Privacy Policy

1. Introduction

This Privacy Policy explains how Mechd Ltd ("we", "us", or "our") collects, uses, stores, and protects your personal information when you use the Mechd mobile application and website at mechd.co.uk (together, "the Service").

Mechd Ltd is a private limited company registered in England and Wales (company number 17259958). We are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Mechd Ltd is registered with the Information Commissioner's Office (ICO) as a data controller (application reference C1953272).

By using the Service, you agree to the collection and use of information in accordance with this policy.

2. Who We Are

Data Controller: Mechd Ltd
Company number: 17259958
Registered address: Unit A, 82 James Carter Road, Mildenhall, IP28 7DE
ICO registration: C1953272
Website: mechd.co.uk
App: app.mechd.co.uk and iOS App Store (App ID: 6779783946)
Contact: info@mechd.co.uk

3. What Personal Data We Collect

3.1 Data You Provide Directly

• Email address — collected at account registration
• Password — stored in encrypted form, never accessible in plain text
• Vehicle details — make, model, year, fuel type, and mileage entered during the Service
• Symptom descriptions — text responses you provide when describing your vehicle issue

3.2 Data Collected Automatically

• Session data — authentication tokens managed by Supabase to keep you logged in
• Device information — browser type, operating system, and device type collected passively
• IP address — logged automatically by Netlify as part of standard website hosting

3.3 Audio Data — Important Notice

Mechd does not collect, store, or transmit your audio recordings. All audio analysis is performed entirely on your device using the Web Audio API. When you record a vehicle sound, the frequency analysis runs locally in your browser or app. The raw audio never leaves your device.

Only the output of that local analysis — a text label such as "Brake squeal (74%)" — is used in the diagnostic process. No audio file is transmitted to any server at any time.

3.4 Location Data

Mechd does not request or collect device location data. The Garages feature works by taking a postcode that you type in manually, which is used only to search for nearby mechanics at the moment you request it. This postcode is not stored or linked to your account.

3.5 Payment Data

Payment card details are processed directly by Stripe (web purchases) or Apple In-App Purchase via RevenueCat (iOS purchases) or Google Play Billing via RevenueCat (Android purchases). Mechd does not store, access, or retain your payment card information at any point. We retain records of transactions including amounts, dates, subscription status, and Stripe customer ID for accounting and legal compliance purposes.

4. How We Use Your Data

• To provide and manage your account — Lawful basis: Performance of a contract
• To deliver the diagnostic service — Lawful basis: Performance of a contract
• To process payments — Lawful basis: Performance of a contract
• To send transactional emails (account confirmation, password reset) — Lawful basis: Performance of a contract
• To measure advertising campaign performance — Lawful basis: Legitimate interests
• To improve and develop the Service — Lawful basis: Legitimate interests
• To protect the security of the Service — Lawful basis: Legitimate interests
• To comply with legal obligations — Lawful basis: Legal obligation

5. AI Processing and Anthropic Claude

Mechd uses Anthropic Claude (claude-sonnet-4-6) to generate diagnostic suggestions. To do this, we transmit the following information to Anthropic's API:

• Your symptom descriptions and answers to diagnostic questions
• Your vehicle details (make, model, year, mileage)
• Audio classification labels generated on your device (e.g. "Brake squeal 74%")

No raw audio is ever transmitted. No personal identifiers such as your name, email address, or account ID are sent to Anthropic.

Anthropic's servers are located in the United States. This constitutes an international data transfer under UK GDPR. We rely on Standard Contractual Clauses and Anthropic's Data Processing Agreement as the legal mechanism for this transfer. Anthropic does not use data submitted via the API to train its models. See anthropic.com/privacy.

6. Third Party Service Providers

• Supabase — Database and user authentication. Data stored in the EU (Frankfurt, Germany, eu-central-1). supabase.com/privacy
• Netlify — Website and web app hosting. Data processed in the US under Standard Contractual Clauses. netlify.com/privacy
• Anthropic — AI diagnostic processing. Servers in the US. Standard Contractual Clauses in place. anthropic.com/privacy
• Stripe — Payment processing for web purchases. PCI DSS compliant. Servers in the US under Standard Contractual Clauses. stripe.com/privacy
• Apple / App Store — iOS in-app purchase processing. Apple processes payment data for iOS purchases under Apple's own privacy policy and terms. apple.com/legal/privacy
• RevenueCat — iOS and Android subscription and entitlement management. Receives purchase event data and updates subscription status in our database. Servers in the US under Standard Contractual Clauses. revenuecat.com/privacy
• AppsFlyer — Mobile attribution and campaign measurement. Receives install timestamps, IP addresses, app open events, and purchase events including revenue value and product ID. On Android, the Android Advertising ID (GAID) is collected for precise attribution. On iOS, no individual device identifier is collected — AppsFlyer uses SKAdNetwork aggregated attribution only, with no cross-app tracking. Servers in the US under Standard Contractual Clauses. appsflyer.com/legal/privacy-policy
• Meta (Facebook) — Advertising measurement on mechd.co.uk only. The Meta Pixel and Conversions API receive anonymised event data including App Store button clicks for campaign optimisation. This applies to the marketing website only — not to app.mechd.co.uk or the iOS/Android apps. Servers in the US under Standard Contractual Clauses. facebook.com/privacy/policy

We do not sell, rent, or share your personal data with any third party for their own commercial purposes.

7. International Data Transfers

Your primary account data and vehicle information is stored in the European Union (Frankfurt, Germany) via Supabase. This does not require additional legal mechanisms as the EU has adequacy status under UK GDPR.

The following services process data in the United States. We rely on Standard Contractual Clauses as the legal basis for each transfer:

• Anthropic — receives text-only diagnostic session data, no audio, no personal identifiers
• Netlify — receives standard hosting and server log data
• Stripe — receives payment transaction data for web purchases
• RevenueCat — receives iOS and Android subscription event data
• AppsFlyer — receives install and in-app event data for attribution. Android: includes Android Advertising ID. iOS: aggregated SKAdNetwork data only, no individual device identifier
• Meta — receives anonymised event data from the marketing website mechd.co.uk only for advertising measurement purposes

Apple processes iOS in-app purchase data under Apple's own data protection framework and privacy policy.

8. How Long We Keep Your Data

• Account data — Retained while your account is active. Deleted within 30 days of account deletion.
• Diagnosis history — Retained within your account. Deleted when your account is deleted.
• Vehicle data — Retained within your account. Deleted when your account is deleted.
• Audio recordings — Never retained. On-device processing only.
• Mobile attribution data — Retained by AppsFlyer in accordance with their data retention policy. In-app event data retained for analytics and fraud prevention purposes as set out in AppsFlyer's privacy policy at appsflyer.com/legal/privacy-policy.
• Payment records — Retained for 7 years in accordance with UK financial record-keeping obligations.

9. Your Rights Under UK GDPR

You have the right to access, rectify, erase, restrict, port, and object to processing of your personal data. To exercise any right, contact us at info@mechd.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the ICO at ico.org.uk.

10. Cookies

The Mechd app and web app at app.mechd.co.uk use one cookie: a strictly necessary session authentication cookie managed by Supabase. This cookie is required to keep you logged in and cannot be disabled without logging you out. No consent is required for strictly necessary cookies under UK law.

The Mechd marketing website at mechd.co.uk uses the Meta Pixel and non-essential cookies for advertising measurement purposes. You will be asked for your consent before these cookies are set via our cookie consent banner. You may withdraw consent at any time by clicking the cookie preferences option in the footer.

11. Security

We implement appropriate technical and organisational measures to protect your personal data including HTTPS encryption on all data in transit, encrypted password storage, and EU-based database hosting. In the event of a personal data breach likely to result in a risk to your rights, we will notify the ICO within 72 hours and affected users without undue delay.

12. Children's Privacy

Mechd is not directed at children under the age of 13. We do not knowingly collect personal data from children. Contact us at info@mechd.co.uk if you believe a child has provided us with personal data.

13. California Residents — CCPA Rights

If you are a California resident, you have additional rights under the CCPA including the right to know, delete, and opt out of the sale of your personal information. We do not sell personal information. Contact us at info@mechd.co.uk to exercise your CCPA rights.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through a notice in the app before the changes take effect. The current policy is always available at mechd.co.uk/privacy.

15. Contact Us

Email: info@mechd.co.uk
Website: mechd.co.uk
ICO: ico.org.uk