Privacy Policy

Stamp & Key Ltd trading as VanStamp ("we", "us") provides a web app that helps businesses manage their vehicles, drivers, shifts, fuel, expenses and compliance dates. This policy explains what personal data we handle, why, and what your rights are.

VanStamp is a trading name of Stamp & Key Ltd, a company registered in England and Wales (Company Number: 17495132). Registered office: 100 Wodensfield Towers, Plym Close, Wolverhampton, WV11 1QR.

Privacy and data requests: privacy@vanstamp.co.uk | General contact: hello@vanstamp.co.uk | Security reports: security@vanstamp.co.uk

Registered office: 100 Wodensfield Towers, Plym Close, Wolverhampton, WV11 1QR

1. Our two roles

We handle personal data in two different ways.

As a controller, we decide how and why we use the data. This covers visitors to our website, people who contact us, the account holders (usually office managers) who sign up for VanStamp, including their billing details, and the checks we make when a company asks us to verify it.

As a processor, we handle data on behalf of our customers. When a business uses VanStamp, it enters information about its vehicles and drivers. That business is the controller of its drivers' information and decides what to record. We process it only to provide the service and on the customer's instructions, as set out in our Terms of Service (Schedule 1).

If you are a driver using VanStamp through your employer, your employer is responsible for the information about you in the app. Please contact them first about your data. We will help them respond to you.

2. What we collect

Website visitors and enquiries: name, email, company, number of vehicles and the content of your message when you use our contact form; basic technical data such as IP address and browser type, needed to keep the site secure.

Chatting with Viki, our website assistant: the messages you type and the page you're on, sent to write Viki's replies. We keep each question and Viki's answer, with email addresses and phone numbers removed and without your name, to see what people ask, improve the answers and limit how many questions can be asked; your internet address is kept only as a scrambled code for those limits. If you ask Viki to pass you to our team, we save the details you give (name, email and any company, phone number, number of vehicles and note) with a copy of the chat, as an enquiry. Please don't type sensitive personal information into the chat.

Account holders (office users): name, email address, company name, password (stored in protected form, never in plain text), and subscription and billing status. Card payments are handled by Stripe. We do not see or store your card number.

Information customers and drivers enter into the app:

• Vehicles: registration, make, model, photos, mileage, MOT, insurance, road tax, breakdown cover and service dates
• Drivers: name, email, mobile number, date of birth, address, nationality, driving licence number, issue date and category, next of kin and emergency contacts
• Driver activity: shifts (start and end times, start and end mileage and odometer photos); daily vehicle checks (the result the driver marked for each item, their notes, whether they said the vehicle was safe to drive, and the photos, including a photo of the engine bay on every check); fuel stops, including AdBlue, with pump, odometer or receipt photos; expenses and receipt photos; issue reports with photos and messages; time-off dates; notes sent to the office; requests to update vehicle photos
• Information worked out from those records, such as shift length, weekly shift totals, miles per shift, each vehicle's current mileage, and whether a vehicle has had its daily check today
• Photo details: when each photo was taken, when it was uploaded, and how it was taken (in-app camera, phone camera or chosen from the gallery)
• Details read from receipts and documents: for example supplier name, supplier VAT number, amounts and VAT, dates, insurer, policy number and expiry dates
• Work badges (if the company uses them): badge photo, job title, employee number and badge expiry date, and the company's logo and contact details (phone, email, website and, if the company chooses to show it, trading address)
• Certificates and qualifications a team member adds (for example a Driver CPC or CSCS card): the photo or PDF exactly as uploaded, its name, an expiry date if they add one, and whether it is shown when their badge is scanned or kept private
• Team members without a company vehicle (for example office staff): name, email, mobile number, emergency contacts, and a work badge if the company gives them one
• Fuel cards: provider, last four digits, and a PIN, which is encrypted before it is stored
• Documents uploaded by the customer (for example MOT certificates, insurance documents, V5s, driving licence copies and invoices)
• An audit log of actions taken in the app

Company verification: if a company adds its company type and number, we store them and show a link to the company's record on Companies House. If the company asks us to verify it, we look it up on Companies House, the UK's public register of companies, and store the company's status, registered name, registered office and incorporation date, and the name of the current officer that matches the account holder's name. We re-check the company every month.

MOT records: to show each van's MOT history and keep its MOT date up to date, we send the van's registration number, and nothing else, to the MOT History service run by the Driver and Vehicle Standards Agency (DVSA), the UK government body that keeps MOT records. We store what it returns about the vehicle (make, model, colour, test dates, results, mileage readings, defects and any outstanding safety recall) with that van, and check again at most once a day. Vans in demo accounts are never sent.

We do not track vehicle or driver location, and we remove location and device details from every photo before it is stored.

3. Why we use it and our lawful basis

We do not sell personal data. We do not use it for advertising.

4. Who we share it with

We use trusted service providers ("processors") to run VanStamp. They may only use the data to provide their service to us.

• Hosting, database and file storage: Supabase, Inc., on Amazon Web Services servers in Ireland (EU), arranged for us through Lovable Cloud
• Website delivery and security: Cloudflare, Inc., which serves our pages and protects the service from attacks
• Payments: Stripe Payments Europe, Ltd. and Stripe, Inc., which process card payments and subscription billing
• Email delivery: Amazon Web Services (Amazon SES), used by Lovable's managed email service to send our emails
• Automatic reading of photos and documents (odometer and pump photos at fuel stops and at the start and end of shifts, receipt photos, and documents the office uploads such as insurance certificates): OpenAI, L.L.C., reached through the Lovable AI Gateway. Only the individual photo or document is sent, for reading. OpenAI's API terms state that data sent through its business API is not used to train its models. Readings are shown to the driver or office user to check; drivers can retake the photo or, if their company allows it, correct the figure.
• Viki, the website assistant: OpenAI, L.L.C., reached through the Lovable AI Gateway, writes Viki's replies from the messages you type. OpenAI's API terms state that data sent through its business API is not used to train its models.

We may also share data where the law requires it, or to protect our rights, or if the business is sold (with the same protections).

Within a customer's account, its own office users can see its records. Each driver can see their own records and any problems the office has logged on the vehicle assigned to them. So that drivers know about defects before driving, a driver can also see a short summary (type, severity, whether the vehicle can be driven, description and date) of open problems other drivers have reported on the vehicle assigned to them. Drivers cannot see other drivers' messages or other records.

Work badge checks. If a company uses work badges, each badge has a QR code so customers can check it. Anyone who scans the code sees a page on our website showing whether the badge is valid, the person's badge photo, name and job title, the employee number, the badge expiry date and the time of the check. It also shows the company's name, logo and the contact details the company has added (phone, email, website, and its trading address only if the company chooses to show it), and a link to the company's Companies House record if the company has added its company number. For companies we have verified, it also shows the registered name, registered office, incorporation date and register status taken from Companies House. If the person has chosen to show any certificates, the page lists them by name, says if one has expired, and lets the visitor open the document. The page shows no home address, personal phone number, personal email address, date of birth, licence or vehicle details, and it never names the officer we matched. If a badge has expired or been switched off, the page says it is not valid and no longer shows the person's photo or name. Each badge link is a long random code, the page is not listed by search engines, and the company can switch a badge off at any time. A badge holder can also send their own badge link to someone, for example a customer they are visiting.

Exports. Office users can download reports (for example transactions, shift reports and daily vehicle checks) as CSV files or as PDFs with the company's details. Daily check PDFs include the check photos. Once a report is downloaded, it is held by the customer, who is responsible for keeping it secure.

5. Transfers outside the UK

Our database and files are held in Ireland (EU), which the UK recognises as providing adequate protection. Some of our providers are based in the United States and may process data there:

• Cloudflare, Inc. — UK International Data Transfer Addendum to the EU standard contractual clauses
• Stripe, Inc. — UK International Data Transfer Addendum to the EU standard contractual clauses
• Amazon Web Services, Inc. — UK International Data Transfer Addendum to the EU standard contractual clauses
• OpenAI, L.L.C. — UK International Data Transfer Addendum to the EU standard contractual clauses
• Lovable (Lovable Labs Incorporated) — UK International Data Transfer Addendum to the EU standard contractual clauses

6. How long we keep it

• Active accounts: for as long as the customer's account is active. When a photo or document is replaced or deleted inside an account, the earlier version is kept with the account's records so the history stays complete, and is deleted with the rest of the account's data.
• After an account closes: the customer can export their data. We then delete it within 30 days, apart from encrypted backups, which are removed on their normal cycle within 90 days.
• Billing and tax records: 6 years, as UK tax rules require.
• Enquiries: 12 months after our last message.
• Questions asked to Viki: 90 days.
• Security logs: 90 days.

7. How we protect it

• Data is encrypted in transit.
• Fuel-card PINs are encrypted before storage, are shown only to the assigned driver, and every reveal is logged.
• Photos and documents are stored privately and opened only through short-lived, signed links.
• Location and device details are removed from photos before they are stored.
• Daily check photos can only be taken with the camera at the time, which helps the customer trust them as evidence; they cannot be chosen from the phone's gallery.
• Emails about urgent vehicle problems contain no photos or photo links; the details can only be opened after signing in.
• Each company's data is separated from every other company's, and drivers can only access their own records and the limited information about their assigned vehicle described in section 4. This is enforced in the database, not just on screen.
• Access to accounts is by password, and we check new passwords against known leaked passwords.

No system is perfectly secure. If a breach affects your data, we will tell the affected customer without undue delay so they can meet their own legal duties, and we will notify the ICO where required.

8. Your rights

Under UK data protection law you can ask to: see your data, correct it, delete it, restrict its use, receive a copy in a portable format, and object to certain uses. You can also withdraw consent where we rely on it.

For data we hold as controller (account, billing, enquiries), contact us at privacy@vanstamp.co.uk. For data held on behalf of an employer, contact the employer first; we will help them respond.

We aim to reply within one month. If you are not happy, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

9. Cookies and similar technologies

We use only what is needed to keep you signed in, run the app and secure the service. See our Cookie Notice.

10. Children

VanStamp is a business tool for adults. It is not intended for anyone under 18.

11. Changes

We may update this policy. For significant changes we will tell account holders by email or in the app. The date at the top shows the latest version.