1. Who is responsible
Island Car Log is the trading name of the Guernsey sole trader who operates this website. The operator is the data controller for the personal information used to operate the service.
Island Car LogApartment 8, St Cecilia Court
Collings Road
St Peter Port, GY1 1GB
Guernsey
For a privacy question or rights request, email [email protected] or write to the address above. Include your account email to help us identify your records; please do not send your password or full payment-card details.
2. Information we handle
- Accounts: email address, username or display name, account identifiers, sign-in credentials handled by our authentication provider, and account settings.
- Vehicles and records: registration or VIN where supplied, vehicle details, mileage, servicing, maintenance, expenses, fuel records, garages, notes, photographs and document descriptions.
- Uploaded files: insurance and renewal documents, invoices, receipts, registration paperwork and other documents you choose to store. Their contents may include names, addresses, policy numbers or information about other people.
- Tools: AI questions and saved responses, vehicle context, quote and invoice information, valuation requests, results and feature-usage counts.
- Subscriptions: account and payment-provider identifiers, subscription status, billing dates and transaction details needed to manage Premium. Payment details entered in checkout are handled by the payment provider.
- Contact and beta enquiries: your name, email address, vehicle information, message and correspondence.
- Technical information: IP addresses, browser and device information, requests, errors and security events handled by hosting and service providers. Optional public-page visit statistics are described on the Cookies & Browser Storage section.
Most information comes from you or your use of the service. Subscription updates come from the payment provider; supported live vehicle valuations may return information from the valuation provider. Only upload material you are authorised to use. Redact information that is not needed, particularly medical details, criminal-offence information and other people's private details.
3. Purposes and lawful bases
Where data protection law requires a lawful basis, the basis depends on the purpose:
| Purpose | Basis |
|---|---|
| Create and maintain your account, store your vehicle records and provide requested tools. | Performance of our contract with you, or steps you request before entering a contract. |
| Take payments, administer Premium and respond to service or cancellation enquiries. | Contract; legal obligation where accounting or consumer law requires records or action. |
| Protect accounts, prevent misuse, investigate faults and manage complaints or legal claims. | Legitimate interests in operating a secure, reliable service and protecting our rights; legal obligation where applicable. We must consider your rights and use only proportionate information. |
| Host authorised records that include another person's ordinary personal information. | Legitimate interests in providing the requested personal vehicle-record service, subject to minimisation and the other person's rights. |
| Send requested beta or promotional updates. | Consent. You can ask us to stop at any time. Necessary account and billing messages are separate. |
| Run optional Cloudflare public-page visit statistics. | Your choice to allow statistics. You can change it on the Cookies page. |
We do not request medical information or criminal-offence information for ordinary vehicle record keeping. An ordinary lawful basis alone does not authorise use of these more sensitive categories; please leave them out of your uploads and tool inputs.
4. Providers and sharing
Providers receive information needed for the services they supply. The relevant providers include:
- Supabase: account authentication, database records, private document storage and backend processing. Supabase privacy information.
- Cloudflare: website delivery, security and, when allowed, public-page visit statistics. Cloudflare privacy information.
- PayPal and an available wallet provider: checkout, subscription payments, fraud prevention and billing updates. Their own notices apply to processing they carry out independently. PayPal privacy information.
- Resend: delivery of account and service emails, including recipient addresses and message contents. Support correspondence sent to our Gmail address is handled by Google. Resend privacy information; Google privacy information.
- FormSubmit: delivery of the website's beta signup form to our inbox, including the information entered in that form. FormSubmit privacy information.
- OpenAI: processing information sent when you use AI Mechanic, as explained below. OpenAI processing information.
- DealerPricing: a supported live valuation may send registration or VIN and mileage to obtain vehicle valuation data. A fallback estimate may be used when live data is unavailable. DealerPricing website.
Browsers also request software libraries from content-delivery providers such as jsDelivr and fonts from Google where a page uses them; those requests disclose technical connection information. We may disclose information to advisers or authorities where reasonably necessary for legal obligations, claims or the protection of rights.
Your stored vehicle documents are not published as public web pages. Access by the operator or providers must be limited to what is needed to supply, maintain, secure or support the service or comply with law.
5. AI and vehicle tools
When you ask AI Mechanic a question, your question, relevant vehicle specifications, recent maintenance logs and recent conversation text are sent to OpenAI to generate a response. Questions and responses are saved with your account for conversation history and usage limits. Private information included in your question or maintenance notes may therefore be included in the request.
Uploading an insurance or registration document to Document History does not by itself submit that file to AI Mechanic. Garage Quote Checker currently extracts PDF or image text in your browser; files and confirmed information are stored with your account when you choose to save them.
AI guidance and value estimates are informational. They do not make insurance, credit or legal decisions about you. Do not include unnecessary sensitive personal information in tool inputs, and check important results with an appropriate professional.
6. International processing
Our primary Supabase project is hosted in Ireland. Providers may also process information in the United States and other countries for delivery, support, payments, email or AI processing; hosting the primary database in Ireland does not mean every provider processes only in Ireland.
Applicable data protection law requires an authorised transfer route or suitable safeguards where information is sent to a country without recognised protection. Provider transfer arrangements are described in their processing terms, including Supabase's data processing addendum and OpenAI's data processing addendum, which address contractual safeguards. Contact us for details of the safeguards applying to your information or to request a copy where available.
7. Retention and deletion
Account and vehicle records are kept to provide your account and the history you choose to maintain. Documents are kept until you remove them through the document controls or a relevant erasure request is processed. Saved AI history and feature-usage records support your requested conversations, allowances and misuse prevention.
Retention depends on whether information is still needed for your account or enquiry, whether a complaint or dispute remains open, applicable accounting or other legal requirements, and the need to investigate security incidents. Contact us to ask about a particular record or request deletion.
Remove documents you no longer need using the document controls before closing your account. The account-deletion control removes your profile and saved vehicles, but should not be treated as confirmation that every uploaded file, provider record or legally required record has been erased. For a request covering all your personal information, contact us using section 1. Cancel subscription renewals separately before closing your account.
Copies held in provider logs, backups or payment systems may follow those providers' retention arrangements. Any retention after a deletion request must have a valid reason; it does not remove your right to ask for an explanation or complain.
8. Keeping information secure
The service uses authenticated account access, account-based access controls and private document storage. Document viewing uses temporary signed links, currently valid for up to one hour. Anyone given a working link may be able to view the file while it remains valid, so avoid sharing links to private paperwork.
Keep your password private, secure your email account, sign out on shared devices and keep independent copies of important records. No online service can guarantee complete security. Report suspected unauthorised access to our contact address promptly.
9. Your rights and complaints
Depending on the applicable law and the reason for processing, you may have rights to access your information, correct it, request erasure or restriction, obtain portable information, object to processing based on legitimate interests, and withdraw consent. These rights have legal limits; withdrawing consent does not undo lawful processing before withdrawal.
Email or write to us using section 1. We may need proportionate information to verify your identity, and will explain any legal reason for refusing or limiting a request. An export button is not required to make an access or portability request.
You can complain to the Office of the Data Protection Authority in Guernsey. Where UK data protection law applies, you can also complain to the UK Information Commissioner's Office. You do not have to complain to us first.
10. Choices and updates
Account details are needed to create and manage an account. Vehicle details and files are supplied by you; leaving out required information may prevent a requested feature from working. You can use public pages without creating an account or allowing optional statistics.
Manage browser storage and public-page visit statistics on the Cookies & Browser Storage section. Ask us to stop beta or promotional updates at any time; necessary account and payment messages may still be sent. This notice is information about processing, not a request to consent to every use of your data.
We will update this notice when data handling changes and provide an appropriate notice of significant changes. The date above identifies this version.