Your vehicle archive should stay yours.

Effective date: October 7, 2026. This policy applies to the Homologate website, web app, Android app, and shared reports.

1. Who is responsible for your data

Practical Logic LLC, a Virginia limited liability company ("Practical Logic," "we," "us"), is the business responsible for personal information processed through Homologate (the "controller" under the GDPR). The service providers listed below process data on our behalf under their own security programs and data processing terms. Contact: support@homologate.app.

2. Information we collect

• Account information: email address, password (stored by Supabase only as a salted hash; we never see it), display name, and account timestamps.
• Sign-in provider information: if you use Google or Facebook, the basic profile details described in Section 4.
• Vehicle archive content: VIN, registration details, year, make, model, specifications, service and project records, mileage, costs, supplier and workshop details, notes, photos, documents, and other information you choose to add. Photos are resized and re-encoded on your device before upload where your browser or device supports the format, which removes embedded metadata such as GPS location; the photo's capture date may be read and stored with it.
• Sharing information: share links you create and email addresses of collaborators you invite.
• Technical information: IP address, browser and device details, and request and error logs generated when you use the Service.
• Support communications: anything you send to support@homologate.app.
• Billing information: for optional paid plans, subscription and invoice identifiers, amounts, currency, payment status, benefits, and billing notices. Payment details are entered directly into Stripe.

We do not use analytics, advertising, or cross-site tracking tools. The web app uses only essential cookies to keep you signed in, and browser local storage for preferences and a device copy of your garage. The Android app keeps an account-scoped copy of your garage on the device for offline use.

3. How we use information

• To create and secure your account and sign you in.
• To store, sync, display, and export your vehicle archive, and to share it with the people you choose.
• To provide features you request, such as VIN lookups, recall checks, document scanning, and reminders.
• To send transactional and security email. We do not send marketing email.
• To prevent abuse, enforce rate limits, troubleshoot errors, and keep the Service secure.
• To respond to support requests and comply with legal obligations.
• To process optional subscriptions, enable purchased benefits, recover failed payments, and manage account limits.

We do not sell or rent personal information, share it for cross-context behavioral advertising, or use your content to train artificial intelligence models.

4. Signing in with Google or Facebook

Google and Facebook sign-in are optional. When you choose one, you are redirected to Google or Meta to sign in, and that provider asks you to approve sharing basic profile information with Homologate. The sign-in exchange is handled by Supabase Auth on our behalf.

• What we receive: your name, email address, profile photo URL, and the unique account identifier the provider assigns to you. We request only the basic sign-in permissions (Google: openid, email, profile; Facebook: email and public_profile).
• What we never receive: your Google or Facebook password, contacts, friends list, posts, messages, calendar, files, or other account content. Homologate cannot post on your behalf.
• How it is used: only to create and sign in to your Homologate account and to show your name or email in the app. It is stored by Supabase with your account.
• Google user data: Homologate's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Disconnecting: you can remove Homologate's access from your Google account connections or Facebook's Apps and Websites settings. Disconnecting stops future sign-ins through that provider but does not delete your Homologate data; to delete it, follow the steps on the account deletion page.

5. Service providers and what each one handles

We use the following providers to operate Homologate. Each receives only the data needed for its role and handles it under its own privacy policy and, where offered, a data processing agreement with Practical Logic LLC.

6. When information is shared

• With service providers listed above, to operate the Service.
• With people you choose: anyone holding a share link you create can view that report until it expires (new links expire after 30 days) or you revoke it; collaborators you invite can access the vehicles you share with them. Original photo downloads are off unless you enable them.
• For legal reasons: when required by law, subpoena, or court order, or to protect the rights, safety, or security of users, the public, or Practical Logic LLC.
• In a business transfer: if Practical Logic LLC is involved in a merger, acquisition, or sale of assets, subject to this policy.

7. Retention

We keep your account and archive while your account is active. When you delete your account, your account, profile, vehicles, records, share links, collaborator entries, and uploaded files are deleted from our active systems right away. Residual copies in provider backups and operational logs are removed as they expire, per the vendors' log retention policies and backup schedules. Emails already delivered to recipients remain in their inboxes. We may keep limited information longer when required for security, abuse prevention, or legal obligations.

A failed subscription payment does not delete your account or vehicle record text. After the renewal grace period, over-limit stored media has a 90-day retention window following downgrade. Automatic media deletion is currently disabled; any future removal requires a specific file list, a deadline, and at least 30 days of advance notice. Stripe may retain transaction and billing records after account deletion to meet financial, security, and legal requirements. Files can be downloaded from Account Billing, separately from the metadata JSON export.

8. Security

Data is encrypted in transit, stored with providers that encrypt data at rest, and protected by row-level access controls so each account can reach only its own data. No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant authorities as required by law.

9. Your choices and rights

Everyone who uses Homologate can:

• Access and export account data from the Account page (JSON export of your profile, vehicles, records, media metadata, share links, and collaborators).
• Correct information directly in the app.
• Delete individual records, files, or the entire account from the web app or the Android app.
• Contact support@homologate.app for anything you cannot do yourself.

We respond to requests within 30 days, or sooner where required, and may need to verify your identity, usually by confirming control of the account email. You can use an authorized agent where the law allows. We will not discriminate against you for exercising any privacy right.

10. Additional rights for users in the EEA, UK, and Switzerland (GDPR)

We process personal data on these legal bases: to perform our contract with you (providing the Service); our legitimate interests (securing the Service, preventing abuse, and improving reliability), balanced against your rights; your consent (optional social sign-in), which you can withdraw at any time; and compliance with legal obligations.

You have the right to access, rectify, erase, restrict, or object to processing of your personal data, the right to data portability, and the right to lodge a complaint with your local data protection authority. Our providers may process data in the United States and other countries. Where required, those transfers rely on safeguards such as the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework, as provided in each vendor's data processing terms.

11. Additional rights for California residents (CCPA/CPRA) and other U.S. states

In the past 12 months we have collected these categories of personal information: identifiers (email, name, account IDs, IP address); customer records you provide; internet or network activity (request logs); and audio or visual information (photos you upload). Sources are you, your device, and the sign-in provider you choose. We use them for the business purposes described in Section 3 and disclose them only to the service providers and recipients described in Sections 5 and 6.

We do not sell or share personal information as those terms are defined by California law, and we have no actual knowledge of selling or sharing information of consumers under 16. We use sensitive personal information, such as account credentials, only to provide the Service you request. California residents may request to know, access, correct, and delete personal information, and will not be discriminated against for doing so. Residents of other U.S. states with consumer privacy laws, including Virginia, may make similar requests, and may appeal a decision by replying to our response. Send requests to support@homologate.app.

12. Children

Homologate is not directed to children under 13, and we do not knowingly collect personal information from them. Users between 13 and 18 should use the Service with a parent or guardian's involvement. If you believe a child under 13 has provided personal information, contact support@homologate.app and we will delete it.

13. Changes to this policy

We will post any update here with a new effective date and, for material changes, provide notice through the Service or by email before the change takes effect.

Contact

Practical Logic LLC · support@homologate.app