VehiclePrivacy Policy
Effective 27 September 2026
In short: we use your data to run VehicleProof for you, nothing else. We don't sell it, we don't show ads, and the app has no advertising or analytics trackers. Your records are stored in Singapore. You can see, correct, export or delete your data at any time, and deleting your account in the app removes it.
1. Who we are
VehicleProof (the app and this website) is operated by FoundryOps, a business of Mohamad Akmal bin Mohamed Abu Bakar, in Malaysia ("we", "us"). We are responsible for your personal data under Malaysia's Personal Data Protection Act 2010 (PDPA).
Contact for anything in this policy: vehicleproof999@gmail.com.
2. What we collect
| Data | What it includes | Where it comes from |
|---|---|---|
| Account | Name, email address, sign-in method (email and password, Google or Apple). Your password is held by our sign-in provider; we never see it. | You, or Google or Apple when you sign in with them |
| Vehicles | Registration number, make, model, year, colour, fuel type, odometer readings, cover photo | You |
| Inspections | Photos of the vehicle, damage notes, dates and times, and a digital fingerprint (SHA-256) of each photo | You, through the in-app camera |
| Records and documents | Service and repair records, expenses, workshop names and amounts, receipts, insurance, road tax and registration documents, and notes | You. Documents can contain other personal details, such as an owner's name or ID number on a registration card. |
| Scanned documents | The text read from receipts and documents you choose to scan | Produced from your scan |
| Location | Your approximate location, only when you search for places nearby | Your phone, with your permission |
| Device | Device model and name, operating system, app version, and a notification token if you allow notifications | Your phone |
| Subscription | Your plan and whether a subscription is active. We never receive your card details. | Apple App Store or Google Play |
| Enterprise enquiries | Name, email, phone, company and your message | You, if you request an Enterprise quote |
| Security logs | What was done in your account and when, with your IP address and browser details stored only in a scrambled (hashed) form | Our servers |
| Support | Emails you send us | You |
Your name and email are needed to create an account; without them we can't provide the app. Everything else is optional and only collected when you use the feature it belongs to.
3. Why we use it
- To provide the app: store your vehicles, inspections, records and documents, and show them back to you.
- To read scanned receipts and documents so you don't have to type them in.
- To remind you before road tax, insurance or a service is due.
- To find service centres, fuel and charging stations near you, when you ask.
- To manage your plan, device limits and subscription.
- To keep the service secure: detect abuse, limit misuse and investigate problems.
- To reply to support requests and Enterprise enquiries.
- To meet legal obligations.
We don't sell your data, use it for advertising, or use your photos and documents to train AI models.
4. Who we share it with
We use a small number of service providers to run VehicleProof. They process data only on our instructions and only for the purpose listed.
| Provider | What for | Location |
|---|---|---|
| Clerk | Sign-in and account security | United States |
| DigitalOcean | Servers and private file storage | Singapore |
| Supabase (on Amazon Web Services) | Database | Singapore |
| Mistral AI | Reading the text of receipts and documents you choose to scan | European Union |
| Google sign-in; Google Drive, only if you connect it; Firebase Cloud Messaging for notifications, which receives only the alert title, never your documents | United States and others | |
| Apple | Sign in with Apple, App Store purchases and notifications on iPhone | United States and others |
| RevenueCat | Checking the status of App Store and Google Play subscriptions | United States |
| Resend | Sending emails, such as Enterprise quote requests | United States |
| OpenStreetMap (Overpass API) | Finding nearby places. It receives an approximate location, not who you are. | Germany |
Google Drive: if you connect your own Google Drive, the app can only see files it creates there. Files you store in your Drive are yours; they stay in your Drive under Google's terms, even if you later delete your VehicleProof account.
Sharing you choose: when you share an inspection report or invite someone to your workspace, they see what you share.
Legal requests: we disclose data if the law requires it, or to protect the rights and safety of users and others.
5. Transfers outside Malaysia
Your data is stored in Singapore, and some providers above process it in other countries. We only use providers that protect personal data to a standard comparable with the PDPA, under written terms with each of them.
6. How long we keep it
| Data | Kept for |
|---|---|
| Your account and records | While your account is open |
| After you delete your account | Sign-in stops at once and your name and email are removed at once. Your vehicles, records, photos and documents are permanently deleted after 30 days, so we can restore them if you ask within that time. |
| Database backups | Up to 35 days, after which deleted data is gone from backups too |
| Security logs | 12 months, without your name or email |
| Nearby searches | Not saved to your account. Results are cached on our server for about 5 minutes. |
| Support emails | As long as needed to resolve your request |
7. How we protect it
- All connections are encrypted (HTTPS).
- Your files are stored privately and can only be opened through short-lived links, after we check it's you.
- Sign-in details on your phone are kept in its secure storage (Android Keystore or iOS Keychain).
- Each workspace can only see its own data, and actions are recorded in an audit log.
No system is perfectly secure. If a breach affects your personal data, we'll notify you and the authorities as the law requires.
8. Your rights
Under the PDPA you can:
- Access the personal data we hold about you and get a copy.
- Correct data that is inaccurate. Most of it you can edit in the app yourself.
- Withdraw consent or ask us to stop or limit processing, for example by turning off location or notifications in your phone's settings.
- Delete your account and data. See how to delete your account.
- Receive your data in a portable form.
Email vehicleproof999@gmail.com from the address on your account. We'll reply within 21 days, as the PDPA requires. If you're not satisfied with our answer, you can complain to the Personal Data Protection Commissioner of Malaysia (pdp.gov.my).
9. Children
VehicleProof is meant for adults who own, rent out or manage vehicles. It isn't directed at children, and we don't knowingly collect data from anyone under 13. If you think a child has given us data, contact us and we'll delete it.
10. This website
This website uses no cookies, analytics or trackers. It is hosted on GitHub Pages, which may record visitors' IP addresses for security, as described in GitHub's privacy statement.
11. Changes to this policy
If we make an important change, we'll tell you in the app or by email before it takes effect. The date at the top shows when this policy last changed.
12. Contact
FoundryOps (Mohamad Akmal bin Mohamed Abu Bakar), Malaysia
vehicleproof999@gmail.com