Privacy notice

The controller is i-Appraisal, Angel Gardens, Manchester M4 4GE, ICO registration TBC: ICO registration number. For data-protection questions, or to exercise any right below, contact hello@iappraisal.co.uk.

You can also write to us at i-Appraisal, Angel Gardens, Manchester M4 4GE, or call 0161 570 0961.

In this notice “we”, “us” and “i-Appraisal” mean i-Appraisal. A “customer” is a business that has an account with us, such as an auction, dealer, rental or leasing company.

We handle personal data in two different capacities, and which one applies decides who you should ask about it.

Where we are the controller. We decide how and why we use: the account and sign-in data of everyone who uses the service; security and audit records; usage and billing records; demo requests and other enquiries sent through this website; and the details of the people we deal with at our customers and suppliers. This notice is our explanation of that processing, and you can exercise your rights with us directly.

Where we are a processor. A customer company uses the service to appraise its own vehicles. The data it puts in — registrations, walkaround video, frames and audio, photographs, documents, inspection answers, findings and appraisals, the details of its own staff, and the details of its own hire customers — is processed by us on that customer’s behalf and on its instructions. The customer is the controller of that data and decides what is collected and why.

If you were filmed during a walkaround, if you work for one of our customers, or if you are a customer’s hire customer, please contact that company first about its processing: it is responsible for it, and it will have its own privacy notice. If you contact us instead, we will pass your request to the customer and help it respond.

Account data. Your name, email address and profile picture, received from Google or Microsoft when you sign in. We store an email address only where the provider confirms it is verified. We also keep the identifier the provider gives your account, so that the next sign-in finds the same account.

Authentication data. A session cookie, and — if you enable two-factor authentication — an encrypted TOTP secret and hashed recovery codes.

Organisation and membership data. Which customer organisation you belong to, your role and permissions in it, and the branches you are assigned to. For each customer company we also hold its trading and legal name, registration and VAT details, address, phone, email and website where it has given them, the names, job titles, email addresses and phone numbers of its contacts (for example its main, accounts and operations contacts), and our own notes about the account.

Invitations. The email address someone is invited at, the role offered, who sent the invitation, and when it was sent, accepted or withdrawn. The invitation itself is emailed to that address.

Vehicle lookups. Registrations you search, and the reports returned. A registration, the MOT history and the mileage recorded against it are about a vehicle, but can be personal data when the vehicle can be linked to a person.

Uploaded media. Walkaround video and images, and anything incidentally captured in them, including number plates, premises and any person in frame. A walkaround records sound: the operator’s commentary is transcribed and analysed, and anything else within earshot may be recorded too. The same applies to recordings of an interior or mechanical pass, including spoken answers to inspection checks, and to photographs and documents added to an appraisal.

Appraisal records. The findings, grades, verdicts and prices produced from that media, the inspection answers given and who gave them, changes made to an appraisal and by whom, and the name of the person who opened it.

Hire-customer data. Where a customer shows an appraisal to its own hire customer: the email address the link was sent to, or the customer’s own reference for that person; whether they acknowledged or disputed the condition; any note they wrote; how and when they answered; and a copy of what they were shown. A hire customer who signs in to keep the link also has account data, as above.

Demo requests. If you ask for a demo on this site: your name, work email address, company and the part of the trade you work in, and, if you choose to add them, your role, your monthly volume and a vehicle registration to appraise.

Usage data. API calls, timings and cost, recorded to operate and bill the service. Each record notes the organisation, the service called, the registration involved where there was one, and how the call went.

Audit records. When one of our platform administrators opens a customer’s organisation to support it, each change they make is logged: which account acted, when, the kind of request and whether it succeeded. The content of the request is not stored. We also keep a record of each deletion made in the service: what was deleted, when, and by which account.

Technical data. The information any web server needs to answer a request, such as your IP address, browser type and the time of the request, which we use to run the service, limit abuse and investigate faults.

Communications. Emails and calls between you and us, and what they contain.

We do not ask for special category data, such as health information, and the service is not designed to process it. Please do not include any in footage, notes or documents.

UK GDPR requires a lawful basis for each use of personal data for which we are the controller. Ours are:

Providing accounts and the service

Creating and running your account, signing you in, and letting you use the service. Contract, where you are our customer; otherwise our legitimate interest, and your organisation's, in providing the service your organisation has contracted for.

Security and two-factor authentication

Protecting accounts, detecting and preventing misuse, and limiting abusive traffic. Our legitimate interest in keeping the service and our customers' data secure, and our legal obligation to secure personal data.

Usage records and billing

Recording API calls and their cost, applying daily limits, and invoicing. Contract with our customer, and our legitimate interest in charging accurately and controlling the cost of providers.

Audit of platform access and deletions

Logging what our own staff change inside a customer's organisation, and recording deletions. Our legitimate interest, and our customers', in being able to show who did what.

Customer and supplier relationships

Keeping the details of the people we deal with at customers and suppliers, and our notes about the account. Contract, and our legitimate interest in managing those relationships.

Invitations and service emails

Sending the invitation someone asked us to send, and other messages needed to run the service. Our legitimate interest, and the inviting organisation's, in giving its people access.

Demo requests and enquiries

Answering what you asked. Our legitimate interest in responding to the request you made.

Legal and regulatory

Keeping accounting records, responding to lawful requests from authorities, and establishing, exercising or defending legal claims. Legal obligation, and our legitimate interest in protecting our legal position.

We use a demo request only to arrange the demo you asked for, in our legitimate interest in answering it. It is not added to a mailing list.

We do not send marketing email, we do not sell personal data, and we do not rely on consent as a lawful basis for any of the processing above. Where we rely on legitimate interests, we have weighed them against your rights and interests, and you can ask us for that assessment. You have the right to object (section 10).

Where we act as a processor (section 2), the lawful basis is the customer’s to identify, and its own privacy notice should explain it.

The service uses an AI analysis provider to read a walkaround. Frames extracted from the video, the transcript of its audio and details of the vehicle are sent to that provider, which returns a description of the visible damage. The service then places each finding on a panel, grades it against written NAMA and BVRLA rules, and prices it from a repair matrix. Where the footage cannot settle a question, the finding is marked as needing inspection by a person rather than guessed.

The results are about the condition of a vehicle, not an assessment of any person. They are an aid for the customer’s staff, who review the findings beside the frames they came from and can add, correct or remove findings and re-appraise. Nothing is charged automatically: whether to buy, price or recharge is decided by a person at the customer.

So neither we nor, through the service, our customers make decisions about individuals based solely on automated processing that produce legal or similarly significant effects on them, within the meaning of Article 22 of UK GDPR. Where a customer shows an appraisal to its hire customer, that person can dispute the recorded condition and add a note; the dispute is recorded for the hire company, which decides what happens next. If you want a person to review an outcome that affects you, ask the company that used the service (section 2).

The AI analysis provider processes this data to return the assessment to us, as our sub-processor under a written contract. We do not use personal data from the service to train AI models of our own.

The service providers that run the service for us receive personal data in these categories:

Our hosting provider, whose servers are in Germany, in the EU. It holds everything the service stores. It also operates the mail server through which we send invitations and the notification of a demo request to our own team.

An AI analysis provider in the United States, which receives extracted video frames, the audio transcript and vehicle context to produce the damage assessment. Do not upload footage containing personal data you would not want processed by a third-party AI provider.

The DVSA MOT History service, which receives the vehicle registration to return its MOT history.

Google or Microsoft, if you sign in with them: the sign-in exchange and the email address it returns.

No vehicle-data provider other than the DVSA receives registrations today; one will be added here before it does.

We may also disclose personal data:

• within a customer's organisation, to the people that customer has given access to, and to systems the customer connects through our API or embed;
• to a hire customer, the appraisal the customer company chose to show them;
• to our professional advisers, such as lawyers, accountants and insurers, under a duty of confidentiality;
• to the police, courts, regulators or other authorities where the law requires it, or where it is needed to establish, exercise or defend legal claims; and
• to a buyer or prospective buyer of all or part of our business, under confidentiality, who would continue to use it as this notice describes.

We do not sell personal data, and we do not share it with advertisers or data brokers.

The providers we use are listed in the Schedule to our Terms of service.

Some of these providers process data outside the UK. Where a country has not been found adequate by the UK government, those transfers are made under the UK International Data Transfer Addendum to the European Commission’s standard contractual clauses, which forms part of our agreement with the provider. Our AI analysis provider processes in the United States on that basis. You can ask us for the transfer mechanism relied on for any provider.

Our hosting is in Germany. The UK government has found the European Economic Area adequate, so data held there needs no further safeguard. Google and Microsoft process sign-in data on their own infrastructure, under their own terms.

You can ask for a copy of the safeguards for any transfer by contacting us at the address in section 1. Commercial terms may be redacted from the copy.

We keep personal data only for as long as we need it. The periods below are applied by the service itself: a retention sweep runs daily and deletes records once they pass their period.

The damage assessment produced from a walkaround, along with vehicle lookups, reports and usage logs, is kept for six months from the date it was created, after which it is deleted.

Frames extracted from the video are kept with the appraisal for six months, then deleted. They are stored with the damage assessment they belong to, so a finding can be checked against the frame it cites, and go when it does. The walkaround video itself is stored the same way and deleted at the same time.

Recordings of the interior or mechanical pass, and photos or documents you add to an appraisal, are stored with that appraisal and deleted when it is.

A demo request is kept for 24 months from when it was sent, then deleted.

Account and authentication data is kept for as long as your account is open, and deleted when it is closed.

In full:

Damage assessments, their frames and walkaround video

Kept for six months from creation, then deleted.

Vehicle lookups, reports and AI analysis records

Kept for six months from creation, then deleted. When a report is deleted, everything derived from it goes with it.

Usage and API call logs

Kept for six months from creation, then deleted.

Appraisals, interior and mechanical recordings, photos, documents and inspection answers

Kept with the appraisal for as long as the customer's account is open, unless the customer deletes them sooner.

Hire-customer answers

The link sent to a hire customer expires after seven days unless the customer company chooses another period, up to 30 days. The answer given, and the copy of what was shown, are kept with the appraisal as the record of it.

Invitations

The invitation link is valid for 14 days. The record that an invitation was sent is kept with the organisation's records while its account is open.

Demo requests

Kept for 24 months from when the request was sent, then deleted.

Audit log of platform administrators' actions

Kept for 24 months, then deleted.

Record of deletions

Kept without a time limit, so that a deletion can be evidenced. It holds what kind of record was deleted, when, the registration it concerned and which account deleted it, not the record itself.

Account and authentication data

Kept for as long as your account is open, and deleted when it is closed.

Customer company details and contacts

Kept for as long as we have a relationship with that customer, and afterwards only where the law requires us to keep records.

Session

The sign-in session lasts up to seven days, or until you sign out.

Temporary files

Copies of uploaded video held on our server while it is processed are removed within seven days at most. The copy of a walkaround kept on your phone during upload is removed once the upload completes, is abandoned, or is a day old.

Correspondence

Kept for as long as needed to deal with what it is about, and afterwards only where we need it to meet a legal obligation or to establish or defend a legal claim.

Where we act as a processor, the customer company decides how long it needs its data within these limits, and can delete it sooner. When a customer’s agreement with us ends, its data is deleted as our Terms of service describe.

Access is via SSO with optional two-factor authentication. Partner embed tokens are stored hashed, never in plain text. TOTP secrets are encrypted at rest.

• Sign-in is through Google or Microsoft; we hold no passwords. Each person can add authenticator-app two-factor authentication to their own account, and until the second factor is given, a session can reach nothing but the two-factor check and sign-out.
• TOTP secrets are encrypted with AES-256-GCM. Recovery codes, API keys, embed tokens, invitation links and hire-customer links are stored only as one-way hashes; the plain value is shown once, when it is created, and cannot be produced again.
• Connections between your device and the service are encrypted in transit.
• The session cookie cannot be read by scripts on the page, is sent only over encrypted connections, and is not sent with requests that other sites make in the background.
• Each customer's data is separated by organisation. Every query for customer data is made in the context of one organisation, so one customer cannot reach another's records.
• Embed tokens are accepted only from the web address they were issued for, and expire. API keys carry scopes and daily limits. Public forms are rate-limited.
• When our own staff open a customer's organisation to support it, every change they make is logged (section 3).
• A hire customer's view of an appraisal is built from an explicit list of fields, and never includes prices.

No system is perfectly secure. If we become aware of a personal data breach that is likely to put your rights at risk, we will tell the ICO and, where the law requires it, you, and where we are a processor we will tell the customer company without undue delay.

You have the right to access your data, to have it corrected or erased, to restrict or object to processing, and to data portability. To exercise any of these, contact us at the address above. You can complain to the Information Commissioner’s Office at ico.org.uk.

In full, under UK GDPR you have the right:

To be informed

about how your data is used, which is what this notice is for.

Of access

to a copy of the personal data we hold about you, and information about how we use it.

To rectification

of data that is inaccurate or incomplete.

To erasure

of your data, where there is no longer a good reason for us to keep it.

To restrict processing

for example while a question about its accuracy is settled.

To data portability

to receive data you gave us, in a structured, machine-readable format, where we process it by automated means on the basis of contract.

To object

to processing based on our legitimate interests. We will stop unless we have compelling grounds that override yours, or need the data for legal claims.

In relation to automated decision-making

not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you. Section 5 explains why the service does not make such decisions.

To exercise a right, email hello@iappraisal.co.uk or write to us at the address in section 1. We will respond within one month, which the law lets us extend by up to two further months for complex or numerous requests; we will tell you if we do. There is no fee, unless a request is manifestly unfounded or excessive. We may ask you to confirm your identity before we act, so that we do not give your data to someone else.

For data we process on behalf of a customer company (section 2), we will pass your request to that company, which will respond as controller, and we will help it to do so.

Some rights are subject to conditions and exceptions, for example where we must keep data to meet a legal obligation. If we cannot do what you ask, we will explain why.

We set one strictly necessary cookie to keep you signed in. There is no advertising or analytics tracking, so no consent banner is required.

The cookie holds a random session identifier, lasts up to seven days, and is removed when you sign out. Nothing on this site places third-party cookies, tracking pixels or advertising tags.

The app also stores some data in your browser, in its local storage and IndexedDB, where that is needed for a feature you are using: the video of a walkaround while it uploads, so a dropped signal does not lose it; a note of an analysis that is still running, so you can return to it; and settings you choose on that device. This storage is strictly necessary to provide the service you asked for, so under PECR it does not need consent. It stays on your device, and you can clear it in your browser settings at any time, although an upload in progress would then be lost.

The service and this website are for businesses and are not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

If you are unhappy with how we have handled your personal data, please tell us first, at the address in section 1, so that we can try to put it right. We will acknowledge your complaint and tell you the outcome.

You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection, at ico.org.uk or on 0303 123 1113.

We will update this notice when what we do with personal data changes. The date at the top shows when it was last updated. If a change is material, such as a new purpose or a new category of recipient, we will tell account holders by email or in the service before it takes effect.