Legal information

No advertising, no audience measurement, no selling — AutoCare shows no advertising, and we use no audience-measurement or tracking tool. We neither sell nor rent your data. Some Google components built into the app do, however, send Google technical data and usage statistics (see “Technical data, security and support”).

Your data is used to run the app — your vehicles, your service book, your expenses and your reminders are stored for you, in the European Union, and tied to your account.

Some features rely on outside services — sign-in (handled in the United States by Google), plate lookup, fuel prices, maps and, from version 3.1 on iPhone, subscription management (by a specialist provider in the United States, which receives your account identifier even if you have bought nothing, except in guest mode). To read a registration document, the app sends the whole photo, including the holder's name and address, to Anthropic, in the United States. On the website, the questions you type to Jo are read by Anthropic, in the United States, to write its replies. Details follow.

You stay in control — apart from what is needed to create an account, everything is optional. You can delete your account at any time, from the app or by email (see section 03).

A question, a right to exercise — write to contact@labs-autocare.com: access, rectification, erasure, objection, portability. See “Your rights”.

Email account — name (a first name is enough), email address and password. The password is hashed, that is, irreversibly transformed, by Firebase Authentication (Google): we can never read it. The password-reset email is sent by Firebase.

Sign in with Google — Google sends us your email address, your name and the link to your Google profile photo. We store your email and your name. Of the photo, we keep only the link: the image stays with Google, and the app displays it by loading it from Google's servers. If your AutoCare profile has no photo, the app takes this link again each time you sign in with Google. On Android, sign-in goes through the phone's credential manager.

Sign in with Apple — Apple sends us your email address, or a relay address if you hide yours, and your name. On iPhone, we keep only your first name. On Android, Apple sign-in opens in your browser, and we keep the full name Apple sends at the first sign-in.

Guest mode — “Start without an account” creates an anonymous guest account, with no email. The first name asked for at welcome is optional; if you give it, it is stored in your profile. What you enter is stored on our servers, just as for a regular account, under an anonymous identifier. If you later create an email account from Profile → “Create an account”, it is kept. If you instead sign in to another account, or create an account with Google or Apple, it is not transferred and stays stored under the anonymous identifier: tap “Sign out” first to erase it (see section 03).

Profile — display name, email, photo, account creation and last sign-in dates, settings (currency, distance unit, language, reminder time and day, weekly check, preferred fuel), stored on your account so that you get them back on another phone (from version 3.1 on iPhone), and monthly budget.

Technical sign-in data — at each sign-in, Firebase Authentication receives your IP address and information about your browser or device. Google uses it for security and fraud prevention.

Vehicles — name, make, model, version, year, licence plate, vehicle identification number (VIN, box E of the French registration document), fuel type, colour, category, mileage, first registration date, battery and charging.

Service book — maintenance (date, mileage, cost, garage, notes), fill-ups (litres, price, amount, station you entered), expenses and recurring expenses, reminders, mileage history. Amounts and your budget are financial data: they are used only for your own statistics.

Vehicle condition — checks you carry out, symptoms you report, and the health score computed on your phone. This information relates to the vehicle, not to its driver.

Long-standing user benefit — the first time your account is loaded, the app compares your account's creation date and that of your oldest vehicle with the reference date set in article 5 of the terms, then stores the result in your profile. From version 3.1 on iPhone, and on Android, a negative result is checked again each time you open the app and can only change in your favour. Versions 3.0.1 and 3.0.2 for iPhone still use 1 September 2026: if your account dates from September 2026, install 3.1 as soon as it is out or write to us. This calculation is used solely to grant you this benefit. If you think the result is wrong, write to us and we will check it ourselves.

Profile photo — resized and stripped of its metadata (including any location where it was taken), then stored in Firebase Storage (Google), in the European Union. A copy also stays on your phone.

Vehicle photos — they stay only on your phone: only the file path is stored with your vehicle. On iPhone, they may be included in your phone's iCloud or computer backups. The Android app does not back up its data to your Google account.

Photo taken with the camera, on Android — for your profile or a vehicle, the app receives the original photo in its temporary storage, on the phone. The last photo taken stays there until the next one, or until the app is uninstalled.

What is sent — the whole photo of the registration document, resized and without metadata. The holder's name and address, and the entry stating whether the holder owns the vehicle, therefore appear on the image sent. If you prefer, or if the document is in someone else's name, cover this information before taking the photo: reading the vehicle details does not need it.

The route — the photo goes through our server function (Google Cloud Functions, in the European Union), which processes it in memory without storing it. It is then read by Anthropic's Claude API, in the United States. On Android, a photo taken with the camera passes through the app's temporary storage, then is erased.

What is extracted — seven items only: licence plate, VIN, make, model, version, fuel type and first registration date. We instruct the AI never to pick up or return the name, the address or the ownership entry, and a filter lets only these seven fields come back. You check the record before saving it.

What we keep — nothing of the image: neither on our servers nor in our logs. AutoCare neither extracts nor stores the holder's name or address. The vehicle fields are stored only if you save the record.

What Anthropic keeps — Anthropic deletes the image and its response from its systems within 30 days. Exceptions: content flagged for breaching its usage policy may be kept for up to 2 years (the related classification scores, up to 7 years), and longer where the law requires. Anthropic does not train its models on this data.

Your location — if you allow it, the app reads your location, precise or approximate depending on the permission you give the phone, only while you are using it, never in the background. You can also search for a town or move the map.

Fuel prices — to find nearby stations, the app sends data.economie.gouv.fr, the public-data platform of the French economy and finance ministries, the coordinates of your location as they are (or those of the map centre, or of the chosen town) and a search radius. The request goes straight from your phone, without passing through our servers; as with any connection, your IP address reaches it. No account identifier is sent, and we do not keep your location.

On iPhone: Apple maps — the map, your position on the map, town search and each station's brand go through Apple's mapping services (MapKit). Apple receives the area shown, the text of your searches and the coordinates of the stations shown. Directions open in the Maps app.

On Android: Google Maps — the map is provided by Google Maps: it only loads when you open the Fuel tab, never when the app starts, and shows your position based on the phone's. Google receives the area shown, your IP address, information about the device, an identifier specific to Google Maps, your interactions with the map and, if the component crashes, a crash report. Your location is provided by Google Play location services. Town search goes through the phone's service that turns a town name into coordinates (Google). Directions open in the navigation app of your choice.

Notifications — deadline reminders are local notifications, scheduled on your phone. No server sends them to you. They are cancelled when you sign out or delete your account.

Google technical identifiers — on iPhone, versions earlier than 3.1 create an installation identifier with Google (Firebase) at launch and, if you allowed notifications, register a notification token with Google (Firebase Cloud Messaging) and Apple; version 3.1 removes this registration: install it as soon as it is available on the App Store. We do not use them and send no remote notifications. On Android, the app creates neither a Firebase installation identifier nor a notification token. Legal basis: our legitimate interest in running the app with Google's standard components.

Widgets — they show a summary (vehicles, mileage, score, next deadline, budget) stored on your phone. They do not connect to our servers.

Biometric lock — optional: Face ID or Touch ID on iPhone, fingerprint or face unlock on Android. The phone only tells the app whether the check succeeded. We never have access to your biometric data.

Offline copy — to work without a network, the app keeps a copy of your data, your preferences and your drafts on your phone.

PDF export — the PDF is created on your phone. The resale file leaves out the licence plate and the VIN by default (an option adds them). The expense report, however, shows each vehicle's licence plate. A PDF is shared only if you send it yourself.

Review prompt — the app may invite you to rate AutoCare. The prompt is shown by Apple or Google, and any review is published under your store account, without going through us. During the closed test of the Android app on Google Play, the rating and review are sent privately to the developer and are not published. Legal basis: our legitimate interest in making the app known.

On iPhone — AutoCare Plus is bought on the App Store. Apple collects the payment and manages the subscription. The app checks your purchases on the phone, with Apple. From version 3.1, it also passes them to our subscription-management provider, RevenueCat, which links them to your AutoCare account. To do so, the app connects to this provider when you open it, with your account identifier and technical information (see “Who receives your data”), even if you have bought nothing. In guest mode, the app does not open a session in your name with this provider: your purchases are still checked on the phone, with Apple.

On Android — once purchasing is offered there, AutoCare Plus is bought on Google Play (Google Play billing). Google collects the payment and manages the subscription. The app checks your purchases on the phone, with Google Play.

On our side — your subscription status is not stored on our servers. From version 3.1 on iPhone, it is stored with our subscription-management provider, RevenueCat, linked to your AutoCare account identifier. We never have access to the payment details you use in the stores. If your subscription ends, you keep all your data.

Direct refund — if we refund you ourselves (articles 2 and 7 of the terms of use), we process the bank details you give us, solely for that transfer. Legal basis: performance of the contract and our legal obligations. Proof of the refund, which may show these details, is kept for 10 years, as an accounting record. The message in which you send them to us is kept like other exchanges with support.

Professional plans and complimentary access — the Pro Fleet, Business and White label plans are billed directly by Adelem Labs. We process the company name, the customer's contact email, the licence code, the plan, the number of vehicles, the licence dates and status, the identifier of the account using it, as well as quotes, invoices and correspondence. The same licence data, without an invoice, exists for access we grant free of charge.

Anti-abuse counters — our registration-document reading and plate lookup functions count your calls over one hour. Legal basis: our legitimate interest in preventing abuse and controlling our costs.

Technical logs — our server functions (Google Cloud) produce logs: the account identifier for certain operations (account deletion, licence, certain errors) and, for each request, the date, the IP address and information about the device. They contain no plate and no image. Jo's function, however, does not record the IP address (see "Jo, the website's assistant"). Legal basis: our legitimate interest in securing the service, fixing errors and proving that a deletion took place.

Technical data from Firebase components — at each exchange with our servers, the Firebase components send Google your IP address, the app, system and component versions, and error codes. Google processes them on our behalf, to run and secure the service. Legal basis: performance of the contract.

Google's own statistics, on Android — Google Maps and ML Kit also send Google usage and performance statistics (and, for Google Maps, crash reports), with an identifier specific to each of these components (for example to count active users). Google uses them for its own purposes, including improving its services, as an independent controller, under its Privacy Policy. We do not receive these statistics. Google Maps only loads when you open the station map: legal basis, on our side, our legitimate interest in using this component to show the map you request. ML Kit is only switched on with your agreement, asked before the first odometer reading: legal basis, your consent, which you can withdraw at any time in Profile → Google services (your choice stays on the phone). A withdrawal applies straight away to the scan; statistics already collected may still be sent to Google.

Support — if you write to us (email, WhatsApp, text message) or call us, we process your contact details, your message and its attachments. The subject pre-filled from the app states its version. A WhatsApp message goes through WhatsApp (Meta), under its own rules. Legal basis: our legitimate interest in answering you, or performance of the contract if your request concerns the service.

What we keep — nothing of the content of your messages, neither in a database nor in our logs. The console of our Anthropic account also lets us view requests and their replies: we do not access it, except to diagnose a fault. Before sending, our server masks the email addresses, phone numbers, number plates, VINs and bank numbers it recognises; please still don't type personal details.

Preventing abuse — to count the day's questions, our server computes a fingerprint of your IP address with a secret key and the date; the address itself is not recorded. This fingerprint and its counter, stored in the European Union, are erased automatically the following night, at the latest 48 hours after your question. The fingerprint does not identify you: we cannot find your questions from your name or address, unless you give us additional information (Article 11 GDPR).

At Anthropic — Anthropic deletes the messages and its replies from its systems within 30 days. Exceptions: content flagged for breaching its usage policy may be kept for up to 2 years (the related classification scores, up to 7 years), and longer where the law requires. Anthropic does not train its models on this data.

Legal basis — our legitimate interest in answering the questions you choose to ask us and in protecting the service against abuse. You can object at any time (see "Right to object"); the simplest way is not to type: the buttons are always available and send nothing.

Google (Firebase, Google Cloud and Gmail) — sign-in (Firebase Authentication), storage of your data (Cloud Firestore) and of your profile photo (Cloud Storage), server functions (Cloud Functions), logs (Cloud Logging) and our inbox (Gmail), where emails sent to our @labs-autocare.com addresses arrive.

Anthropic (Claude API) — reading the registration document, only when you use that feature; Jo's replies to the questions you type on the website.

RevenueCat, Inc., our subscription-management provider (a company based in the United States) — from version 3.1 on iPhone, for every account open in the app, even without any purchase (never in guest mode): your account identifier, your purchase history (product, dates, price, store, transaction identifiers) and technical information (including a device identifier specific to our apps, the device model, the system and app versions, the languages set on the device, the country of your App Store account and the IP address), to link your purchases to your AutoCare account and check whether Plus is active on it. On Android, and on iPhone before 3.1, our servers only send it your account identifier, when the account is deleted, to erase any record in your name (never in guest mode).

IONOS — hosting of the website, receipt and forwarding of emails sent to our @labs-autocare.com addresses.

Apple — App Store (payment and subscription), Sign in with Apple, maps and the Maps app on iPhone, review prompt.

Google — Google Play (payment, subscription and review prompt), Sign in with Google, and on Android: Google Maps, Google Play location services, conversion of town names into coordinates and ML Kit statistics.

Meta — WhatsApp, if you choose to write to us that way.

French economy and finance ministries — data.economie.gouv.fr, a public platform run with Opendatasoft, which provides fuel prices and RappelConso recalls.

Google LLC (United States) — Firebase Authentication runs only in the United States. Sign in with Google, Google Maps, Google Play services, ML Kit, our technical logs, our email and, occasionally, Google's support may also involve servers outside the European Union. Safeguards: Google LLC is certified under the EU–US Data Privacy Framework, recognised by an adequacy decision of the European Commission; Google's data processing terms also provide for the standard contractual clauses, a model contract approved by the European Commission.

Anthropic (United States) — our contract is with Anthropic Ireland, Limited, and the registration document is read, and Jo's replies are written, in the United States. Safeguard: the European Commission's standard contractual clauses, included in Anthropic's data processing addendum.

RevenueCat, Inc., our subscription-management provider (United States) — from version 3.1 on iPhone, and, on Android or on iPhone before 3.1, when an account is deleted. Safeguard: the European Commission's standard contractual clauses, included in its data processing addendum.

Apple — for European users, the controller is Apple Distribution International Limited (Ireland). Transfers to Apple in the United States rely on the standard contractual clauses.

Account, profile, vehicles, service book, profile photo — for as long as your account exists. Everything is deleted when you delete your account, except for the exceptions listed in section 03.

Guest account — deleted when you tap “Sign out” or “Delete my account”. If you uninstall the app or sign in to another account without doing so, it stays stored under its anonymous identifier: as it has no email and no verified name, it cannot be found from a message.

After an account is deleted — Google erases your sign-in identifiers from the Firebase Authentication backups within 180 days at most, and its other backup copies within the same period. IP addresses recorded by Firebase Authentication are kept for a few weeks.

Technical logs — 30 days (those of Jo's function do not contain the IP address). Google Cloud audit logs, which record the project's administrative operations and may mention an account identifier, are kept for 400 days.

Anti-abuse counters — valid for one hour, then reset; deleted with the account.

Registration-document photo — on our side, for the duration of the request. At Anthropic, 30 days at most, unless flagged (see above).

Questions typed to Jo — on our side, for the duration of the request; never recorded. At Anthropic, 30 days at most, unless flagged (see "Jo, the website's assistant").

IP address fingerprint (Jo's quota) — erased automatically the following night, at the latest 48 hours after the question.

Location — never kept by AutoCare.

Plate looked up — never kept by our server function. It is stored in your vehicle only if you confirm the record. The apiplaqueimmatriculation.com service applies its own rules to its logs.

Exchanges with support — 3 years after our last exchange.

Professional licences and complimentary access — for the duration of the licence, then at most 5 years after it ends, as proof of the contract (limitation period), before deletion. Invoices: 10 years, under our accounting obligations.

Direct refund — proof of the refund, which may show your bank details, is kept for 10 years, as an accounting record. The message in which you sent them to us is kept like other exchanges with support.

Data on your phone — offline copy, vehicle photos, copy of the profile photo, exported PDFs, last photo taken with the camera on Android, widgets and preferences stay until the app is uninstalled. Deleting the account does not erase them.

Google technical identifiers — until they expire, under Google's rules.

Purchases — Apple and Google keep your purchase history under their own rules.

Data at RevenueCat, our subscription-management provider — your account identifier, your purchase history and the technical information attached to them are kept for as long as your account exists, and erased when it is deleted, from the app or at your request.

Website logs — at most 8 weeks at our host, IONOS, then deleted.

Access — find out what data we hold about you and get a copy.

Rectification — correct your data, directly in the app or by writing to us.

Erasure — in the app (a vehicle, an expense, a reminder, your photo, your account) or by writing to us. See section 03.

Restriction — freeze the use of your data, for example while a dispute is being checked.

Portability — receive, on request, your data in a structured, machine-readable format (JSON).

Objection — see “Right to object” below.

Withdrawing a permission — location, camera, notifications or biometrics: in your phone's settings, as easily as you gave it. Only the feature concerned then stops working.

Instructions after your death — see below.

Location — to find nearby stations. Precise or approximate, as you choose. Only while the app is in use, never in the background. Optional.

Camera — to read the odometer, photograph the registration document, a vehicle or your profile photo. Optional.

Photos — the app does not access your whole photo library: the system picker passes it only the photo you choose.

Notifications — to remind you of your deadlines. Optional.

Biometrics — Face ID, Touch ID, fingerprint or face unlock, to lock the app. Optional.

Step 1 — on the Today screen, tap the profile icon at the top left. The Profile screen opens.

Step 2 — at the very bottom of Profile, tap “Delete my account”.

Step 3 — if the biometric lock is on, confirm your identity.

Step 4 — when asked “Delete your account?”, tap “Delete”.

Step 5 — from version 3.1 on iPhone, and on Android: if you sign in with Apple, identify yourself with Apple one last time; the app then removes the permission given to AutoCare. Closing that window cancels the deletion.

The account's email address — if it differs from the one you are writing from. If you sign in with Apple and hide your address, give the relay address (it ends in privaterelay.appleid.com). You can find it on iPhone in Settings → your name → Sign-In & Security → Sign in with Apple, or on account.apple.com.

How you sign in — email and password, Google or Apple.

Your sign-in identity — email address, hashed password, links to your Google or Apple account, sign-in dates (Firebase Authentication).

Your profile — name, email, photo, preferences, monthly budget, long-standing user benefit, licence information recorded on the profile.

All your content — vehicles, maintenance, fill-ups, checks, symptoms, mileage history, health score, expenses, reminders and anti-abuse counters, including what remained of vehicles deleted earlier.

Your profile photo — on our servers (Firebase Storage).

Your data at RevenueCat, our subscription-management provider — your account identifier, your purchase history and the technical information attached to them (from version 3.1 on iPhone).

Scheduled notifications — on the phone used for the deletion.

Technical logs — 30 days. They may contain your account identifier, your IP address and information about the device. One of them, “Account deleted”, proves that the deletion took place. Google Cloud audit logs, which may mention an account identifier, are kept for 400 days.

Google backups — your sign-in identifiers disappear from the Firebase Authentication backups within 180 days at most, like Google's other backup copies. IP addresses recorded by Firebase Authentication are kept for a few weeks.

Registration documents already scanned — Anthropic erases them within 30 days. If flagged, it may keep them for up to 2 years (the related classification scores, up to 7 years), and longer where the law requires. We cannot speed up this deletion.

Professional licences and complimentary access — if your account had a licence, the licence record (code, plan, company, contact email, account identifier, dates, status) is kept for at most 5 years after the licence ends, as proof of the contract. Invoices are kept for 10 years, under our accounting obligations.

Direct refund — if we refunded you ourselves, proof of the refund, which may show your bank details, is kept for 10 years, as an accounting record. The message in which you sent them to us is kept like other exchanges with support.

Exchanges with support — 3 years after our last exchange.

Your purchases — Apple and Google keep your purchase history. Your subscription continues until you cancel it.

Your Apple or Google account — it is not deleted. When deleted from the app (version 3.1 or later on iPhone, and Android), an account that signs in with Apple loses the permission given to AutoCare (step 5). In other cases, the permission remains visible and you can remove it yourself: for Apple, on iPhone in Settings → your name → Sign-In & Security → Sign in with Apple, or on account.apple.com; for Google, at myaccount.google.com/connections.

On your phone — the offline copy of your data, vehicle photos, the copy of your profile photo, exported PDFs, the last photo taken with the camera on Android, widget content and preferences stay until the app is uninstalled. On iPhone, they may also be included in your iCloud or computer backups. To erase them, uninstall the app.

Google technical identifiers — the installation identifier and notification token created with Google by iPhone versions earlier than 3.1 (and by the first test versions of the Android app) remain until they expire.

Third-party services — the logs of apiplaqueimmatriculation.com (plates looked up), data.economie.gouv.fr, Apple maps and Google Maps are a matter for those services.

A vehicle — its maintenance records, symptoms and reminders are deleted with it. Its expenses, however, are kept on purpose: your expense history outlives the sale of a vehicle, and you can delete them one by one. Its fill-ups, checks and mileage history are no longer shown, but remain stored with your account until it is deleted: write to us to erase them sooner.

An expense or a reminder — from the list where it appears.

A symptom — from the symptom journal (AutoCare Plus); without Plus, it is deleted with its vehicle or your account, or on request at contact@labs-autocare.com.

A vehicle photo — on the vehicle's page, “Delete photo”. On Android, it is also erased with the vehicle. On iPhone, delete it before deleting the vehicle: otherwise it stays on the phone until the app is uninstalled.

Your profile photo — in Profile, “Delete photo”. It is erased from our servers and from the phone. If you sign in with Google, the app will take your Google photo again at the next sign-in.

Your location, camera, notifications — withdraw the permission in the phone's settings.

Odometer reading by ML Kit, on Android — withdraw your agreement in Profile → Google services.