WheelPass privacy policy
Last updated: [date]
In short: we collect what we need to connect learners with instructors, book and record lessons, and keep people safe. We do not sell your data. We do not show learners an instructor's home postcode, or instructors a learner's full address before they approve a lesson. You can download your data or delete your account in the app at any time.
[A shorter version for 16 and 17 year olds is at the end.]
1. Who we are
[Business name], [company number], [address] is the controller of your personal data. We are registered with the ICO: [registration number]. Contact: [privacy email].
2. What we collect, and why
| What | Why | Our legal reason |
|---|---|---|
| Your name, email address, and that you are a learner or an instructor | To run your account and sign you in | We need it to provide WheelPass to you (contract) |
| Learners: date of birth, learning stage, transmission, the district (the first part) of the postcode you search | To check you are 16 or over, tell instructors if you are under 18, and show relevant instructors. We do not keep the full postcode you search with | Contract; protecting children |
| Learners: pickup address for each lesson | So your instructor knows where to collect you. Your instructor sees only the district until they approve the lesson | Contract |
| Learners: practical test date and centre | To remind you. Only your instructor can see it, and only if you choose | Your consent |
| Learners: theory practice answers, mock test results, saved questions | To show your progress and practise | Contract. Shared with an instructor only if you choose |
| Instructors: profile (photo, bio, languages, rate), the districts you cover, your availability, your car (registration, make, model; MOT and tax status), your base postcode (never shown to learners) | To list and run your business | Contract |
| Instructors: ADI number, badge type, expiry and a photo of your badge | To check you are on the DVSA register. The photo is deleted soon after we decide; we keep the decision, the ADI number and the expiry | Safety and protecting children; legal duties |
| Instructors: bank account details | So learners can pay you. Encrypted. Only learners connected to you can see them, and we log every time they are shown | Contract |
| Lessons, requests, payments you say you made and that were confirmed, refunds | The record of what was booked and paid. We never hold money | Contract; keeping records |
| Messages in the app | So you and your instructor or learner can talk. We do not read them. A small number of trained staff can read a conversation that has been reported, and we log it | Contract; safety |
| Reviews and replies | Help others choose | Legitimate interests |
| Reports, blocks and suspensions | Safety | Legitimate interests; protecting children |
| Which version of our terms, this policy and the guidelines you accepted, and when | To show what you agreed to and to ask you again when they change | Legitimate interests; legal duty |
| Notifications and your notification settings; your phone's push token | To tell you things (lesson reminders, requests, payments) and respect what you choose | Contract; your consent for optional ones |
| How often features are used (counts only, for example "searches today") | To understand how WheelPass is used. These counts are not linked to you | Legitimate interests |
| Technical errors (from Sentry) | To fix faults. We try not to send personal details | Legitimate interests |
We never collect your driving licence number.
3. Who we share it with
- Your instructor or your learner, as described above, and only after you are connected.
- Other users see only what is public: an instructor's profile and reviews (first name and initial).
- Our service providers (processors), who act only on our instructions: Cloudflare (hosting and storage), Google (Firebase sign-in and App Check; address suggestions), Expo (push notifications), Resend (email), Sentry (error reports). The DVLA's vehicle service and postcodes.io are asked for a car registration or a postcode district, nothing more.
- The authorities, if the law requires, or if we believe a child or adult is at risk.
- We do not sell your data and we do not use it for advertising.
Some of these providers are outside the UK. [Describe the safeguards, for example the UK addendum or adequacy decision, for each.]
4. How long we keep it
| Data | How long |
|---|---|
| Your account details | While you have an account. When you delete your account your name and email are replaced and your sign-in record is deleted |
| Chat messages | 12 months after your connection ends |
| Records of lessons and payments | 6 years (the other person needs the record). After you delete your account they stay without your name |
| Badge photos | Deleted shortly after the decision |
| Notifications | 90 days |
| The record of which version of our terms and policies you accepted | Kept after you delete your account, without your name, as evidence of what was agreed |
| Theory answers | While you have an account |
| Admin audit logs | 2 years |
| Reports and safety records | As long as needed for safety; if someone is suspended or banned we keep what we need to stop them returning |
If something is under a legal hold, we keep it until the hold ends.
5. Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, and you can complain to the ICO (ico.org.uk). In the app: Home (learners) or Profile (instructors) → Privacy and your data lets you download your data and delete your account. For anything else, write to [privacy email]. We answer within one month. Your date of birth can only be changed by us, because it decides what you can do.
6. Safety and security
Bank details are encrypted. Staff only see what they need, and what they look at is logged. Requests to our servers must come from our apps. We have a written procedure for data breaches and will tell you and the ICO if one affects you.
7. Cookies
The WheelPass apps do not use cookies. Our website uses only what it needs to work and does not use advertising or tracking cookies.
8. Changes
We will tell you in the app before important changes. The latest version is always at [website]/privacy.
The short version for 16 and 17 year olds
You are old enough to use WheelPass, and your privacy matters just as much.
- We only ask for what we need. Your name, email, birthday (to check your age), where you want lessons, and where to pick you up.
- Your instructor knows you are under 18. That is so they can look after you properly.
- Your home address is private. Only your instructor sees it, and only after they approve a lesson.
- Messages stay in the app. Instructors are not allowed to contact you privately outside it. If anyone does, or if anything makes you uncomfortable, tap Report. You can also Block them. They are not told.
- If you are ever in danger, call 999.
- We never sell your information or use it to advertise to you.
- You are in control. You can see your data and delete your account in the app any time, under Privacy and your data.
- You can choose whether your instructor sees your theory progress and your test date.
- You can talk to a parent or carer about using WheelPass. We think that is a good idea.