Privacy Policy

1. Who we are

Podiar Ltd is a company registered in England and Wales (company number 17487157), registered office Suite RA01, 195-197 Wood Street, London, E17 3NU. We are registered with the Information Commissioner’s Office (ICO) under registration number [ICO registration number].

For questions about this policy or your personal data, email hello@podiar.co.uk [or a dedicated privacy address, if one is set up] or write to us at the registered office above.

2. Our role: controller and processor

• We are the controller for the account data of people who use Podiar (dealership owners, managers and salespeople), for billing data, for enquiries sent to us through this website, and for the technical data we need to run and secure the service.
• We act as a processor for the dealership (our customer) for the content it puts into Podiar: its vehicles, the photographs taken of them, and enquiries that members of the public send to the dealership through a Podiar listing widget. The dealership decides why that data is used and is the controller of it. If you sent an enquiry to a dealer, please contact that dealer about it; we will help them answer you.

The law that applies is the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

3. What we collect

Your account

• Your name, email address and, optionally, a profile image. Accounts are created by a workspace owner on the web; the mobile app is sign-in only.
• Your password, which we store only as a one-way hash. We never see or store it in plain text.
• The dealership (workspace) and sites (garages) you belong to and your role at each.
• Sign-in sessions: when you sign in we record the session’s expiry, the IP address and the browser or device type (user agent) it was opened from. Sessions last up to 30 days.
• Your display preferences in the app.

Dealership and site details

The dealership’s name and billing email, and each site’s address, contact email, phone and WhatsApp numbers and opening hours. These are business details, but may identify an individual (for example a sole trader).

Vehicles and photographs

• Vehicle details you enter or look up: registration, VIN, make, model, mileage, price and description.
• Photographs of vehicles taken in the app (or uploaded in the dashboard), including the registration plates visible in them, and the showroom images and 360° spins we produce from them. Photographs may incidentally show people or other vehicles in the background; please avoid this where you can.
• Capture measurements. On supported phones, the app records how the phone was held for each photo (its height, angle and distance from the car, measured with the phone’s augmented-reality and, where present, LiDAR sensors), so we can match the room to the shot. These measurements contain no image of you, no location and no device or user identifier.

We do not collect your location. The app does not request location permission, and it captures photos without embedded location (EXIF) data. If you upload photos from a computer through the dashboard, any location data your camera embedded is removed from the details we store about the photo, but the original file you uploaded is kept as it was; remove location data before uploading if that matters to you.

Registration plates

Plates are detected by our own models running on our own servers. No third party is asked to find or read a plate, and we do not write plate text to our logs. Depending on the setting the dealership chooses for each showroom, plates on the finished images are blurred (the default), replaced with the dealership’s own plate panel, or left unaltered (Off). The original photographs are kept, unaltered, so that images can be produced again; they are not published.

When you look a car up by registration, we send the registration (and, for a valuation, the mileage) to our vehicle-data provider, CheckCarDetails, and keep the result for 24 hours so a repeat lookup is not charged twice.

Billing

Subscriptions are bought and managed on the web, not in the app. Payments are taken by Revolut on its own hosted checkout page. We never see or store card numbers. We keep Revolut’s references for the customer, subscription and orders, the plan, billing periods and the dealership’s billing email; Revolut receives the name and email of the person paying.

Enquiries from the public (on behalf of dealers)

If a dealership shows its stock on its own website with a Podiar widget, a member of the public can send it an enquiry: their name, email and/or phone number, their message and the vehicle they are asking about. We store it in that dealership’s workspace and pass it to the dealership. The widget sets no cookies and does no tracking; we use visitors’ IP addresses only briefly, to rate-limit requests and block abuse.

Enquiries to us through this website

When you contact us, apply to the founder programme or ask for a demo, we keep your name, email, company, phone number and message, plus which page you came from and any campaign tags in the link. We do not store your IP address with it. Booking a call on the demo page uses Cal.com (see section 9).

Notifications

If you allow notifications, the app registers a push token with Expo’s notification service and we store it with the platform and the phone’s model or device name.

Diagnostics and security

• Crash and error reports from the app and our servers (Sentry), including the device model, operating system and app version and what the app was doing at the time. We configure Sentry not to send personal data by default.
• An append-only audit log of changes made in the service (who changed what, and when), which we keep for security and to resolve disputes.
• Face ID / fingerprint unlock, if you turn it on, is handled entirely by your phone. We never receive biometric data.

We do not use advertising or analytics trackers in the app, the dashboard, the widgets or this website, and we do not sell personal data.

4. How images are made — and what we never do

Podiar does not use generative AI on your photographs. Showroom images are composited deterministically: the real car is cut out of your photo and placed, unaltered, into a room rendered to match the angle you shot from. A 360° spin is a 3D reconstruction built only from that spin’s own photographs. The only machine-learning models we use are for cutting the car out, finding plates and windows, and reconstructing spins. We do not sell your photographs or give them to anyone to train their models, and we switch off our image-segmentation provider’s storage of the photos it processes (see section 6). [confirm whether customer photos may be used, under the dealer agreement, to test and calibrate Podiar’s own models — and say so here either way]

5. Why we use it, and our lawful basis

Where we rely on legitimate interests you can object (section 10). We do not use automated decision-making that has legal or similarly significant effects on you.

6. Who processes data for us

We use the following service providers (sub-processors). Each acts only on our instructions under a written contract.

We also download open model weights from Hugging Face when building our own processing services; no personal data is sent to Hugging Face. We may share personal data where the law requires it, to protect our rights, or with a buyer if our business is sold, in which case this policy will continue to apply.

7. International transfers

Some of the providers above are based in, or may process data in, the United States. Where personal data leaves the UK we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified) or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses. [confirm the mechanism in each provider’s data processing agreement]

8. How long we keep it

• Account data: while your account exists. When you delete your account (section 11) your name, email and profile image are removed straight away and your password and sessions are deleted.
• Vehicles, photographs and images: while the dealership’s workspace is active, and for [period] after it closes, unless the dealership asks us to delete them sooner.
• Temporary processing files: deleted automatically after 7 days.
• Vehicle lookups: cached for 24 hours.
• Billing records: 6 years after the end of the financial year they relate to, as UK law requires.
• Enquiries to us: [period, e.g. 24 months from last contact].
• Audit log: kept for the life of the workspace; it records changes, not the content of photos.
• Backups: database backups roll off automatically, the oldest after [90 days].

9. Cookies and similar technologies

This website uses no analytics or advertising cookies. Its fonts are served from our own domain. The only cookie it sets is the strictly necessary sign-in cookie, if you sign in. It also uses your browser’s session storage to remember, for that visit only, that you have seen the opening animation. The demo page embeds Cal.com’s booking calendar, which may set its own cookies when it loads; see Cal.com’s privacy policy. The dashboard uses only the strictly necessary sign-in cookie. The listing widgets set no cookies.

10. Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you and get a copy of it;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to our use of it (including where we rely on legitimate interests);
• receive data you gave us in a portable format; and
• withdraw consent at any time, where we rely on consent.

To use any of these rights, email hello@podiar.co.uk. We will reply within one month. If your data is held for a dealership (for example, an enquiry you sent to a dealer), we will pass your request to that dealership and help it respond.

11. Deleting your account

You can delete your account from inside the app: Settings → Account → Delete account, then type DELETE to confirm. It takes effect immediately and signs you out on every device. Your name, email address and profile image are erased, your password and sessions are deleted and your access to every dealership is removed. The dealership’s own vehicles, photographs and listings are not deleted, because they belong to the dealership.

If you are the only owner of a dealership that still has other team members, you will be asked to transfer ownership first (or contact us). If you are the only member, deleting your account also cancels the dealership’s subscription. A dealership owner who wants all of the workspace’s data erased can ask us at hello@podiar.co.uk. The help centre has step-by-step instructions.

12. Security

Data is encrypted in transit (TLS) and at rest by our hosting providers. Each dealership’s data is kept separate, with the separation enforced in the database as well as in our code, so one dealership cannot read another’s. Photographs are shared with our processing providers only through short-lived links. Access to production systems is limited to the people who need it. No system is perfectly secure; if we become aware of a breach that puts you at risk, we will tell you and the ICO as the law requires.

13. Children

Podiar is a service for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children.

14. Changes to this policy

We will post any changes on this page and update the date at the top. If a change is significant we will also tell account holders by email or in the app before it takes effect.

15. Complaints

If you are unhappy with how we have handled your data, please contact us first at hello@podiar.co.uk. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint or 0303 123 1113.

See also our Terms of Service.