This Privacy Policy explains how Vroomi collects, uses, shares and protects your personal data when you use our mobile app and website. We are committed to protecting your privacy and handling your data in line with the UK GDPR and the Data Protection Act 2018.
1. Who we are
Vroomi is a driving-lesson marketplace app operated by Arri Tech Ltd ("we", "us", "our"), a company registered in England and Wales under company number 13784390, with its registered office at 9 Telford Road, Southall, Middlesex, UB1 3JG. "Vroomi" is a trading name of Arri Tech Ltd.
For the purposes of UK data-protection law, Arri Tech Ltd is the data controller of the personal data described in this policy. If you have any questions, contact us using the details in section 13.
[If you are required to register with the ICO as a data controller, add your ICO registration number here. Most businesses processing personal data must pay the ICO data-protection fee.]
2. The data we collect
Depending on how you use Vroomi (as a learner, instructor or driving school), we may collect the following categories of personal data:
| Category | Examples |
|---|---|
| Identity & contact | Name, username, email address, phone number, profile photo |
| Location | Home postcode and approximate location coordinates, used to match learners and instructors by distance and travel radius |
| Account & role | Whether you are a learner, instructor or school; ADI/PDI status; languages; transmission; availability |
| Driving licence | Photos of your driving licence, where you choose to upload them for verification |
| Lessons & progress | Bookings, lesson history, progress notes, mock-test records, messages between users |
| Payment | Subscription and payment information. Card details are collected and processed by our payment provider, Stripe — we do not store your full card number |
| Technical | Device information, app version, IP address, push-notification tokens, and usage/diagnostic data |
We collect this data when you create an account, complete your profile, book or give lessons, message other users, make a payment, or contact our support team.
3. How we use your data
We use your personal data to:
- Create and manage your account and profile;
- Match learners with instructors and schools based on location, transmission, language and availability;
- Enable bookings, messaging, lesson tracking and mock-test records;
- Take payments and manage subscriptions;
- Send you service messages (such as booking confirmations, and account or payment notifications);
- Provide customer support and respond to your enquiries;
- Keep Vroomi secure, prevent fraud and misuse, and improve our service;
- Comply with our legal and regulatory obligations.
4. Our legal bases for using your data
Under UK GDPR we rely on the following legal bases:
- Contract — to provide the Vroomi service you have signed up for (for example, matching, bookings and payments).
- Legitimate interests — to keep our service secure, prevent fraud, and improve Vroomi, where this is not overridden by your rights.
- Consent — for optional things such as marketing communications and non-essential cookies. You can withdraw consent at any time.
- Legal obligation — where we must process data to comply with the law (for example, tax and accounting records).
5. Who we share your data with
We do not sell your personal data. We share it only with trusted service providers ("processors") who help us run Vroomi, and only as needed. These currently include:
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication and file storage (hosting your account and app data) |
| Stripe | Payment processing and subscription billing |
| SendGrid (Twilio) | Sending transactional emails |
| Twilio [if SMS/OTP enabled] | Sending SMS one-time passcodes for sign-in |
| Google Firebase | Push notifications |
| DVSA / DVLA APIs [if used] | Vehicle MOT and tax lookups |
[Confirm this list is complete and accurate before publishing. Add or remove providers to match what you actually use. Each provider should have a data-processing agreement in place.]
We may also share data with other Vroomi users where you choose to — for example, an instructor sees a learner's name and booking details when a lesson is arranged. We may disclose data if required by law, or to protect our rights, users or the public.
6. International transfers
Some of our providers may process data outside the UK. Where they do, we ensure appropriate safeguards are in place (such as UK adequacy regulations or the International Data Transfer Agreement / Addendum). [Confirm the hosting regions of your providers — for example, which region your Supabase project is hosted in — and update this section accordingly.]
7. How long we keep your data
We keep your personal data only for as long as we need it for the purposes set out in this policy, and to meet our legal obligations. In general:
- Account data is kept while your account is active, and for [X months/years] after you close it;
- Payment and invoice records are kept for [6 years — confirm with your accountant, per UK tax rules];
- Driving licence images are kept [state your retention period — ideally deleted once verification is complete].
[Set real retention periods for each data type. Vague or missing retention periods are a common cause of GDPR complaints.]
8. Your rights
Under UK data-protection law you have the right to: access your data; correct inaccurate data; request erasure; restrict or object to processing; data portability; and withdraw consent. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
To exercise any of these rights, contact us using the details in section 13. We will respond within one month.
9. Children and young people
You can legally start learning to drive a car in the UK at 17 (or earlier in some cases), so some Vroomi learners may be under 18. We take extra care with young people's data. [State your minimum age to hold an account, how you handle under-18 users, and — if you allow under-13s in any circumstance — how you obtain parental consent. UK GDPR sets 13 as the minimum age a child can consent to online services in the UK. This section should be reviewed carefully as children's data carries heightened obligations.]
10. How we protect your data
We use technical and organisational measures to protect your data, including encryption in transit, access controls, and reputable infrastructure providers. No system is completely secure, but we work to protect your information and to notify you and the ICO of any breach where legally required.
11. Cookies
Our website uses cookies and similar technologies. For full details of what we use and how to manage your choices, please see our Cookie Policy.
12. Changes to this policy
We may update this policy from time to time. When we do, we will change the "last updated" date above, and where changes are significant we will let you know. Please check back periodically.
13. Contact us
For any privacy question, or to exercise your rights, contact us via our contact form, or write to: Arri Tech Ltd, 9 Telford Road, Southall, Middlesex, UB1 3JG. [Add a dedicated privacy contact email if you have one, and DPO details if you have appointed one.]