VHC CARE Privacy Policy

Effective date: October 29, 2026

This Privacy Policy explains how VHC CARE ("VHC CARE," "we," "us," or "our") collects, uses, shares, and protects information when you use our website (vhccare.com), our mobile application (АВТО ГРИЖА / VHC CARE), and related services (together, the "Service"). By using the Service, you agree to the collection and use of information as described in this policy.

1. Who we are

VHC CARE is a vehicle fleet compliance and management platform, operated by:

MOBILE APPLICATIONS IP Ltd.
dist. Krasno selo, Municipality Stolichna, str. Han Persian No. 10, ent. B, fl. 1, ap. 4, 1612 Sofia, Bulgaria
UIC/PIC: 201205921

For any question about this policy or your data, contact us at support@vhccare.com.

2. Information we collect

2.1 Account information. Name, email address, phone number (if you add it in Account Settings), and password (never stored in plain text — authentication is handled by Supabase using industry-standard hashing). Each account also gets an internal user ID, which links your data to your account.

2.2 Organization and company information. If used for a company/fleet: legal name, registration number, VAT number, business address, phone, and website.

2.3 Vehicle information. Plate number, make, model, year, VIN, fuel type, engine details, seats, weight, color, odometer, and photos you upload.

2.4 Driver information. Name, phone, email, date of birth, ID/passport number, address, license number and categories, employment type, photo, and any compliance documents you upload for them.

2.5 Compliance documents. Documents and deadlines you track, including any files, scans, or photos attached, and any data extracted from them. These can include health information — for example a driver's medical certificate — if you choose to upload it. Uploading such documents is optional.

2.6 Financial and operational records. Expenses, income, service history, and trip logs. Trip locations are entered manually as text — VHC CARE does not track background GPS location.

2.7 Document scanning (OCR). Scanned images and PDFs are sent to Anthropic's Claude Vision API to extract structured data. They are not used by Anthropic to train models under Anthropic's API terms.

2.8 Push notification data. A device token (via Google Firebase Cloud Messaging), used solely to deliver reminder notifications.

2.9 Invitations. When you invite someone to your company, we store their email address, the role you chose and, if you add one, your personal message, which is included in the invitation email.

2.10 Activity log. We keep a log of team and membership changes in your company — account creation, invitations sent, resent, accepted or cancelled, members leaving or being removed, role changes, ownership transfers, and drivers linked to or unlinked from a login — with who made the change and when. It is used for security and accountability.

2.11 Error reports and diagnostics. When something goes wrong in the app, an error report is sent to Sentry. It contains the error itself, your browser or device type and operating system, your language and time zone settings, the page you were on (without record IDs or search terms), and a short trail of what happened just before the error — pages opened and buttons tapped. We do not attach your name or email address to these reports. They are used to find and fix problems — not to build an advertising profile. We also check that our public pages are online (UptimeRobot); this involves no data about you.

2.12 IP addresses. Our hosting, database and error-reporting providers (Cloudflare, Supabase and Sentry) process your device's IP address when you use the Service, to deliver it and to protect it against abuse. We do not use IP addresses to determine your location.

2.13 What we don't collect. No advertising trackers, no sale of personal information, no knowing collection of data from anyone under 16.

3. How we use your information

• Create and manage your account and organization
• Provide the core Service — vehicles, drivers, documents, expenses, income, services, trips
• Send reminders via email (Resend) and push notification (FCM), per your preferences
• Extract data from documents you choose to scan
• Detect, prevent, and respond to technical problems, fraud, or abuse
• Communicate with you about your account, security, or Service changes
• Comply with legal obligations

We do not use your data for automated decision-making with legal effects, or to serve third-party advertising.

4. Legal basis for processing

• Contract — providing the Service you signed up for
• Legitimate interests — security, fraud prevention, reliability
• Consent — optional features like push notifications, withdrawable in Settings
• Legal obligation — where required by applicable law

5. Who we share information with

We do not sell your personal information. We share information only with the service providers who help us operate VHC CARE:

We may also disclose information if required by law, or in connection with a merger, acquisition, or sale of assets.

Within your organization: information may be visible to other members of your organization according to their role and permissions.

6. Data retention and account deletion

We keep your information while your account exists.

6.1 Deleting your account. You can delete your account yourself, in the app or on the web: Settings → Account Settings → Delete account. If you're not part of any company, "Delete account" is on the screen you see right after signing in. Step-by-step instructions are also on our public Delete your account page. Deletion is immediate and cannot be undone.

6.2 What is deleted.

• Your login and your profile, including the photos you uploaded
• Your push notification registrations
• Invitations sent to your email address
• Every company where you are the only owner, with all its data and files — vehicles, drivers, documents, expenses, income, services and trips. Its other members lose access and are informed by email.

6.3 What stays. In companies that continue (they have other owners, or you are only a member there):

• You are removed and the company's data stays
• Records you created are transferred to the company's owner
• Audit log entries are kept but no longer contain anything that identifies you

This company data and these audit entries are kept as long as the company account exists.

6.4 Backups and retention at our service providers. Error reports (Sentry) are kept for 30 days and email logs (Resend) for 30 days, then deleted automatically. Database backups are taken daily and kept for 7 days; uploaded files are not included in those backups. After you delete your account, your data may remain in these database backups for up to 7 days, until they are overwritten.

6.5 Can't sign in? Email support@vhccare.com from the address you signed up with and ask for your account to be deleted. We respond within 30 days. To delete specific data without deleting your account, contact us using the details in §1.

7. Your rights

• Access the personal information we hold about you
• Correct inaccurate information
• Delete your account and your information yourself — see §6
• Export your data in a portable format
• Object to or restrict certain processing
• Withdraw consent for optional features at any time
• Lodge a complaint with your local data protection authority

To exercise any of these rights, contact us using the details in §1.

8. Data security

• Encryption of data in transit
• Row-level security enforced at the database level
• Restricted, audited access to production systems
• Passwords that appear in known data breaches are rejected when you create an account on the sign-up page, or change or reset your password (checked with Have I Been Pwned — only the first characters of a scrambled form of the password are sent, never the password itself)

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. International data transfers

MOBILE APPLICATIONS IP Ltd. is established in Bulgaria (EU), and your data is primarily hosted in the European Union (Ireland) via Supabase — so most processing already takes place within the EU/EEA. Some subprocessors listed in §5 may process data outside the EU/EEA, relying on appropriate safeguards required by applicable law.

10. Children's privacy

VHC CARE is not directed at, and is not intended for use by, anyone under the age of 16. If you believe a child has provided us with personal information, contact us and we will take steps to delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via email or an in-app notice before the change takes effect.

12. Contact us

support@vhccare.com
MOBILE APPLICATIONS IP Ltd.
dist. Krasno selo, Municipality Stolichna, str. Han Persian No. 10, ent. B, fl. 1, ap. 4, 1612 Sofia, Bulgaria