performance of a contract (Art. 6(1)(b)): triggered only by your action |
| Saving your parking location ("Find My Car") | Consent (Art. 6(1)(a)): location permission is granted explicitly and can be revoked at any time in the device settings |
| Processing subscription payments | Performance of a contract (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c)) |
| Error monitoring and service security | Legitimate interest (Art. 6(1)(f)) |
| Usage statistics (Firebase Analytics) | Consent (Art. 6(1)(a)): explicit opt-in |
| Service communications (changes to terms, security) | Legitimate interest / legal obligation |
| Preventing abuse of the sign-up trial offer (one trial per person; device identifiers used to detect repeat trials) | Legitimate interest (Art. 6(1)(f)) |
We do not sell your data and do not use it for advertising.
4. AI-assisted scanning
When you use the scanning feature, the photo you take (for example the vehicle registration certificate, which contains the owner's name and address, VIN, licence plate, or a receipt) is:
- transmitted encrypted (HTTPS) to our servers;
- sent to Anthropic PBC (the Claude API service), acting as a sub-processor, solely for automatic extraction of fields from the image;
- deleted from our servers immediately after processing, whether or not the extraction succeeds. Exceptions: if you explicitly choose to save a receipt photo as an attachment of an expense, or leave the "Save to vehicle documents" option on (on by default) when scanning a registration certificate or vehicle identity card to add a car, the photo is stored like any other document you upload, together with the fields extracted from it. If you don't finish adding the vehicle, the kept photo is deleted automatically within 48 hours.
About processing at Anthropic: under Anthropic's commercial terms, data submitted through the API is not used to train AI models and may be retained briefly solely for abuse monitoring, in accordance with Anthropic's policies. The transfer to Anthropic (USA) takes place under the EU-US Data Privacy Framework and/or standard contractual clauses.
AI extraction is prefill-only: every extracted value is shown to you for review and can be corrected before saving. No automated decision-making with legal effects within the meaning of Art. 22 GDPR takes place.
5. Recipients and sub-processors
| Provider | Role | Data |
|---|---|---|
| Hetzner (EU) | Server hosting and file storage | All account data and content |
| Anthropic PBC (USA) | AI extraction from scanned photos | Only photos submitted for scanning |
| Google LLC · Firebase (USA) | Push notifications; statistics (consent only) | Push token; pseudonymized usage data |
| Sentry (USA) | Error monitoring | Technical data, error logs (no passwords or tokens) |
| Payment processor (Stripe) | Subscription payments | Payment data: processed directly by the processor; we do not store card numbers |
Transfers outside the EEA take place under the EU-US Data Privacy Framework and/or standard contractual clauses (Art. 46 GDPR).
6. Retention
- Account data and content: for the lifetime of the account; on account deletion, data is deleted or anonymized within 30 days.
- Photos submitted for AI scanning: deleted immediately after processing, unless the "Save to vehicle documents" option was left on, or you explicitly chose to save a receipt as an expense attachment (see section 4). In that case they are retained like any other document you upload. If you don't finish adding the vehicle, the kept photo is deleted automatically within 48 hours.
- Analytics data (Firebase Analytics): maximum 14 months.
- Error logs (Sentry): maximum 90 days.
- Billing data: for the statutory fiscal archiving periods.
- Saved parking spots: until you delete that parking spot or your account.
- Sign-up trial abuse-prevention record (hashed email/device identifier): kept for a fixed period of 36 months from the date the trial was granted, after which it is pruned. This record is not deleted when you delete your account, since its purpose, preventing the same person from receiving the trial again, would otherwise be defeated.
7. Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time (without affecting prior processing). Consent for location can be withdrawn at any time by revoking the permission in the device settings; parking spots already saved remain stored until you delete them. Data export and account deletion are available directly in the App (Profile); for any other request write to office@vehigo.ro. We respond within 30 days.
You have the right to lodge a complaint with the Romanian supervisory authority (ANSPDCP, dataprotection.ro) or your local supervisory authority.
8. Security
All transfers are encrypted (HTTPS/TLS). Passwords are stored only as hashes. Authentication tokens are stored on the device in the system's secure storage (iOS Keychain / Android Keystore). Files are accessed exclusively through time-limited signed URLs. Access to production data is restricted.
9. Children
The App is not directed at persons under 16 and we do not knowingly collect data from them. If you become aware that a minor has provided us data, contact us at office@vehigo.ro.
10. Changes to this policy
Each version carries a version number (date) shown in the header. For significant changes you will be asked to re-accept in the App before continuing to use it. The current version is permanently available at the address shown in the App.
11. Contact
Webatelier SRL Str. Brașovului Nr. 4, Biroul 15, Miercurea Ciuc, Harghita County, Romania, 530003 Email: office@vehigo.ro