Privacy Policy

BSAPH Limited (“BSAPH”, “we”, “us”, or “our”) is the data controller for the personal information we process across all of our platforms, including MotorFile, Crave, Forecourt, ProWrench, QiblaFlow, BSAPH Portal, EmberFade, BSA Axiom, and BSA Forge. This Privacy Policy explains what data we collect, why we collect it, and how we protect it — in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Controller: BSAPH Limited (Company No. 17532433), registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ.
Contact: [email protected]

1. What We Collect

• Identity data: Name, username, date of birth (where applicable).
• Contact data: Email address, phone number, postal address.
• Vehicle data: VRNs, VINs, MOT history, mileage, service history — sourced from DVLA, DVSA, and mechanic records.
• Order data: Items ordered, totals, delivery addresses, payment status (we do not store full card details — handled by Stripe).
• Account data: Password hashes, linked social accounts (Google, Apple), 2FA settings, the BSAPH platforms your account is used on.
• Technical data: IP address, browser type, device identifiers, cookies, usage data.
• Marketing data: Communication preferences and consent records.

2. How We Use Your Data

• Providing and maintaining the BSAPH platforms and services you use.
• Processing orders, payments, and booking confirmations.
• Sending transactional communications (order updates, MOT reminders, service alerts).
• Creating and managing your BSAPH Account across all our platforms.
• Preventing fraud, maintaining security, and enforcing our terms.
• Complying with legal obligations (e.g., HMRC, consumer protection law).
• Improving our services through anonymised analytics.

3. Legal Basis for Processing

• Contract performance: To provide services you've requested.
• Legitimate interests: To improve our platforms, prevent fraud, and maintain security.
• Legal obligation: To comply with applicable UK laws.
• Consent: For marketing communications and optional analytics.

4. Third-Party Processors

5. Your Rights Under UK GDPR

• Right of access: Request a copy of all personal data we hold about you.
• Right to rectification: Correct inaccurate or incomplete data.
• Right to erasure: Request deletion of your data where no legal retention obligation applies.
• Right to portability: Receive your data in a structured, machine-readable format.
• Right to restriction: Ask us to restrict processing while a dispute is resolved.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Withdraw consent at any time without affecting prior lawful processing.

To exercise any right, contact [email protected]. We will respond within 30 days. You may also lodge a complaint with the Information Commissioner's Office (ICO).

6. Cookies

• Authentication: JWT session tokens stored in localStorage.
• Preferences: Cart contents and UI preferences in sessionStorage.
• Analytics: Google Tag Manager (where consented). Opt out via browser settings.
• Cloudflare: Security cookies (e.g., __cf_bm) for bot protection.

7. Security

We implement TLS encryption in transit, bcrypt password hashing, database-level encryption at rest, rate limiting on auth endpoints, CSP headers, and role-based access controls. All infrastructure runs on our own bare-metal hardware in the UK with Cloudflare DDoS protection at the edge.

8. Multi-Tenant Platforms

Some BSAPH platforms (Crave restaurants, ProWrench garages, Forecourt dealers) power our business clients' customer-facing services. In these cases, BSAPH acts as a data processor; the tenant is the data controller for their customers. Customer data is logically segregated per tenant.

9. Mobile Apps: BSAPH Portal and EmberFade

BSAPH Portal

• Account: you sign in with your BSAPH Account (name and email). The sign-in token is kept in your phone's secure storage.
• Business data: the app shows and edits the orders, enquiries, bookings, customers, invoices and products of the businesses you are an active member of. That data belongs to the business, and BSAPH processes it on the business's behalf (section 8).
• Push notifications: only if you choose to allow them. We store a push token linked to your account and use it to alert you to new orders, enquiries and donations for your business. Alerts are delivered through Apple's and Google's push services. The token is detached from your account when you sign out and removed when you delete your account.
• Camera and photos: used only when you choose to add a photo to a product or job. The photo you pick is uploaded to that record. The app receives only the photo you pick.
• Not collected: the app does not read your device location, and does not track you across other companies' apps or websites.

EmberFade

• Account: your BSAPH Account (name and email) and a random device identifier created for each install.
• Device keys: an encryption key pair is created on your phone. The secret key stays in your phone's secure storage and is never sent to us. We store only the public key, which senders need in order to encrypt messages to you.
• Messages: messages are encrypted on your phone before they are sent. We hold only the encrypted copy until it is delivered to the recipient's device, and then delete it. We cannot read message content. We do hold who is in each conversation so that messages can be routed.
• On your device: after delivery, the readable copy exists only in the app's private storage on your phone. Disappearing-message timers delete it on schedule, and “Burn all messages” in Settings erases it all.
• Camera and photos: used only when you choose to send a photo. Photos are encrypted like messages.
• Reports: if you report a message, we receive the reason and the message details you choose to submit, either in the app or by email to [email protected]. This is the only way we see message content.
• Not collected: the app does not read your device location, and does not track you across other companies' apps or websites.

To delete your account and the data tied to it from either app, open Profile or Settings and choose Delete account, or see bsaph.com/delete-account.

10. Contact Us