Privacy Policy

Privacy Policy for Vehiso Ltd

This privacy notice explains how and why we at Vehiso Ltd collect, use, share, and store your information when you use our services (the “Services”). This policy covers various interactions you may have with us, such as:

Visiting our website at https://vehiso.com.
Using the Vehiso office application in a web browser.
Using the Vehiso DMS mobile application on iOS or Android.
Engaging with us through sales, marketing, events, or customer support.

If you have any questions or concerns about our practices, please reach out to us.

Summary of Key Points

This summary provides key highlights from our privacy policy. For detailed information, please click on the links or refer to the table of contents below.

What Information Do We Process?

We collect personal information based on how you interact with our Services. To learn more, click here.

Do We Process Sensitive Personal Information?

No, we do not process sensitive personal information.

Do We Receive Information from Third Parties?

Only when you connect a Facebook Page, Instagram account or TikTok account to post vehicles to it. We then receive the details of that account needed to post on your behalf. To learn more, click here.

How Do We Process Your Information?

Your information is processed to provide our Services, improve operations, communicate with you, ensure security, and comply with legal requirements. For more information, click here.

When and With Whom Do We Share Personal Information?

We may share your personal information in specific situations. For details, click here.

How Do We Keep Your Information Safe?

We implement technical and organizational measures to protect your personal data. Unfortunately, no method of transmission over the internet is 100% secure. For more information, click here.

Your Rights

You may have various rights regarding your personal information, depending on your location. For detailed information, click here.

Exercising Your Rights

You can easily exercise your rights by contacting us directly using the details provided in this notice.

Learn More About Our Practices

To read the complete privacy policy, click here.

1. What Information Do We Collect?

Personal Information You Disclose to Us

Summary: We collect personal information that you voluntarily provide, which may include:

Names
Phone numbers
Email addresses
Mailing addresses
Job titles
Usernames
Passwords
Contact preferences
Contact or authentication data
Dates of birth
Photographs of vehicles
Device identifiers, where you enable notifications
Questions you ask the AI assistant, and voice notes you record on a vehicle health check

Sensitive Information

We do not process sensitive information.

Payment Data

If you make purchases, we may collect data necessary to process your payment. All payment data is stored by Stripe. You can review their privacy policy for more details.

Information Collected Through Our Mobile Application

If you install and use the Vehiso DMS mobile application, it may collect the following. Each is used only to provide the feature it belongs to, and none of it is used for advertising or shared with any advertising network.

Camera. With your permission, the application uses the camera to read a vehicle registration number, and to photograph vehicles you are adding to stock, a customer's part exchange, and what you find on a vehicle health check. Photographs you take are uploaded to your own dealership's records.
Photo library. With your permission, you may choose photographs already on your device to attach to a vehicle's stock record or a customer's part exchange. The application reads only the photographs you select, and does not write anything back to your library.
Push notifications. If you allow notifications, your device is issued an identifier by Apple or Google which we store so that we can notify that device about activity on your account, such as a new enquiry. It is not used to identify you anywhere else, and removing the application or signing out removes it.
Microphone and speech recognition. With your permission, the application uses the microphone in two places. On a vehicle health check you can record a voice note, which is uploaded and turned into a written note for the customer; the recording is used only for that and is not kept afterwards. When you hold the AI assistant's talk button, your phone's own speech service, provided by Apple or Google, turns what you say into text. Apple or Google may process that audio under their own privacy policies; only the resulting text is sent to us.
Diagnostics. When the application encounters an error it sends a technical report so that we can fix it. These reports identify your account by a randomly generated reference rather than by name, and are used only to diagnose faults.

Records You Enter About Your Own Customers

Our Services are used by motor dealerships to run their own businesses. Where you are a dealership using the Services, the records you create - your customers' names, contact details, addresses, dates of birth, the vehicles they enquire about and the paperwork you raise - remain yours. You decide what to collect and why; we hold and process it on your instructions in order to provide the Services to you, and we do not use it for our own purposes.

If you are an individual whose details appear in a dealership's records and you wish to exercise your rights over that information, please contact that dealership. We will assist them in responding.

The AI Assistant and Other AI Features

Some features use artificial intelligence: the AI assistant in the office application and the mobile application, the chat assistant a dealership can add to its own website, drafted replies to enquiries and reviews, customer write-ups of health check findings, and reading supplier documents. To answer a request, we send what you asked, together with the stock, customer or enquiry details needed to answer it, to an AI model provider that processes it on our behalf.

In the mobile application, the AI assistant asks for your agreement before it sends anything, and you can decline and keep using the rest of the application.
Replies are generated automatically and can be wrong. Anything important should be checked before you rely on it.
You can report a reply as offensive or wrong from inside the application. A report keeps a copy of the reply and your reason so that we can review it.
Your conversations with the AI assistant are kept with your dealership's account so that you can carry on where you left off.
We do not use your information, or your dealership's customer records, to train AI models, and we do not sell it.

Text Messages (SMS)

When you set up a website, we may ask you to verify your mobile number by text message. You enter your own number and tick a box to agree before anything is sent. We then text you a one-time verification code.

What we send. Only the verification code you asked for. We do not send marketing or promotional text messages.
Message frequency. One message each time you request a code. Message frequency varies with how many codes you request.
Cost. Message and data rates may apply, depending on your mobile plan.
Help and opting out. Reply HELP for help, or STOP at any time to stop receiving messages. You can also reach us through our Contact Us page.
No sharing. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent will not be shared with any third parties. The only exception is our SMS provider, Twilio, which receives your number solely to deliver the messages.

Connected Facebook, Instagram and TikTok Accounts

A dealership can connect its Facebook Page, Instagram professional account or TikTok account to the office application, so that it can post its vehicles there. You sign in with Facebook, Instagram or TikTok yourself and choose which accounts to connect; we never see your password. Connecting is optional, and nothing is posted until you connect an account.

What we receive. From Facebook and Instagram: the name, identifier and profile picture of each Page or Instagram account you choose to connect, and the list of Pages you manage so that you can choose between them. From TikTok: your TikTok display name, username and profile picture, and the posting options TikTok allows for your account (such as which audiences you can post to). For posts we publish, we also receive the post's identifier and link, and its public counts of likes, comments and views. When you open the comments on a post we published for you on Facebook or Instagram, we also receive the comments people have left on it, with each commenter's name or username, so that you can read them in the office application, whether or not you reply.
What we use it for. Only to publish the posts you create or schedule in the office application - vehicle photographs and captions - to the accounts you choose, to show you which accounts are connected, to show you how your posts are doing, and to let you read, reply to, hide or delete the comments on those posts. A reply you write is published on Facebook or Instagram under your Page or account, and a comment is only hidden or deleted when you choose to. On TikTok, every post is reviewed and confirmed by you in the office application before it is published, including who can see it; we do not post to TikTok automatically.
What we do not do. We do not read your private messages, your friends or followers, or anything else on your personal profile beyond the details listed above. We do not store the comments people leave on your posts: they are fetched from Facebook or Instagram each time you open them, and we do not use them, or the people who wrote them, for anything else. We do not use information from Facebook, Instagram or TikTok for advertising, we do not sell it, and we do not use it to train AI models.
Access tokens. Connecting gives us an access token for each account, which is how we post and read on your behalf. Depending on how your account was connected, the token is held either by our posting provider, Post for Me, which publishes on our instruction, or by us, encrypted in our own database and used only for the purposes above. We refresh a token only while the account stays connected, and delete it when you disconnect.
How long we keep it. Until you disconnect the account. See Deleting the Data We Hold From Facebook, Instagram or TikTok.

Your use of Facebook and Instagram is also governed by Meta's Privacy Policy, and your use of TikTok by TikTok's Privacy Policy.

2. How Do We Process Your Information?

Summary: We may process your personal information for various reasons, including:

To create and manage your account.
To provide and deliver services to you.
To communicate with you regarding your inquiries and support needs.
To comply with legal obligations.

3. What Legal Bases Do We Rely On to Process Your Information?

Summary: We process your personal information only where we have a lawful basis to do so.

Performance of a contract. To provide the Services you or your dealership have subscribed to, to administer your account, and to take payment.
Legitimate interests. To keep the Services secure, to diagnose faults, and to improve how they work - balanced against your interests, and never in a way we would not expect you to accept.
Consent. Where you have given it, and which you may withdraw at any time. Connecting a Facebook, Instagram or TikTok account is done with your consent, given on that platform's own sign-in screen, and you can withdraw it by disconnecting the account. Device notifications and access to your camera, photo library, microphone and speech recognition are asked for separately by your device and can be withdrawn in its settings. The AI assistant in the mobile application asks for your agreement before its first use. Text messages are sent only after you tick the box agreeing to receive them.
Legal obligation. Where we must keep or disclose information to comply with the law.

4. When and With Whom Do We Share Your Personal Information?

We may share your information in specific situations, such as:

Business Transfers: We may share or transfer your information in the event of a merger, sale, or acquisition of our business.
Compliance with Laws: If required by law, your information may be shared with relevant authorities.
Service Providers: We use a small number of providers who process information on our behalf, under contract and only as instructed:
- Stripe, to take payments.
- Bugsnag (SmartBear), to receive the error reports described above.
- Firebase Cloud Messaging (Google) and the Apple Push Notification service, to deliver notifications to your device.
- OpenRouter, which passes requests from our AI features to the AI model provider that answers them.
- Post for Me, which, for accounts connected through it, holds the access you grant when you connect a Facebook Page, Instagram account or TikTok account, and publishes the posts you create to it. See Connected Facebook, Instagram and TikTok Accounts.
- Meta (Facebook and Instagram) and TikTok, which receive the posts you choose to publish to your accounts there.
- Twilio, to deliver the verification codes described in Text Messages (SMS). We do not share mobile numbers with anyone for marketing.
- Apple and Google, whose speech services on your phone turn what you say to the AI assistant into text.
- Our hosting and email providers, to run the Services and send the messages you ask us to send.

5. Do We Use Cookies and Other Tracking Technologies?

Summary: Yes, we may use cookies and similar technologies to collect and store your information.

6. How Long Do We Keep Your Information?

Summary: We keep your information for as long as we need it to provide the Services, and then only for as long as the law requires.

Account information is kept while your account is open. Where records must be retained after that - invoices and payment records for accounting and tax purposes, for example - we keep those for the period the law requires and no longer.

You may ask us to delete your account at any time, and we will act on that request. Records the law requires us to keep are retained for their remaining period and are not used for anything else.

Details of a connected Facebook, Instagram or TikTok account are kept until you disconnect it, and are then deleted as described in Deleting the Data We Hold From Facebook, Instagram or TikTok.

A voice note recorded on a health check is deleted once it has been turned into text. Conversations with the AI assistant, and reports about its replies, are kept with your dealership's account.

Where the records are a dealership's own customer records, the dealership decides how long they are kept. See Records You Enter About Your Own Customers.

7. How Do We Keep Your Information Safe?

Summary: We aim to protect your information with appropriate security measures, although no method of electronic transmission is completely secure.

8. Do We Collect Information from Minors?

Summary: We do not knowingly collect data from individuals under the age of 18.

9. What Are Your Privacy Rights?

Summary: Depending on your location, you have certain rights regarding your personal information.

If you are in the United Kingdom or the European Economic Area, you have the right to ask for a copy of the personal information we hold about you, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time, which does not affect what we did before you withdrew it. You can object at any time to our using your information for direct marketing. To use any of these rights, see How Can You Review, Update, or Delete the Data We Collect From You?.

If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint, or to the data protection authority where you live or work in the European Economic Area. We would appreciate the chance to deal with your concerns first, so please contact us beforehand if you can.

10. Controls for Do-Not-Track Features

Most web browsers include a Do-Not-Track feature. As the technology for DNT signals continues to evolve, we will inform you of any changes to our practices.

11. Do California Residents Have Specific Privacy Rights?

Yes, California residents have specific rights regarding access to their personal information. For more details, see the relevant section in this policy.

12. Do We Make Updates to This Notice?

Yes, we will update this notice as necessary to reflect changes in our practices. Please review this notice frequently to stay informed.

13. How Can You Contact Us About This Notice?

If you have questions or comments about this notice, please get in touch through our Contact Us page.

14. How Can You Review, Update, or Delete the Data We Collect From You?

You may have the right to request access to, correction of, or deletion of your personal information. To make such a request, please visit: Contact Us.

15. Deleting the Data We Hold From Facebook, Instagram or TikTok

You can have us delete what we hold from a connected Facebook Page, Instagram account or TikTok account in any of these ways:

In the office application. Go to Social Media, then Settings, and choose Disconnect next to the account. We delete the account's profile picture, the other details we received about it and any access token we hold straight away, keeping only its name and identifier so that your post history still shows where each post went, and ask the platform to withdraw the access you granted where it lets us (or, for accounts connected through our posting provider, Post for Me removes it).
On Facebook or Instagram. In Facebook, go to Settings and privacy, Settings, Business integrations (or Apps and websites), select Vehiso and choose Remove. In Instagram, go to Settings, Website permissions, Apps and websites, and remove Vehiso. This revokes our access straight away; to have the details we already hold deleted as well, disconnect the account in the office application or contact us as below.
On TikTok. In TikTok, go to Settings and privacy, Security and permissions, Apps and services permissions, select Vehiso and choose Remove access. As with Facebook, contact us or disconnect in the office application to have the details we already hold deleted.
By asking us. Send a request through our Contact Us page with the name of the dealership and the account to remove. We will delete the data within 30 days and confirm to you when it is done.

Posts already published to your Facebook Page, Instagram account or TikTok account are yours and stay there until you delete them on that platform. A record that a post was made (its caption, the vehicle, the date, and the name and identifier of the account it went to) stays in your dealership's post history until you delete it or close your account. To have those removed sooner, ask us as above.