Privacy Policy

Last Updated: January 15, 2025

1. Who We Are

Data Controller: Car Crash Lawyer AI

We provide incident documentation services for car accidents, helping you collect and organize evidence for insurance and legal purposes.

2. Important Legal Disclaimer

3. What Data We Collect

When you use our service, we collect:

• Account Information: Email address, name, phone number
• Incident Details: Date, time, location (including what3words coordinates), accident description
• Evidence Files:
  • Photos of accident scene and damage
  • Dashcam video footage
  • Voice recordings and witness statements
• AI-Generated Content: Automated transcriptions and summaries of your recordings
• Emergency Contacts: Phone numbers for recovery services and personal emergency contacts
• Technical Data: IP address, browser type, device information (for security and service improvement)

Data Minimization

We follow GDPR's data minimization principle:

• We collect only data necessary for providing the documentation service
• We don't require personal data beyond what's needed for incident recording
• You can choose which optional fields to complete
• Technical data (IP addresses, device info) is used only for security and fraud prevention

4. Why We Collect Your Data (Legal Basis)

We process your personal data based on:

• Your Consent: You explicitly agree to our data processing when you sign up
• Contract Performance: We need your data to provide the incident documentation service you requested
• Legitimate Interest: Improving our service and preventing fraud

5. How We Use Your Data

We use your information to:

• Create comprehensive incident reports
• Transcribe audio recordings using AI (OpenAI Whisper)
• Generate AI summaries of witness statements for clarity
• Store evidence securely for your records
• Contact emergency services when you request it
• Provide location services via what3words
• Send you your completed incident reports via email

AI-Powered Analysis Features

Our AI analysis tools help you organize and review your incident information:

• Transcription: Audio recordings converted to text using OpenAI Whisper
• Summarization: Key points extracted from your statement using GPT-4
• Quality Review: AI checks for completeness (time, location, witnesses, injuries)
• Completeness Scoring: Automated assessment of documentation thoroughness
• Next Steps Suggestions: General recommendations based on your incident details

Important: AI analysis is generated by automated algorithms and:

• May contain errors or inaccuracies
• Is not reviewed by legal professionals
• Should not be relied upon as legal advice
• Is intended to help you organize information only

Emergency Services Integration

When you use emergency features:

• Emergency Contacts: You can save phone numbers for quick dial (stored locally on your device)
• Location Sharing: what3words coordinates can be shared if you choose
• No Automatic Calls: We never call emergency services without your explicit action
• User Control: All emergency functions require your manual trigger

6. Third-Party Services We Use

We work with trusted partners to provide our service:

OpenAI (Transcription & AI Analysis)

• What they do: Convert your audio recordings to text and provide AI analysis
• Data sent: Audio files and transcription text (no personal identifiers)
• Location: USA (EU-US Data Privacy Framework compliant)
• Privacy policy: openai.com/privacy

Supabase (Data Storage)

• What they do: Securely store your data and files
• Data sent: All account and incident data
• Location: Configurable - UK/EU regions available for GDPR compliance
• Security: AES-256 encryption at rest, TLS 1.3 in transit
• Privacy policy: supabase.com/privacy

what3words (Location Services)

• What they do: Convert GPS coordinates to 3-word addresses
• Data sent: Location coordinates only
• Location: UK-based
• Privacy policy: what3words.com/privacy

7. Data Security

We protect your data using:

• Encryption: All data encrypted in transit (HTTPS/TLS 1.3) and at rest (AES-256)
• Access Control: Only you can access your incident reports
• Secure Storage: Files stored in private, encrypted buckets
• Authentication: Supabase Auth with secure session management
• Regular Backups: Data backed up daily to prevent loss

Audit Logging & Access Control

• Activity Logging: All data access and modifications are logged with timestamps
• Access Monitoring: System tracks who accesses your data and when
• Audit Trail: You can request logs of all access to your account
• User-Only Access: Only you can access your incident reports (except when legally required to disclose)

8. How Long We Keep Your Data

Active Data Retention: Up to 365 days (1 year) from creation by default

You have control:

• Delete Anytime: Request deletion of your data at any time
• Extended Retention: Keep data longer if needed for legal proceedings (you must request this)
• Automatic Archival: After 1 year, data is archived (can be restored on request)
• Permanent Deletion: Archived data can be permanently deleted on request

Backup Retention: Deleted data is removed from backups within 90 days of deletion request.

9. Your Rights Under UK GDPR

You have the right to:

Right to Access

Request a copy of all your personal data we hold

Right to Rectification

Correct any inaccurate or incomplete data

Right to Erasure ("Right to be Forgotten")

Request deletion of your data (we'll comply within 30 days)

Right to Restriction

Limit how we process your data in certain circumstances

Right to Data Portability

Receive your data in a portable format (JSON/PDF)

Right to Object

Object to processing based on legitimate interests

Right to Withdraw Consent

Remove your consent at any time (may limit service functionality)

10. AI Listening Feature - Special Notice

Our AI Listening feature provides continuous audio recording for hostile situations:

• What it does: Records audio continuously across multiple app pages
• When to use: Only in confrontational or threatening situations
• Legal basis: UK law permits one-party consent recording (you are a party to the conversation)
• Data storage: Transcripts stored, audio chunks processed then deleted
• Your control: You start and stop the feature manually

Important: While legal in the UK, use this feature responsibly and only when documenting evidence is necessary.

11. Automated Decision-Making

We use automated processing (AI) to analyze your incident statements. This processing:

• Does NOT make decisions that legally affect you
• Does NOT determine legal outcomes or liability
• Only provides informational analysis to help you organize your documentation
• You are free to ignore or disregard any AI-generated analysis

No automated decisions are made that have legal or similarly significant effects without human review.

12. Cookies and Tracking

We use essential cookies only:

• Authentication cookies: Keep you logged in (7-day expiry)
• Session cookies: Remember your preferences during your visit

We DO NOT use:

• Advertising cookies
• Analytics cookies without consent
• Third-party tracking

13. Children's Privacy

Our service is not intended for users under 18. If you are under 18, please do not use this service or provide any personal data.

14. Changes to This Policy

We may update this privacy policy occasionally. When we do:

• We'll update the "Last Updated" date at the top
• Significant changes will be notified via email
• Continued use of the service means you accept the updated policy

15. Data Breaches

In the unlikely event of a data breach affecting your personal data, we will:

• Notify you within 72 hours
• Report to the ICO (Information Commissioner's Office) if required
• Take immediate steps to secure your data

16. International Transfers

Some data is processed outside the UK/EU (e.g., OpenAI in the USA). We ensure adequate protection through:

• Standard Contractual Clauses (SCCs)
• EU-US Data Privacy Framework compliance
• Encryption and security measures

← Back to Home