Auto Princess ← Home

AUTO PRINCESS LTD
PRIVACY POLICY

Version 2.0  |  Last Updated: 27 June 2026

Effective Date: 27 June 2026

Registered Company Number: 17155826

IMPORTANT LEGAL NOTICE: Please read this Privacy Policy carefully before downloading, installing, or using the Auto Princess mobile application or any associated services. This document constitutes a legally binding agreement between you and Auto Princess Ltd. By proceeding to use the Software, you acknowledge that you have read, understood, and agree to be bound by the terms of this Privacy Policy in their entirety. If you do not agree with any part of this Policy, you must not access or use the Software and must immediately uninstall any installed versions.

1. Controller Identity and Contact Information

The data controller responsible for your personal data is:

Auto Princess Ltd
Company Number: 17155826 (registered in England and Wales)
Registered Office: 71-75 Shelton St, London WC2H 9JQ
Email: support@autoprincess.com
Website: https://autoprincess.com

For all privacy-related enquiries, data subject access requests, objections, or complaints, please contact us in writing at the email address above. We will acknowledge your request within five (5) business days and provide a substantive response within one (1) calendar month in accordance with Article 12 UK GDPR. Where the complexity or volume of requests necessitates an extension, we will notify you within the initial one-month period and may extend the response period by a further two (2) calendar months, providing written reasons for the extension.

We are not currently required to appoint a Data Protection Officer (DPO) under Article 37 UK GDPR, as we do not engage in large-scale systematic monitoring of individuals or large-scale processing of special category data. Should our processing activities change such that appointment becomes mandatory, we will update this Policy accordingly and publish the DPO's contact details.

We are registered with the Information Commissioner's Office (ICO) under registration number 00014589025. Our supervisory authority for UK GDPR purposes is the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. You have the right to lodge a complaint with the ICO at any time by visiting www.ico.org.uk or by calling 0303 123 1113.

For users located in the European Economic Area (EEA): Auto Princess Ltd acts as a data controller in respect of EEA residents' personal data pursuant to the EU General Data Protection Regulation (EU) 2016/679. We have not appointed an EU representative under Article 27 EU GDPR at this time. EEA residents may contact us directly at support@autoprincess.com for matters relating to the processing of their personal data.

2. Scope and Application

This Privacy Policy governs the collection, processing, storage, disclosure, and use of personal data obtained through the following services (collectively, the "Software" or "Services"):

This Policy applies to all users of the Software, including free-tier users, subscribers to Pro plans (monthly and annual), business account holders, and visitors to our website.

This Policy does not apply to third-party websites, applications, or services that may be linked to or from our Software. We are not responsible for the privacy practices of third parties, and we encourage you to review their privacy policies independently.

This Policy should be read alongside our Terms of Service, which is incorporated by reference herein. In the event of any conflict between this Policy and the Terms of Service, this Policy shall prevail in respect of matters relating to the processing of personal data.

3. Definitions

For the purposes of this Privacy Policy, the following definitions apply:

4. Data We Collect and Lawful Basis

We collect and process several categories of personal data. For each category, we identify the specific data elements, the purpose of processing, and the lawful basis under Article 6 UK GDPR (and Article 9 where applicable). Where we rely on legitimate interests, we confirm that we have conducted and documented a Legitimate Interests Assessment (LIA) balancing our interests against your rights and freedoms.

4.1 Account and Identity Data

Data Collected:

Purpose: To create and maintain your account, authenticate your identity, grant or restrict access to features based on your subscription tier, provide customer support, and contact you regarding your account.

Lawful Basis: Performance of a contract (Article 6(1)(b) UK GDPR). The processing of account data is necessary to provide you with the Software as agreed.

4.2 Vehicle and Diagnostic Data

Data Collected:

Purpose: To provide core diagnostic functionality, populate the Vehicle Passport, generate AI-assisted fault analysis and maintenance recommendations, and display MOT history.

Lawful Basis: Performance of a contract (Article 6(1)(b) UK GDPR), being the provision of diagnostic services. Where you voluntarily add service records or notes beyond what is required for core diagnostics, we additionally rely on your consent (Article 6(1)(a)).

4.3 Audio Data

Data Collected:

IMPORTANT DISCLOSURE: The Auto Princess application requests access to your device's microphone solely for the purpose of capturing engine and mechanical sounds when you actively use the audio analysis feature. The microphone is not activated at any other time. The application does not record ambient conversations, background audio unrelated to vehicle diagnostics, or any audio when the audio analysis screen is not actively open and recording.

Purpose: To perform AI-powered engine sound analysis for fault classification and diagnostic inference. Audio data is also used to expand and refine our machine learning sound classification dataset, subject to the AI training disclosure in Section 7.

Lawful Basis: Consent (Article 6(1)(a) UK GDPR). You are required to grant explicit microphone permission at the operating system level before any audio can be captured. You may revoke this permission at any time via your device settings, which will disable the audio analysis feature. We additionally rely on legitimate interests (Article 6(1)(f)) for the specific use of anonymised, non-reversible audio features in AI model training, having assessed that our interest in improving diagnostic accuracy is proportionate and does not override your rights.

4.4 Image and Visual Data

Data Collected:

Purpose: To perform AI-powered visual inspection and condition assessment of vehicle components. Images are also used to expand our machine learning visual classification dataset, subject to the AI training disclosure in Section 7.

Lawful Basis: Consent (Article 6(1)(a) UK GDPR). Camera access requires explicit permission at the operating system level. You may revoke this at any time via your device settings, disabling the visual inspection feature.

4.5 Subscription, Payment, and Billing Data

Data Collected:

CRITICAL: Auto Princess Ltd does not collect, store, or process your full payment card number, CVV/CVC, bank account details, or any other full financial credentials. All payment transactions are processed exclusively by Stripe Technology Europe Limited, which acts as an independent data controller for payment processing. Your complete card data is transmitted directly to Stripe and is never accessible to Auto Princess systems. Please review Stripe's Privacy Policy at https://stripe.com/gb/privacy for details of how Stripe processes your payment data.

Purpose: To process subscription payments, manage your Pro entitlement, gate access to premium features (requirePro Cloud Function enforcement), handle subscription renewals, cancellations, and failed payment events via Stripe webhooks, and provide billing-related customer support.

Lawful Basis: Performance of a contract (Article 6(1)(b) UK GDPR). Processing subscription and billing data is necessary to fulfil and manage your paid subscription.

4.6 Device and Technical Data

Data Collected:

Purpose: To ensure the technical operation and security of the Software, detect and fix bugs and crashes, monitor application performance, prevent fraudulent or abusive use, enforce API security via Firebase App Check, and understand feature usage patterns to inform product development.

Lawful Basis: Legitimate interests (Article 6(1)(f) UK GDPR). We have a legitimate interest in maintaining the security, stability, and integrity of the Software, and in understanding how users interact with it to improve our services. We have assessed that this processing does not override your interests, rights, or freedoms, as the data is pseudonymous, technical in nature, and not used for profiling or advertising purposes.

4.7 DVLA API Data

When you enter a vehicle registration number and initiate a lookup, our Cloud Function (dvlaLookup, deployed to europe-west2) makes a server-side request to the DVLA Vehicle Enquiry Service API on your behalf. The data retrieved and stored by us is limited to the vehicle's technical and registration attributes (as listed in Section 4.2 above). We do not receive, store, or process the registered keeper's name or address from DVLA. Your vehicle registration number is processed by the DVLA under their own privacy notice, available at https://www.gov.uk/government/organisations/driver-and-vehicle-licensing-agency.

4.8 Data We Do Not Collect

We explicitly confirm that Auto Princess does not intentionally collect or store:

5. Automated Processing and the Paywall System

5.1 Pro Feature Gating (Paywall)

Access to premium (Pro) features within the Software is controlled through an automated entitlement system operating as follows:

  1. When you initiate a subscription via the in-app subscription screen, you are redirected to a Stripe-hosted checkout page. You complete payment directly on Stripe's platform.
  2. Upon successful payment, Stripe transmits a secure webhook event (checkout.session.completed or invoice.payment_succeeded) to our stripeWebhook Cloud Function, deployed to europe-west2.
  3. The stripeWebhook function verifies the webhook signature using our Stripe webhook signing secret to confirm the event is authentic and originated from Stripe.
  4. Upon verified payment, the function writes your Pro entitlement record to Firestore at path entitlements/{userId}, setting status to "pro", recording your Stripe Customer ID, Stripe Subscription ID, plan type, and current period end date.
  5. When you attempt to access a Pro feature within the app, our requirePro Cloud Function verifies your entitlement record in real-time. If status is "pro" and the subscription period is current, access is granted. If the entitlement is absent, expired, or set to "free", access is denied and you are shown an informational screen describing available plans.
  6. For subscription renewals, Stripe sends invoice.payment_succeeded webhook events at each billing cycle, and the entitlement record is updated accordingly. For cancellations or payment failures, invoice.payment_failed and customer.subscription.deleted events update the entitlement status and restrict Pro access at period end.

No human intervention is involved in the routine granting or revocation of Pro access. Entitlement decisions are made programmatically based on verified Stripe webhook data.

5.2 Automated Decision-Making and Profiling

The entitlement system described in Section 5.1 constitutes automated decision-making within the meaning of Article 22 UK GDPR insofar as it produces a decision (access granted or denied) with a legal or similarly significant effect on you. However, this processing is necessary for the performance of a contract between you and Auto Princess Ltd, being your subscription agreement. You have the right to request human review of any automated entitlement decision by contacting us at support@autoprincess.com.

Beyond entitlement gating, we do not use your personal data to create profiles for the purposes of targeted advertising, personalised pricing (other than the published subscription tiers), or any other form of automated profiling that produces significant effects on you.

5.3 In-App Purchase Compliance

The Auto Princess mobile application does not include tappable external links or in-app mechanisms that direct users to complete payment outside the app in a manner that would contravene Apple App Store Review Guideline 3.1.1 or the Google Play Developer Distribution Agreement. Payment flows are presented via informational screens describing available plans. All payment processing for subscriptions initiated through the iOS or Android app is conducted via Stripe-hosted web checkout pages accessed through the device browser, or through Apple In-App Purchase or Google Play Billing where required by the respective platform's policies.

6. Cookies, Tracking, and Analytics

6.1 Mobile Application

The Auto Princess mobile application does not use browser cookies, as it is a native mobile application. The application does use the following tracking and analytics technologies:

Lawful Basis: Legitimate interests (Article 6(1)(f) UK GDPR). We have a legitimate interest in monitoring application stability and performance. You may opt out of Firebase Analytics data collection within the app's Settings screen.

6.2 Website

Our website at https://autoprincess.com may use the following cookie categories:

Marketing or advertising cookies are not used on our website. A full cookie declaration, listing each cookie by name, provider, type, and retention period, is available at https://autoprincess.com/cookies and is updated whenever our cookie usage changes.

Consent for non-essential cookies is obtained via our cookie consent management tool displayed on first visit to the website. You may withdraw consent or change your cookie preferences at any time by clicking the "Cookie Settings" link in the footer of the website.

Lawful Basis: Strictly necessary cookies are processed under the basis of our legitimate interests in operating the website. All other cookies are placed on the basis of your consent, in compliance with PECR and UK GDPR Article 6(1)(a).

7. Artificial Intelligence and Machine Learning Data Processing

7.1 Overview of AI Processing

The Software incorporates artificial intelligence and machine learning systems powered primarily by Google Gemini APIs. These systems provide diagnostic reasoning, audio-based fault classification, image-based visual inspection, and natural language diagnostic explanations. This section provides full disclosure of how your data is used in connection with these AI systems.

7.2 Real-Time AI Inference

When you use AI-powered features within the Software, the following data is transmitted to AI processing services for the purpose of generating a diagnostic response:

This inference-time processing is conducted under the terms of Google LLC's API usage policies. Data transmitted for inference purposes is processed by Google's infrastructure and is governed by Google's applicable data processing terms. We do not grant Google the right to use your identifiable personal data for Google's own model training in this context, and our API agreement with Google includes appropriate data processing protections. Please review Google's Generative AI Prohibited Use Policy and API Terms of Service for further information.

7.3 AI Training Data Collection and Use

CRITICAL DISCLOSURE: Auto Princess actively collects and uses user-submitted data to train, fine-tune, evaluate, and improve our proprietary AI and machine learning models. By using the Software and submitting data, you grant Auto Princess Ltd the rights described below. Please read this section carefully.

The following categories of data may be used for AI training purposes:

Before being used in AI training, data is subjected to the following processing steps:

7.4 Intellectual Property Licence for AI Training Data

By submitting audio recordings, images, text inputs, or other data through the Software, you grant Auto Princess Ltd a worldwide, irrevocable, perpetual, royalty-free, non-exclusive licence to use, reproduce, modify, adapt, publish, translate, distribute, process, and create derivative works from such data, including for the purposes of training, evaluating, and improving AI and machine learning models used within the Software or in future Auto Princess products and services.

This licence is granted in addition to, and does not replace, any rights Auto Princess Ltd holds over AI training data as the data controller under UK GDPR on the basis of legitimate interests (for anonymised or pseudonymised training data) or under the terms of this Privacy Policy.

7.5 The Irreversibility of AI Model Training

IMPORTANT LIMITATION ON ERASURE RIGHTS: You should be aware that once your data has been used to train a machine learning model, it is not technically possible to identify and remove the influence of that specific data from the trained model's weights, parameters, or representations. This is an inherent technical characteristic of how neural networks and statistical learning systems function, as recognised by the UK ICO and addressed in Recital 26 of UK GDPR, which provides that the principles of data protection do not apply to anonymous information. Where your data has been genuinely anonymised prior to or as a result of model training (such that you cannot be identified from the model weights), it falls outside the scope of UK GDPR and your erasure rights do not extend to it. Where your data has been pseudonymised but not fully anonymised within training datasets, we will honour erasure requests in respect of those dataset copies to the extent technically feasible.

In practical terms: if you request deletion of your account and personal data, we will:

  1. Delete your account record, authentication credentials, and directly identifying information from our live systems within 30 days;
  2. Delete your vehicle records, Vehicle Passport data, diagnostic logs, and entitlement records from Firestore within 30 days;
  3. Suppress or delete any pseudonymised training data records that can be linked to your user ID from our training datasets to the extent technically feasible;
  4. Not be able to remove your data's influence from AI model weights that have already been trained, where such data has been anonymised as part of the training process.

7.6 Sound Classification Dataset

Auto Princess maintains a proprietary sound classification dataset, currently comprising labelled audio clips of vehicle engine and mechanical sounds. This dataset is used to train fault classification models. Audio data contributed to this dataset is anonymised prior to dataset inclusion by removing direct identifiers. The dataset is stored securely within our infrastructure and is not sold, licensed, or shared with third parties, except as part of a business transfer as described in Section 10.

8. How We Use Your Personal Data

The following table summarises all purposes for which we process personal data, cross-referenced to the data categories in Section 4 and the lawful bases in Section 4:

We do not use your personal data for marketing or promotional purposes without your separate, explicit opt-in consent. We do not sell your personal data to third parties. We do not use your personal data for targeted advertising.

9. Data Sharing and Third-Party Processors

We do not sell, rent, or trade your personal data to third parties. We share your personal data only in the following circumstances:

9.1 Service Providers (Data Processors)

We engage the following third-party data processors, each operating under a written data processing agreement with Auto Princess Ltd and bound by appropriate data protection obligations:

9.2 Legal and Regulatory Disclosure

We may disclose your personal data to law enforcement agencies, regulatory authorities, courts, or other public bodies where we are required to do so by applicable law, court order, or other legal process, or where such disclosure is necessary to protect our legal rights, enforce our Terms of Service, or prevent fraud or illegal activity. Where legally permissible, we will notify you of any such disclosure.

9.3 Business Transfers

In the event that Auto Princess Ltd undergoes a merger, acquisition, asset sale, restructuring, insolvency, or other business transfer, your personal data may be transferred to the acquiring entity or successor as part of the assets of the business. We will notify you via email or prominent in-app notice before your personal data is transferred under such circumstances and becomes subject to a different privacy policy.

9.4 Aggregated and Anonymised Data

We may share aggregated, anonymised statistical data with third parties, including investors, research partners, or industry bodies, where such data cannot reasonably be used to identify any individual. This does not constitute sharing of personal data.

10. International Data Transfers

Auto Princess Ltd is incorporated in England and Wales, and our primary data processing infrastructure (Firebase Cloud Functions and Firestore) is deployed in the europe-west2 (London) region within the United Kingdom. However, certain third-party processors may process your data outside the UK and EEA:

Where we transfer personal data outside the UK, we ensure that one of the following safeguards applies: an adequacy decision by the Secretary of State; Standard Contractual Clauses approved under Article 46 UK GDPR; or another appropriate safeguard recognised under UK data protection law. You may request copies of the relevant transfer safeguard documentation by contacting us at support@autoprincess.com.

For EEA residents: transfers of your personal data from the EEA to the UK are permitted on the basis of the European Commission's adequacy decision in respect of the United Kingdom (Commission Implementing Decision (EU) 2021/1772). Transfers from the EEA to the United States by our processors are governed by the applicable EU SCCs.

11. Data Retention

We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law. The following retention periods apply:

Following the expiry of the applicable retention period, data is either securely deleted or irreversibly anonymised. We conduct periodic data audits to ensure retention practices are maintained.

12. Your Rights Under UK GDPR and EU GDPR

As a data subject, you have the following rights in respect of your personal data. We will respond to all rights requests within one (1) calendar month of receipt, extendable by a further two (2) months in complex or multiple cases, with written notification of any extension.

12.1 Right of Access (Article 15)

You have the right to obtain confirmation of whether we process personal data about you, and if so, to receive a copy of that personal data together with information about the purposes of processing, categories of data, recipients, retention periods, and your other rights. We will provide this information free of charge, unless your request is manifestly unfounded or excessive, in which case a reasonable fee may be charged.

12.2 Right to Rectification (Article 16)

You have the right to request correction of inaccurate personal data and completion of incomplete personal data concerning you. Where technically feasible, you may update certain account details (such as your display name) directly within the app settings.

12.3 Right to Erasure (Article 17)

You have the right to request deletion of your personal data where: it is no longer necessary for the purposes for which it was collected; you withdraw consent and no other lawful basis applies; you object to processing based on legitimate interests and our interests do not override yours; the data has been unlawfully processed; or erasure is required for compliance with a legal obligation.

Important limitation: As described in Section 7.5, data that has been used in AI model training and has been anonymised as part of that process cannot be retroactively identified or removed from trained model weights. This is a technically unavoidable limitation, consistent with ICO guidance on anonymisation.

12.4 Right to Restriction of Processing (Article 18)

You have the right to request restriction of processing in certain circumstances, including where you contest the accuracy of the data, where processing is unlawful but you oppose erasure, where we no longer need the data but you require it for legal claims, or where you have objected to processing pending verification of our legitimate grounds.

12.5 Right to Data Portability (Article 20)

Where processing is based on consent or contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format (JSON), and to request that we transmit it to another controller where technically feasible. To exercise this right, contact us at support@autoprincess.com.

12.6 Right to Object (Article 21)

You have the right to object at any time to processing of your personal data where we rely on legitimate interests as the lawful basis. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is necessary for the establishment, exercise, or defence of legal claims. You have an absolute right to object to processing for direct marketing purposes (we do not engage in such processing without your prior opt-in consent).

12.7 Rights in Relation to Automated Decision-Making (Article 22)

You have the right not to be subject to a decision based solely on automated processing which produces legal or similarly significant effects concerning you, except where necessary for a contract, authorised by law, or based on explicit consent. As described in Section 5.2, our entitlement gating system constitutes automated decision-making within the scope of Article 22. You have the right to request human review of any automated entitlement decision.

12.8 Right to Withdraw Consent (Article 7)

Where we rely on your consent as the lawful basis for processing (specifically, microphone access for audio analysis and camera access for image analysis), you have the right to withdraw that consent at any time without detriment. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. You may withdraw consent by revoking the relevant app permission in your device's operating system settings, or by contacting us at support@autoprincess.com.

12.9 Right to Lodge a Complaint

You have the right to lodge a complaint with the supervisory authority at any time. For UK residents, the relevant supervisory authority is:

Information Commissioner's Office (ICO)
Website: https://www.ico.org.uk
Telephone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

For EEA residents, the relevant supervisory authority is the data protection authority in your country of residence or the country where the alleged infringement occurred.

We would, however, appreciate the opportunity to address your concerns before you contact the ICO, and we encourage you to contact us at support@autoprincess.com in the first instance.

To exercise any of the above rights, please contact us at support@autoprincess.com, providing sufficient information to verify your identity. We will not charge a fee for exercising your rights unless your request is manifestly unfounded, excessive, or repetitive, in which case a reasonable administrative fee may be applied.

13. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, alteration, disclosure, or misuse. Our current security measures include:

Despite these measures, no data transmission over the internet or data storage system can be guaranteed to be 100% secure. We cannot guarantee absolute security of your data and accept no liability for unauthorised access that is beyond our reasonable control, subject to our obligations under applicable law.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of the breach, in accordance with Article 33 UK GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay, in accordance with Article 34 UK GDPR.

14. Children's Data and Age Restrictions

The Software is intended for use by individuals aged 18 (eighteen) years or older. We do not knowingly collect personal data from individuals under the age of 18.

We do not specifically verify the age of users at registration. However, by creating an account and using the Software, you represent and warrant that you are at least 18 years of age. If you are a parent or guardian and believe that a child under 18 has provided personal data to us without your consent, please contact us immediately at support@autoprincess.com, and we will take steps to delete such data from our systems.

We recognise our obligations under the UK Children's Code (Age Appropriate Design Code) (Information Commissioner's Office, 2021). The Software is not directed at children under 18, does not include features designed to engage children, and does not knowingly process children's data. We will not knowingly retain personal data belonging to a minor.

15. App Store Specific Disclosures

15.1 Apple App Store

The Auto Princess application is distributed on the Apple App Store. Users downloading or using the application via Apple platforms should be aware of the following:

15.2 Google Play Store

The Auto Princess application is distributed on the Google Play Store under package identifier com.autoprincess.app. Users downloading or using the application via Google Play should be aware of the following:

16. Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time. We will notify you of material changes through one or more of the following methods:

For non-material changes (such as corrections of typographical errors or clarifications that do not affect your rights), we will update the "Last Updated" date at the top of this Policy without separate notification. Material changes will be indicated by an updated version number.

Where a proposed change involves new or different processing of your personal data that requires your consent, we will request your consent before implementing the change. Your continued use of the Software following notification of material changes constitutes your acceptance of the revised Policy only where consent is not required. Where consent is required, continued use does not substitute for it.

Previous versions of this Privacy Policy are archived and available upon request by contacting us at support@autoprincess.com. A version history is maintained below:

17. Governing Law and Jurisdiction

This Privacy Policy is governed by and construed in accordance with the laws of England and Wales. Any dispute arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of England and Wales, save that nothing in this clause shall limit your rights to bring proceedings before your local courts or before your relevant national supervisory authority under applicable data protection law.

For EEA users: Nothing in this Privacy Policy limits your rights under EU GDPR or your right to bring proceedings before your national data protection supervisory authority or courts.

18. Contact Information and Complaints

For all privacy-related queries, data subject access requests, or complaints, please contact:

Auto Princess Ltd — Data Privacy
Email: support@autoprincess.com
Website: https://autoprincess.com
Post: 71-75 Shelton St, London WC2H 9JQ

We are committed to working with you to resolve any concerns about our processing of your personal data. If you remain dissatisfied after contacting us, you have the right to lodge a complaint with the ICO at https://www.ico.org.uk.

Auto Princess Ltd · Company Number 17155826 · Registered in England and Wales
Version 2.0 | Last Updated 27 June 2026 | support@autoprincess.com

← Back to home