autOracle Privacy Policy
Last updated: [Date]
Who We Are
autOracle is an AI-powered vehicle diagnostic service operated by:
Registered in the Republic of Bulgaria
Company registration number (UIC): [number]
Registered address: [Full address], Bulgaria
For all privacy enquiries: management@autoracle.ai
Applicable Law and Regulatory Framework
autOracle is established in Bulgaria and operates under the EU General Data Protection Regulation (EU GDPR) 2016/679, supplemented by the Bulgarian Personal Data Protection Act.
As we actively offer our services to users in the United Kingdom, we are additionally subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 in respect of UK data subjects.
Our lead supervisory authority for EU matters is:
2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
cpdp.bg · +359 2 915 3580
UK users may direct complaints to:
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
ico.org.uk · 0303 123 1113
UK GDPR Representative
In accordance with Article 27 of the UK GDPR, autOracle is in the process of appointing a UK GDPR Representative. In the interim, UK data subjects may direct all data protection enquiries to: management@autoracle.ai
This section will be updated upon formal appointment of our UK Representative with their full name, address, and contact details.
What Data We Collect and Why
We collect only the minimum data necessary to provide our service.
4.1 Data you provide directly
Email address
Vehicle registration plate
We do not retain your registration plate beyond what is necessary to complete your report unless you have saved a vehicle to your profile.
Diagnostic information
This data is never linked to your identity or shared with third parties.
Payment information
Payment transactions are processed exclusively by Stripe, Inc. autOracle never receives, sees, or stores your card number, expiry date, or CVV. Only a Stripe transaction reference is retained by us. Stripe's privacy policy: stripe.com/privacy
Name and account details
4.2 Data we collect automatically
Usage data
Collected in anonymised or pseudonymised form where possible.
Device and technical data
IP address
Not used for profiling or behavioural targeting.
Cookies and tracking technologies
See Section 9 (Cookies) for full details.
Data Retrieved from Third Parties on Your Behalf
DVSA MOT History API
When you enter a UK vehicle registration plate, we retrieve your vehicle's complete MOT test history from the Driver and Vehicle Standards Agency (DVSA) national database. This is done solely on your instruction to generate your diagnostic report. The DVSA is an executive agency of the UK Department for Transport.
This data belongs to you. We process it only to deliver your report and do not share it with any third party.
How Long We Retain Your Data
Email address
Retained for the duration of your account or waitlist membership. Deleted within 30 days of account closure or unsubscribe request.
Diagnostic reports and history
Retained for the duration of your active account. Deleted within 30 days of account closure upon request.
Vehicle registration data
Not retained beyond the completion of your diagnostic report unless you have explicitly saved a vehicle to your account profile.
Payment records and transaction data
Retained for seven years in accordance with EU and Bulgarian financial record-keeping obligations. Card details are never stored by autOracle at any point.
Anonymous and aggregated usage data
Retained indefinitely in anonymised form for service improvement and analytical purposes. This data cannot be used to identify any individual.
Who We Share Your Data With
We do not sell your personal data. We do not share your personal data with third parties for their own marketing or commercial purposes.
We share data only with the following categories of service provider, each engaged under a written Data Processing Agreement consistent with EU GDPR Article 28:
We may disclose personal data to competent authorities, courts, or regulators where required to do so by applicable law, court order, or binding regulatory requirement. Where legally permitted we will notify you of any such disclosure.
Your Rights
Under EU GDPR and UK GDPR you have the following rights in relation to your personal data. To exercise any of these rights contact us at management@autoracle.ai. We will respond within one calendar month.
Right of access (Article 15)
You may request confirmation of whether we process your personal data and, if so, a copy of that data along with information about how it is processed.
Right to rectification (Article 16)
You may ask us to correct inaccurate or incomplete personal data we hold about you.
Right to erasure (Article 17)
You may request deletion of your personal data. We will comply unless we are required to retain it by law or for the establishment, exercise, or defence of legal claims.
Right to restriction of processing (Article 18)
You may request that we restrict processing of your data in certain circumstances, for example while a dispute about accuracy is resolved.
Right to data portability (Article 20)
Where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, commonly used, machine-readable format.
Right to object (Article 21)
You may object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
Right to withdraw consent
Where processing is based on consent you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal. To withdraw consent for marketing emails click unsubscribe in any email or contact us directly.
Rights related to automated decision-making
autOracle uses AI to generate diagnostic reports. While our AI system produces recommendations, no solely automated decision with significant legal or similarly significant effects is made about you without human oversight. You may contact us to request human review of any AI-generated output.
Right to lodge a complaint
If you believe we have processed your personal data unlawfully you have the right to lodge a complaint with a supervisory authority.
You may also complain to the supervisory authority in your country of habitual residence.
Cookies
autOracle uses cookies and similar technologies to operate and improve the service.
Essential cookies
Required for the service to function correctly including session management, security, and authentication.
Analytics cookies
Used to collect anonymous information about how visitors use autOracle, including pages visited and session duration. This helps us improve the service.
You may opt out via our cookie preference centre at any time.
We do not use advertising cookies, retargeting pixels, or any tracking technology that shares your data with advertising networks.
International Data Transfers
autOracle is established in Bulgaria, within the European Union. As an EU-based data controller we operate within the EU's internal data transfer framework for processing within EEA member states.
Some of our service providers process data outside the EU and EEA, including in the United States. Where such transfers occur we ensure appropriate safeguards are in place, specifically:
We maintain contingency transfer mechanisms independent of adequacy decisions to ensure continuity of compliant transfers in all circumstances.
Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration, including:
In the event of a personal data breach likely to result in a risk to your rights and freedoms we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, and will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
Children
autOracle is not directed at or intended for use by persons under the age of 18. We do not knowingly collect or process personal data relating to children.
If you believe a child under 18 has provided personal data to us please contact management@autoracle.ai and we will take steps to delete that data promptly upon verification.
Marketing Communications
We will only send you marketing communications — including our newsletter — where you have given explicit prior consent.
You may withdraw consent at any time by clicking the unsubscribe link in any marketing email or by contacting management@autoracle.ai.
Withdrawal of marketing consent does not affect the delivery of service-related communications such as diagnostic reports, account notifications, and security alerts, which are necessary for the performance of our contract with you.
Records of Processing Activities
In accordance with Article 30 EU GDPR, autOracle maintains internal Records of Processing Activities (RoPA). These records are available to supervisory authorities upon request. Upon appointment of our UK GDPR Representative, a copy will be held by them for UK processing activities in accordance with Article 27 UK GDPR.
Disclaimer of Liability for Diagnostic Outputs
autOracle provides AI-generated vehicle diagnostic information for guidance purposes only. All reports, assessments, and recommendations produced by autOracle are informational in nature and do not constitute professional mechanical, engineering, or safety advice.
The information provided is based on statistical data, historical vehicle records, and AI reasoning. It may not account for the specific condition, modification history, or individual circumstances of your vehicle.
autOracle does not accept liability for loss, damage, injury, or expense — whether direct, indirect, incidental, or consequential — arising from reliance on any information, report, or recommendation provided through our service.
Users are strongly advised to have any vehicle fault or safety concern inspected and confirmed by a qualified mechanic or automotive technician before undertaking repairs or continuing to operate the vehicle.
By using autOracle you acknowledge that the service is provided on an "as is" basis and that you assume full responsibility for any decisions made based on the information provided.
Changes to This Policy
We may update this Privacy Policy periodically to reflect changes in our practices, services, or applicable law. When we make material changes we will update the date at the top of this page and notify registered users by email.
Continued use of autOracle following notification of material changes constitutes acceptance of the updated policy. If you do not accept the changes you may close your account by contacting management@autoracle.ai.
Contact
Data Controller
UK GDPR Representative (Article 27 UK GDPR)
In the interim contact: management@autoracle.ai
EU Supervisory Authority
cpdp.bg · +359 2 915 3580
UK Supervisory Authority
ico.org.uk · 0303 123 1113
