Privacy Policy

This policy describes how Underhood Tales SASU ("we") collects, uses and protects personal data within the CareMyRide service, available at app.caremyride.com.

1. DATA CONTROLLER

Underhood Tales SASU Simplified joint-stock company, sole shareholder 29 rue Vincent van Gogh, 78370 Plaisir, France Company number (SIREN) 995 236 353 EU VAT number: FR 86 995 236 353 Contact: contact@underhoodtales.com

2. DATA WE COLLECT

2.1 Account Email address, display name, language, default distance unit and currency, password in hashed form.

2.2 Content you enter Vehicle details (nickname, make, model, year, engine, vehicle identification number, registration and purchase dates), odometer readings, service entries, notes, parts, invoices and uploaded documents, photographs.

A VIN is indirectly identifying personal data under the GDPR: it can link a vehicle to its owner by cross-referencing. We protect it to the same standard as your other personal data.

2.3 Service usage Number of automatic scans consumed, technical error logs, date and count of views on the share links you create.

2.4 Payment If you subscribe, payment is processed by Stripe. We neither receive nor store your card details. We keep only a Stripe customer identifier, and your subscription status and renewal date.

3. PURPOSES AND LEGAL BASES

Providing the service, managing your account and data: performance of the contract. Handling subscriptions and invoicing: performance of the contract and legal obligation. Security, abuse prevention, usage quotas: legitimate interest. Retention of accounting records: legal obligation.

We do not sell personal data and we do not run targeted advertising.

4. OPTICAL DOCUMENT RECOGNITION

When you use automatic scanning, the document is passed to an optical recognition provider through a temporary address valid for one hour. Extracted data is saved to your account.

Optical recognition is not guaranteed to be accurate. You remain responsible for checking and correcting the extracted information.

5. PROCESSORS

We rely on the following providers, each bound by a data processing agreement:

Supabase — database, authentication and file storage. Hosted in the European Union (Ireland). Vercel — application hosting. US company; transfers covered by the European Commission's standard contractual clauses. Cloudflare — domain management and inbound email routing. Resend — transactional email delivery. European infrastructure (Ireland). Make — invoice processing automation. Hosted in the European Union. WiseOCR — optical recognition of invoices. Stripe — payment processing.

This list is kept up to date. Some of these providers are established outside the European Union; the corresponding transfers are covered by standard contractual clauses.

6. RETENTION

Account and content: kept while your account is active. After account deletion: data is erased immediately from the production database. Encrypted backups are kept for no more than thirty days, then destroyed. Accounting records relating to subscriptions: ten years, as required by French commercial law. Technical logs: twelve months.

7. PUBLIC HISTORY SHARING

You can create a link letting a third party view a vehicle's service history without an account. That link exposes the nickname, vehicle details, VIN, odometer readings, completed work and total maintenance spend.

It never exposes your purchase price, your documents, your identity or your contact details.

Distributing that link is entirely your decision. You can revoke it at any time from the vehicle page; it then stops working immediately.

8. YOUR RIGHTS

You have the right to access, rectify, erase, restrict, object and port your data.

Access and rectification are available directly in the app. Erasure is available through account deletion in the settings, which permanently removes all your data and documents.

For other rights, write to contact@underhoodtales.com. We answer within one month.

You may lodge a complaint with the French data protection authority: CNIL, 3 place de Fontenoy, 75007 Paris.

9. SECURITY

Data access is partitioned per account at the database level. Documents you upload are stored privately and reachable only through temporary signed addresses. Traffic is encrypted.

No system is entirely secure. We apply appropriate technical and organisational measures and will inform you without delay of any breach likely to create a risk to your rights.

10. COOKIES

We use only cookies necessary for the service to work: keeping your session and remembering your language. No advertising cookies, no third-party analytics.

11. CHANGES

Any substantial change will be notified by email and shown to you on your next sign-in.