Scans.ai Privacy Policy

1. Who this Policy covers

This Policy explains how personal information is handled when you use the Scans.ai mobile app, create an account, contact support, or complete a vehicle, document, driver, background or other authorised journey.

“Scans.ai”, “we”, “us” and “our” refer to the Scans.ai service. The verified legal entity responsible for the App, and the responsible party/controller for each journey, will be identified in the App and Journey Notice before you accept.

The App is for adults aged 18 and older.

2. Who controls your information

Scans.ai normally controls information needed for its own account security, direct support, Scans.ai billing, fraud and security logs, and legal records.

For a partner journey, the named ride-hailing platform, fleet, insurer or other commissioning party may control the journey information while Scans.ai processes it on that party’s instructions. Scans.ai may have a separate role for its own account, security and legal records. The Journey Notice states the exact position; we do not assume joint control.

3. Information we may collect

Only the categories needed for an accepted journey should be collected:

• account, identity and contact details;
• ID, passport, driving licence and other authorised documents;
• driver, vehicle-owner, VIN, registration, licence and vehicle details;
• photos, video, audio where specifically enabled, inspection evidence and capture metadata;
• location, IP address, device identifiers, app events and security logs;
• payments, invoices and acceptance records;
• facial images, biometric templates or liveness results only for a separately authorised journey;
• criminal or background-check information only for a separately authorised journey; and
• scores, flags, recommendations, confidence values, reasons and human-review outcomes.

The Journey Notice marks information as required or optional and explains what happens if required information is not provided.

4. Where information comes from

Information may come from you, your device, a vehicle owner, the commissioning partner, an authorised fleet, official or approved records, verification providers, payment providers, and Scans.ai’s security and support systems.

If you submit another person’s information, we and the relevant controller still have our own duty to give that person appropriate privacy information where required.

5. Why information is used

Information is used only for the purpose stated in the Journey Notice, such as running the requested inspection or verification, issuing the agreed output, preventing fraud, securing the App, providing support, processing a disclosed payment, keeping acceptance evidence, meeting legal duties, or handling a correction or appeal.

The Journey Notice states the lawful basis for each purpose. This may be a contract, legal duty, legitimate interest supported by an assessment, or consent. We do not use bundled consent where another basis applies.

6. Record of your choices

When you accept the Terms, acknowledge a Privacy Policy or Journey Notice, or give or withdraw a journey-specific consent, we keep an electronic record of that action. The record includes the user and journey, the partner where applicable, the date and time, the document versions shown and the choice made.

We use this record to prove your instructions and choices, meet legal and contractual requirements, resolve disputes and protect the service. It is kept only for the approved period stated in the applicable Journey Notice and retention schedule, after which it is deleted or restricted unless the law or a legal claim requires it to be retained. You may request access to this record or ask us to correct an error.

7. Criminal, biometric and automated processing

A vehicle inspection does not authorise a criminal, driver-background or biometric check. These higher-risk activities require a separate signed scope, lawful-authority assessment, Journey Notice and any required consent, impact assessment or prior authorisation.

The Journey Notice explains whether Scans.ai provides evidence, a score, a recommendation or a decision. Where a result may significantly affect you, it must provide a correction, dispute, appeal and human-review route. The partner normally makes its own onboarding, eligibility or commercial decision unless the valid journey contract says otherwise.

8. Sharing and service providers

We do not sell personal information. Information may be shared only with the parties identified for the journey, which can include the responsible partner, approved verification or inspection providers, hosting and security providers, payment providers, professional advisers, and authorities where lawfully required.

The Journey Notice identifies the relevant recipients, service-provider categories and locations. A provider may use journey information only for the approved service and must return or delete it as required.

Where a journey is commissioned by Uber or Bolt, the Journey Notice will name the applicable legal entity and link the partner’s own privacy notice. Current general privacy routes include Uber’s driver privacy notice and Bolt’s driver privacy notice.

9. Strict journey and partner separation

Uber, Bolt, Scans-direct and other-partner data must remain in separate partner and journey records, including live data, documents, images, reports, scores, logs, analytics, exports, backups and deletion work.

We do not create a shared driver profile, cross-partner eligibility score, fraud graph, benchmark, marketing audience or training dataset from partner data unless new written authority, a lawful basis and a clear notice permit that exact use. Aggregation or anonymisation is not used to avoid contractual deletion duties.

10. Locations, transfers and retention

The Journey Notice states where the information is stored or accessed, including relevant countries, approved providers and any cross-border transfer protection.

It also states a specific retention period or deletion event for the journey’s documents, media, reports, results and appeal records. Account, security, billing and legal records may have separate stated periods. When information is no longer lawfully required, it is returned or deleted in line with the applicable contract and law, including from approved providers and deletion queues.

11. Security and incidents

Scans.ai applies organisational and technical safeguards appropriate to the sensitivity of the information and requires approved providers to protect it. No online service is completely secure.

If a security incident affects your information, the responsible party/controller will investigate and notify the relevant partner, regulator or affected people when required by law and contract.

12. Your rights

Depending on the law and Scans.ai’s role, you may ask to:

• receive information about processing and obtain a copy;
• correct incomplete or inaccurate information;
• delete information where no lawful reason requires it;
• object to or restrict certain processing;
• receive portable information where that right applies;
• withdraw consent for future processing where consent is the basis;
• challenge an incorrect result and request human review; and
• complain to the responsible partner or a data-protection authority.

We may verify your identity and protect another person’s information before responding. If a partner controls the journey, we will route the request to that partner and tell you.

13. Marketing, cookies and app tools

Journey acceptance is not consent to marketing. Direct marketing requires a separate choice and can be stopped at any time.

The App should use only the device permissions, cookies, software development kits and analytics identified for a defined purpose. Optional advertising or analytics tools require a separate lawful basis and control.

14. Changes and contact

We will show material changes to purpose, role, recipients, location, automated processing, retention or rights before they take effect. We will ask for new consent or acceptance where required and keep evidence of the version shown.

For privacy questions, rights requests, corrections or appeals, email support@scans.ai and include the journey reference where available. The Journey Notice provides the responsible partner’s route and the relevant regulator route.