Privacy Policy

For vehicle owners, fleet users and smart tag users

Last updated: October 12, 2026

1. Introduction

This Privacy Policy explains how MEKAVO LTD ("we", "us", "our"), trading as Mekavo, collects, uses, stores and protects your personal data when you use our vehicle owner and fleet management portal ("Service").

We are committed to protecting your privacy and handling your data in accordance with applicable data protection laws.

2. Data Controller

The data controller responsible for your personal data is:

MEKAVO LTD
Company No. 16477044
76 Letchworth Road
Leicester, LE3 6FN
United Kingdom

Email: [email protected]

3. Data We Collect

We collect the following categories of data:

Account information — name, email address, mobile phone number, password (hashed), country, language preference.

Vehicle data — registration numbers, make, model, year, colour, VIN, MOT/ITV dates, insurance and tax dates, mileage, service history. Where available, official vehicle data is retrieved from third-party providers.

Inspection records — checklist results (pass/fail/N/A), inspector name, notes, photos and videos of defects, GPS coordinates (if enabled), date and time.

Fleet and organisation data — company name, industry, team members, driver-vehicle assignments, organisation settings.

Payment data — processed by Stripe. We do not store card numbers. We store transaction references, subscription status and billing history.

Usage data — pages visited, features used, device type, browser, IP address, referral source. Collected via cookies and analytics.

4. How We Use Your Data

We use your data to:

Provide and maintain the Service — vehicle records, inspections, reminders, fleet management
Send reminders — MOT, insurance, tax, service dates and custom reminders via email and SMS (if VIP)
Process payments — VIP subscriptions and fleet plans via Stripe
Look up vehicle data — from official registries via third-party APIs
Enable fleet management — sharing vehicle and inspection data within your organisation
Improve the Service — analytics, bug fixes, feature development
Communicate with you — service notifications, account security, support
Comply with legal obligations — tax records, fraud prevention, regulatory requirements

5. Legal Basis for Processing

We process your data on the following legal bases:

Contract — processing necessary to provide the Service you signed up for (Article 6(1)(b) GDPR)
Legitimate interest — analytics, service improvement, fraud prevention (Article 6(1)(f) GDPR)
Consent — marketing communications, optional location data, cookies (Article 6(1)(a) GDPR)
Legal obligation — tax records, regulatory compliance (Article 6(1)(c) GDPR)

We share your data only where necessary:

Within your organisation — if you belong to a fleet organisation, authorised members (owners, managers) can see vehicle records, inspections and defects for organisation vehicles
Workshop connections — if your vehicle is serviced at a Mekavo-connected workshop, service records created by the workshop are visible to you and vice versa
Payment processor — Stripe processes all payments. See Stripe's Privacy Policy
Vehicle data providers — registration number is sent to third-party APIs for vehicle lookups (no personal data is shared)
Hosting and infrastructure — our servers are hosted on DigitalOcean (EU/UK data centres)
Legal requirements — we may disclose data if required by law, court order, or regulatory authority

We do not sell your personal data to third parties.

7. International Transfers

Your data may be transferred to and processed in countries outside your country of residence:

Stripe (USA) — payment processing, covered by Standard Contractual Clauses
DigitalOcean — hosting within EU/UK data centres
Cloudflare — CDN and security, edge-processed with data minimisation

Where transfers occur outside the EU/UK, we ensure adequate safeguards are in place (Standard Contractual Clauses, adequacy decisions, or equivalent protections).

8. Data Retention

We retain your data for as long as your account is active. After account deletion:

Personal data is deleted within 90 days
Vehicle records and documents are permanently deleted
Inspection records are retained for the legally required period (typically 15 months for commercial vehicles, 36 months for medical/emergency vehicles), then deleted
Payment records are retained for 7 years as required by tax law
Anonymised analytics data is retained for up to 90 days
WhatsApp messages you send to our WhatsApp number, and our replies, are kept for 6 years. After that, the phone number and the message text are removed; only anonymous records (date, country, cost) are kept

9. Your Rights

Under data protection law, you have the right to:

Access — request a copy of your personal data
Rectification — request correction of inaccurate data
Erasure — request deletion of your data ("right to be forgotten")
Portability — request your data in a machine-readable format
Restriction — request we limit how we use your data
Objection — object to processing based on legitimate interest
Withdraw consent — where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

If you are in the European Union, you have the right to lodge a complaint with your national data protection authority.

10. Cookies

We use cookies and similar technologies to operate the Service. For full details, see our Cookie Policy.

11. Children

The Service is not intended for anyone under the age of 18. We do not knowingly collect personal data from children. If we become aware that a child under 18 has provided us with personal data, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-app notification. The "Last updated" date at the top of this page indicates when the policy was last revised.

13. Smart Tags

If you scan a tag. We only count that the tag was scanned that day. We do not record your location. The page puts a small random code in your browser, so that if you write more than once your messages stay together; it does not say who you are.

If you send the owner a message. We keep what you write, any photo you add and the reason you choose. To stop abuse we keep a scrambled form of that browser code, never your name, and we use a scrambled form of your connection's address for a short time to limit how many messages can be sent. If you write through WhatsApp, we keep your number encrypted so the owner's replies can reach you. Messages are checked automatically for spam and abuse before they are delivered. The owner sees your message, never your phone number. If you want the owner to contact you directly, put your details in the message yourself.

If you own a tag. People who find your item never see your phone number, email or address. They only see what you choose to show on the tag's page. Your replies go through Mekavo, so they do not see your number either.

If you sell tags. Resellers never see who activated their tags and never see any message sent through them. They see how many of their tags have been activated and their trust number: how many different real people use their tags. To count each person once and to leave out a seller's own accounts, we compare, inside Mekavo only, whether a phone number was verified, whether the Mekavo app is installed, which app installation an account uses and the network an account was created from. We use these only to prevent fraud (legitimate interest). Resellers also give us their full name, the address where they work and their business details. We check once that their phone was at that address and keep only the result (whether it matched and how far away), never the phone's location. We use these details to know who sells under the Mekavo name and to reach them; buyers may see a reseller's name or business name, town and country. A reseller who asks for a higher limit sends us a short video of their work. It is stored privately, only Mekavo staff can watch it, and we delete it after 12 months.

Who is responsible. Mekavo is responsible for the personal data in the smart tag service. You can ask us what we hold about you, or ask us to delete it, as described in this policy.

14. Contact & Supervisory Authority

For any privacy-related questions or to exercise your data rights, contact us: