Privacy

Privacy Policy

Last updated 6 September 2026

TyreSpot is a marketplace that connects drivers with independent tyre garages. This policy explains exactly what data the TyreSpot app and website collect, why, who it is shared with, and how to get it deleted.

1. Who we are

TyreSpot (“TyreSpot”, “we”, “us”) operates the TyreSpot website at tyre-spot.com and the TyreSpot mobile app for iOS and Android. We are the data controller for the personal data described in this policy.

2. What we collect and why

Data	Why we need it	Given by
Name and email address	To create and run your account, and to send booking confirmations and service emails	You, at sign-up
Password	To sign you in. Passwords are hashed by our authentication provider and are never visible to us	You, at sign-up
Phone number	So the garage can reach you about your appointment. Optional for drivers, required for garages	You
Postcode	To search for garages near you without using GPS	You
Location (approximate and precise)	To show garages near you and sort them by distance. Optional — refuse it and search by postcode instead	Your device, only with your permission
Vehicle registration and tyre size	To show available vehicle details and tell the garage what to prepare. UK registration lookup is a UK-only feature; it does not determine tyre size	You
Photographs of tyres	To read the tyre size and brand from the sidewall	Your camera or photo library, only with your permission
Profile picture, garage logo and garage photos	To show your account and garage listing	You
Booking details and history	To create, run and evidence your bookings	Created as you use TyreSpot
Payment details	To take payment. Card details go directly to Stripe and never reach TyreSpot's servers. We store only the last four digits, card brand and a Stripe reference	You, via Stripe
Messages between you and a garage	So you can discuss your booking	You
Reviews you write	To show other drivers what a garage is like	You
Support tickets and messages	To answer your questions	You

We do not use advertising SDKs, we do not read your advertising ID, we do not track you across other apps or websites, and we do not sell your data. TyreSpot does not contain third-party advertising.

4. Who we share data with

Recipient	What they receive	Why
The garage you book with	Your name, phone number, vehicle registration, tyre requirement, appointment time and your messages	They have to know who is arriving and what to fit. Garages are independent businesses and are separate data controllers for what they do with it.
Supabase	All account, booking, message and review data	Our database, authentication, file storage and server functions. Hosted in the UK (London) region.
Stripe	Payment card details, amount, currency and a booking reference	To take payment and to pay garages. Card numbers go to Stripe directly and are never stored by TyreSpot.
Google (Maps and Places)	Your approximate or precise location and search terms	To render maps, sort garages by distance and autocomplete addresses.
Google (Gemini)	The tyre photograph you take or choose	To read the tyre size from the sidewall. The image is sent for analysis and is not kept by TyreSpot after the result is returned.
Google or Apple, if you use their sign-in	Your email address and name from that account	To sign you in without a separate password.
Resend	Your email address and the content of the message	To send booking confirmations and account emails.
A UK vehicle-data provider	The registration you enter	To return available vehicle details. UK only; it does not return tyre size.

We also disclose data where the law requires it, and to professional advisers or a buyer if the business is ever sold.

5. Where your data is processed

TyreSpot's database and file storage are hosted in the United Kingdom. Some of our processors — Stripe, Google and Resend — process data in the United States and elsewhere. Those transfers rely on the UK International Data Transfer Addendum, EU Standard Contractual Clauses, or an adequacy decision.

6. How long we keep it

Account data — until you delete your account.
Tyre photographs — sent for analysis and not retained after the result is returned.
Messages and reviews — until you delete your account. Review ratings stay attached to the garage without your name.
Booking, payment and refund records — six years from the end of the relevant tax year, because UK tax law requires it. After account deletion these are stripped of your personal details.
Support tickets — two years.

7. Deleting your account and your data

You can delete your TyreSpot account yourself, at any time, from inside the app: Profile → Security & Privacy → Delete My Account. On the website it is under Account → Security.

Full detail of what is deleted, what is kept and for how long is on our account deletion page.

8. Your rights

You have the right to access, correct, delete, restrict, object to and port your personal data, and to withdraw consent. Use Security & Privacy → Export My Data in the app, or email hello@tyre-spot.com. We respond within one month.

If you are unhappy with how we handled your data you can complain to the UK Information Commissioner's Office at ico.org.uk, or to your local supervisory authority in the EU.

9. Security

All traffic between the app, the website and our servers uses HTTPS with TLS. Access to the database is restricted per-user by row-level security so one account cannot read another account's data. Passwords are hashed. Card numbers never touch our servers.

10. Children

TyreSpot is for drivers and garage operators and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has created an account, email us and we will remove it.

11. Cookies

The website uses cookies that are necessary to keep you signed in and to remember your preferences. See our cookie policy. The mobile app does not use cookies and stores your session securely on your device.

12. Changes

If we change this policy we will update the date at the top of this page and, for material changes, tell you in the app or by email.