Legal

Privacy Policy

Effective date: 24 August 2026
Last updated: 26 August 2026

This policy explains how RevBase collects, uses, shares and retains personal information through its mobile app, website and web app.

1. Who is responsible for your information

The data controller is RevBase Automotive Ltd, trading as RevBase, registered in England and Wales under company number 17417298, with registered office at Lantern House, Holcombe, Radstock, BA3 5DE.

2. Information we collect

Account and profile

Email address, username, display name and password credentials. Our authentication provider stores the password securely; we do not see or store it in plaintext.
An optional profile photograph uploaded after signup.
Legal-document versions and timestamps recording your Terms agreement, Privacy Policy acknowledgement and confirmation that you are at least 18.

Your username, display name and profile photograph are visible only to members who share a club with you. Members see only clubs they have in common.

Garage and vehicle records

Registration, make, model, year, description and vehicle photographs.
Tax and insurance dates and cost fields.
Manually entered service history and related notes.
MOT history requested from DVSA by a member with an active paid plan.

Your garage is private by default. If you deliberately share a vehicle with a club, members of that club can see its main photograph, make, model, description and gallery photographs. They cannot see its registration, tax or insurance details or costs, service history or MOT history.

Clubs, forums and events

Club memberships and administrative roles.
Forum posts, comments, uploaded attachments and reports.
Events you create, event responses and the vehicle selected for attendance.
Moderation actions, warnings, suspensions and complaints.
Confidential platform cases, the private case thread, case-specific account email, immutable target and membership snapshots, and supporting evidence.
A record of activity addressed to you — replies in threads you follow, mentions, and new events in your clubs — so the in-app notification inbox can show what you missed. It stores only a reference to the item and who acted, never a copy of the content, and it is only ever visible to you.

Navigation, Convoy and Track data

Location used while navigation is active, including when guidance continues on a locked phone or through Android Auto or Apple CarPlay.
Destinations, addresses or postcodes submitted for search and routing.
During a convoy, location, heading, ETA, distance, sharing choice, arrival state, SOS status and SOS-response state. You actively choose ETA-only or live-location-and-ETA sharing when joining.
Track sessions that you deliberately start, including the recorded route, speed, lap timing, calculated G-force, session details and selected vehicle.

Track sessions are private unless a member with an active Track or Pro plan deliberately shares one with a club. They can be unshared at any time.

Purchases and technical information

Subscription product, entitlement state, purchase status and app-store transaction identifiers received through RevenueCat. Apple or Google handles payment-card data; we do not receive your full card details.
App version, device and operating-system details, network information inherently processed when connecting, and limited crash diagnostics.
Website contact-form name, email address and message.

The app contains no advertising networks, behavioural marketing trackers or third-party analytics. Our marketing website offers one optional, consent-based advertising cookie, described in section 10; nothing loads unless you accept it. We do not intentionally collect special-category information. Do not include sensitive personal information in open text or community posts.

Ordinary uploaded photographs have embedded EXIF metadata, including GPS metadata, stripped before storage. Evidence submitted to a confidential platform case is the exception: RevBase keeps the exact original bytes and a SHA-256 hash for evidential integrity, while the normal case viewer uses a separate metadata-stripped copy. Original access is restricted to the RevBase team and is specifically audited.

3. Why we use information

We use personal information to:

create and secure accounts and provide the Service;
operate private garages, clubs, forums, events, navigation, Track and Convoy features;
show information that a user deliberately shares with an authorised club audience;
supply and administer paid membership subscriptions;
send verification, password-reset, security, legal, subscription and essential service notices;
answer support, privacy and safety enquiries;
investigate reports, prevent abuse and enforce our Terms and Community Standards;
diagnose faults and maintain security and reliability; and
comply with legal, regulatory and accounting obligations.

Our principal lawful bases under UK data-protection law are:

contract, where processing is necessary to provide an account, requested feature or paid membership subscription;
legitimate interests, where necessary to secure and improve RevBase, administer the community, answer users and prevent abuse, balanced against users' rights;
consent, where required for device permissions or optional processing; and
legal obligation, where we must keep, disclose or act on information by law.

You can withdraw a device permission through your device settings. The affected feature will then stop working. Where Mapbox permits optional usage telemetry, RevBase will provide an in-app opt-out control.

4. Who receives information

We do not sell personal information. We use the following services and recipients only as needed to operate RevBase:

Supabase — database hosting, authentication and backend services.
Cloudflare — website delivery, security, Workers and private R2 media storage.
Mapbox — maps, route calculation and turn-by-turn navigation; it processes location and route information while those features are used.
OpenStreetMap/Nominatim — mapping data and address or postcode search.
Sentry — limited crash reporting containing a pseudonymous account ID, device and OS details and screen names. We configure it not to send email, precise location, user content, screenshots or session replay.
Resend — account verification and password-reset email delivery.
RevenueCat — subscription status and entitlement management.
Google (Firebase Cloud Messaging) — delivery of push notifications to your device, if you turn them on. It receives a device token and the notification text. That text is deliberately generic — "New reply in a thread you follow" — and never contains the content, title or author of what prompted it. Turning push off, or never turning it on, means no device token is stored and nothing is sent.
Apple and Google — app distribution, subscription purchase, renewal, cancellation and refund processing.
DVSA — receives the registration of a vehicle when a member with an active paid plan deliberately requests an MOT lookup. It does not receive the member's RevBase identity from that request.
Meta Platforms Ireland Limited — only if you accept the optional advertising cookie on our marketing website, and only there; see section 10. Meta acts as an independent controller of the pixel data it receives, under Meta's privacy policy.

Service providers may process information outside the United Kingdom. Where UK law requires it, we use an applicable adequacy regulation or contractual transfer safeguard. Provider locations and safeguards are reviewed as part of our supplier management.

Information is also disclosed to other members only within the sharing rules described in this policy. We may disclose information where required by law, to protect someone from harm, to investigate unlawful activity, or in connection with a business reorganisation subject to appropriate safeguards.

5. Location information

Ordinary navigation uses location only while navigation is active. Convoy location sharing continues in the background only while the user remains in the active convoy and ends when the user leaves or the convoy ends.

Live convoy visibility depends on the member's active sharing choice and convoy role. The join screen explains the audience. An active SOS may make the sender's full live location visible to convoy members so they can respond.

Leaving a convoy removes that member's live roster and location record immediately. Ending a convoy immediately ends live visibility and rejects further uploads. Residual convoy location and SOS-response records are automatically deleted approximately 24 hours after the convoy ends.

Track Mode creates a saved location trace only after the user deliberately starts a session. A saved Track session remains until the user deletes it or deletes the account.

6. How long we retain information

Active accounts: account, profile, garage and user content remain while the account exists, unless the user deletes an item earlier.
MOT history: remains while the vehicle is stored, but is deleted when the vehicle is deleted or its registration changes. Minimal lookup-quota records contain no registration and are deleted after two days.
Convoy: a departing member's location is deleted immediately. Records remaining after convoy end are deleted approximately 24 hours later.
Track: saved until the user deletes the session or account.
Notification history: records of replies, mentions and new events shown in the in-app inbox are deleted 90 days after they occur.
Platform cases: case messages, snapshots and evidence are normally retained for 180 days after closure. An active appeal, police request, legal dispute or legal obligation may place the case on hold and extend that period.
Push device tokens: stored only while push notifications are enabled on that device, and deleted when you sign out, turn them off, or uninstall the app.
Paid-plan expiry: each feature the plan covered keeps working for 14 days, except MOT features, which stop immediately. After 90 days, gallery photos beyond the main vehicle photo, the stored MOT copy and raw Track traces are deleted where the current plan no longer includes them. Vehicles, main photos, service history and lap times remain while the account exists.
Support, privacy and complaints correspondence: two years after the issue is closed, unless required longer for a dispute or legal obligation.
Security and diagnostic records: only for as long as reasonably needed to investigate and prevent faults or misuse, subject to configured provider retention.
Subscription and legal records: for as long as reasonably required to administer the subscription, meet accounting or legal obligations, or resolve a dispute.

When an account is deleted, we delete the profile and profile photograph, vehicles and vehicle photographs, tax, insurance, service and MOT information, Track sessions, club memberships and event responses. Forum attachments are deleted. Forum post and comment text may remain attributed to Former member so discussions continue to make sense. Existing event listings may remain, disconnected from the deleted account. A club is transferred to another admin where one is available.

Deleted information may remain in encrypted backups for up to 30 days before being overwritten. Limited information may be retained where lawfully required for security, fraud prevention, disputes or enforcement.

7. Your rights

Depending on the circumstances, UK data-protection law gives you rights to:

receive information about our processing;
access your personal information;
correct inaccurate or incomplete information;
request erasure;
restrict or object to processing;
receive information you provided in a structured, commonly used and machine-readable format; and
withdraw consent without affecting earlier lawful processing.

You can edit much of your information, delete your account and use the available export feature in RevBase. For anything else, email contact@revbase.co.uk. We normally respond within one month and may ask for proportionate identity evidence where reasonably needed.

MOT history is a copy of DVSA's official record. We cannot alter the source record; contact DVSA or the testing garage about an error. You can delete RevBase's copy.

You may complain to the Information Commissioner's Office at ico.org.uk, although we would appreciate the opportunity to resolve the issue first.

8. Security

We use measures designed to protect information, including encrypted connections, provider-managed encryption at rest, row-level database controls, server-side permission checks, private media storage, signed media access and removal of photograph metadata. No system is completely secure.

If a personal-data breach requires notification, we may contact affected users by email and in-app notice and will notify the ICO where legally required.

9. Users aged under 18

RevBase is intended only for people aged 18 or over. Signup requires an age confirmation, but that confirmation is not formal age verification. If you believe a person under 18 is using RevBase, contact contact@revbase.co.uk.

We assess and manage risks to children under the Online Safety Act because an age statement alone may not prevent access.

10. Device storage, cookies and website technologies

RevBase stores necessary information locally to keep users signed in, maintain security and cache content. The web app uses only necessary storage or cookies for operation and authentication, and contains no advertising or analytics technology.

Our marketing website, revbase.co.uk, sets no cookies by default and asks before setting any. The one optional cookie is the Meta (Facebook) pixel, used for advertising: it lets us show RevBase adverts, on Meta's platforms, to people who have visited the website. It loads only if you choose Accept on the cookie banner. If you accept, Meta receives the pages you visit on our website, standard technical information about your browser, and a cookie identifying it, and processes that data as an independent controller under Meta's privacy policy. If you decline, or ignore the banner, no advertising cookie is set and the website makes no third-party requests. The legal basis for this cookie is your consent, and you can withdraw it at any time using the Cookie choices link in the website footer; your choice is stored on your device only. The mobile app contains no advertising or analytics pixels of any kind.

11. Changes to this policy

We review this policy when our services, suppliers or legal obligations change. We will update the date above and notify users in the Service of material changes. Where a change materially affects how information is used, we will request renewed acknowledgement or consent where required.

12. Contact

Privacy questions and requests: contact@revbase.co.uk

RevBase Automotive Ltd, trading as RevBase
Company number: 17417298
Registered office: Lantern House, Holcombe, Radstock, BA3 5DE