Privacy Policy

1. Who we are & how to contact us

Vehtra is a software platform operated by EZDevelopments, the business name of Elliott Zac Broomhall, a sole trader based in the United Kingdom. In this policy "we", "us" and "EZDevelopments" mean that business.

The Vehtra platform currently comprises two products: Vehtra Inspections (HGV inspection management, reporting and the customer portal) and Vehtra Walkarounds (daily driver walkaround vehicle checks). This policy covers both.

Business: EZDevelopments (Elliott Zac Broomhall, sole trader)
Address for service: 8 Steele Avenue, Stoke-on-Trent, ST6 7ED
ICO registration number: ZB891515 (searchable on the ICO register)
Email: info@vehtra.co.uk

2. Our role: controller and processor

Which data protection role we take depends on the data, and the distinction matters for your rights:

We are the controller for account data, billing data and operational data — the information we need in order to run the platform and our business. We decide why that data is processed.
We are a processor for the content our customers put into the platform: vehicle records, inspections, walkaround checks and anything those contain about their staff or their own customers. The operator who subscribes to Vehtra is the controller of that content. They decide why it exists and how long to keep it; we hold and process it on their documented instructions.

If you are a driver, technician or end-customer whose details appear in an operator’s records, that operator — not EZDevelopments — is the controller, and requests about that data are best directed to them. We will help them respond. Our obligations to operators as a processor are set out in our Data Processing Agreement.

3. What data we collect

Account data (we are controller)

Your name and email address.
The Firebase user ID assigned to your account.
Your organisation membership and role.
Whether your email address has been verified, and when.

Billing data (we are controller)

Subscription status, plan tier and billing period for your organisation.
Customer and subscription identifiers issued by our payment processor.

Card details are entered directly with our payment processor and are never seen by or stored on our systems.

Customer content (we are processor)

In Vehtra Inspections:

Vehicle registration numbers and details.
Customer records created by the operator.
Photographs uploaded during inspections.
Signatures captured on inspections.
Repair notes, brake test data, tyre data and similar inspection content.

In Vehtra Walkarounds:

Vehicle details — registration, make, model, type, chassis number and the site a vehicle belongs to.
Walkaround check records: odometer readings, a pass, monitor, defect or not-applicable result against each check item, and free-text notes describing any defect or item being monitored.
Named-user activity. Each check records which user started it and which user completed it, with the date and time of each. Where the operator’s staff are named users, these records show who checked which vehicle and when.

Customer content routinely contains personal data about people who are not our customers — typically the operator’s drivers and technicians, and in Inspections their end-customers. That data is provided to us by the operator, who is its controller.

Operational data (we are controller)

Request logs, including IP address and browser user-agent.
In-app activity events used to render the activity feed.
Application error and diagnostic logs.

4. Lawful basis

Where we are the controller, we process personal data under UK GDPR on the following bases: legitimate interest in running, securing and improving the platform; performance of a contract with paying customers; and consent, where we ask for it specifically.

Where we are a processor, the lawful basis for processing customer content is determined by the operator, not by us. Operators are responsible for having a lawful basis for the personal data they put into the platform, and for telling their own staff how their data is used.

5. How we use your data

To provide the Vehtra products the customer has subscribed to.
To authenticate users, verify email addresses and protect accounts.
To send transactional email — account email such as verification messages, and in Inspections, reports sent to an operator’s customers.
To take subscription payments and manage billing.
To investigate bugs, performance issues and abuse.
To comply with our legal obligations.

We do not use customer content to train machine learning models, and we do not use it for any purpose other than providing the platform to the operator.

EZDevelopments uses a small number of trusted sub-processors. We do not sell personal data and we do not share it for marketing.

Google (Firebase) — authentication and identity. Hosted in the United States; transfers protected by the UK International Data Transfer Agreement and the EU-US Data Privacy Framework where applicable.
Brevo (formerly Sendinblue) — transactional email delivery, including account verification email and inspection reports. Hosted in the European Union.
Stripe — subscription payments and card processing. Stripe receives billing contact details and handles card data directly as its own controller. Transfers outside the UK are protected by the UK International Data Transfer Agreement and the EU-US Data Privacy Framework where applicable.
Render — hosts the Vehtra backend application and database. Transfers outside the UK are protected by the UK International Data Transfer Agreement where applicable.
Vercel — hosts the Vehtra frontend application and serves pages from a global edge network, and provides the aggregate usage analytics described in section 10. Transfers outside the UK are protected by the UK International Data Transfer Agreement where applicable.

We may also disclose data where we are legally required to, or to establish or defend legal claims.

7. International transfers

Where personal data leaves the United Kingdom, EZDevelopments relies on appropriate safeguards including the UK International Data Transfer Agreement, the EU-US Data Privacy Framework or other lawful mechanisms.

8. Retention

Account and billing data is retained while your account is active and for a reasonable period after closure, including as long as needed to meet tax and accounting obligations.

Customer content is retained while the operator’s account is active, so operators can meet their own record-keeping obligations. For inspection records we retain a minimum of 18 months, exceeding the 15-month DVSA minimum; inspection records older than 18 months may be deleted periodically when appropriate. Walkaround check records are retained for the life of the operator’s account, because the operator is the controller and decides how long their defect records should be kept.

Note that archiving a record inside the platform — a vehicle, a site or a completed check — hides it from day-to-day views but does not erase it; archived records remain retrievable by the operator. Permanent deletion of an organisation’s data is carried out on request. On account closure, operators may request an export of their data before it is deleted.

9. Your UK GDPR rights

You have the right to:

Access the personal data we hold about you.
Have inaccurate data corrected.
Request erasure of your data, subject to legal obligations.
Restrict or object to certain processing.
Receive your data in a portable format.
Lodge a complaint with the Information Commissioner’s Office (ico.org.uk).

To exercise any of these rights in respect of data for which we are the controller, contact us at info@vehtra.co.uk. If your request concerns records held by an operator using Vehtra — for example checks recorded in your name by your employer — please contact that operator, who is the controller; we will assist them in responding.

10. Cookies & local storage

Vehtra uses strictly necessary browser storage only. Depending on the product, this may include:

A Firebase authentication token so you stay signed in.
Your current organisation or site selection, so the platform remembers your choice between visits.
A record that you have dismissed the cookie notice, the email verification reminder, or a subscription notice, so they are not shown to you repeatedly.

Analytics. Vehtra Inspections uses Vercel Web Analytics, which reports aggregate page views and visit counts. It sets no cookies, stores nothing on your device, does not build a profile of you and does not track you across other websites. Vehtra Walkarounds does not use analytics at all.

EZDevelopments does not use marketing or advertising cookies, and does not sell or share data for advertising. If we ever introduce non-essential cookies or tracking, this policy will be updated and consent will be sought before they are set.

11. Children

Vehtra is not directed at people under the age of 18 and is not intended for use by children. Please do not register if you are under 18.

12. Changes to this policy

Material changes to this policy will be notified by email with reasonable notice. Minor changes will be reflected by updating the "Last updated" date at the top of this page.

13. Contact

Questions about this policy, and requests to exercise your rights, should be sent by email to info@vehtra.co.uk. Email is the fastest route and the one we monitor; please use it in preference to post. Our address for service of documents is given in section 1.