Privacy Policy - DrivePro

1. Who we are

DrivePro is operated by Develp Media Ltd, a company registered in England and Wales (company number available on request). We are the data controller for personal data processed through this service.

2. What data we collect

We collect the following categories of personal data:

Instructor account data: name, email address, phone number, address, DVSA ADI licence number, bank details (via Stripe - we do not store card numbers directly)
Pupil data: name, email, phone number, date of birth, emergency contact details, driving licence number, lesson history, DVSA syllabus progress, test results
Financial data: lesson charges, payments received, expenses, mileage records - used for MTD VAT submissions
Usage data: log-in times, feature usage, error logs - used to improve the service
Communications: support emails and messages sent to us

3. How we use your data

To provide and operate the DrivePro service
To process payments via Stripe
To send lesson reminders to pupils on your behalf (SMS via AWS Pinpoint)
To submit MTD VAT returns to HMRC on your instruction
To send service emails (account updates, invoices, important notices)
To improve and debug the service

We do not use your data for advertising or sell it to third parties.

4. Legal basis for processing

Contract performance: processing necessary to deliver the service you have subscribed to
Legal obligation: MTD VAT submission, fraud prevention
Legitimate interests: service improvement, security monitoring, abuse prevention
Consent: where we ask for it (e.g. marketing emails)

5. Data storage and security

All data is stored securely in the United Kingdom. We use industry-standard encryption for data in transit and at rest. Access to personal data is restricted to authorised personnel only.

We are registered with the Information Commissioner's Office (ICO) under UK GDPR.

6. Data retention

Instructor account data: retained for the duration of your subscription plus 7 years (HMRC record-keeping requirements)
Pupil data: retained for 3 years after the pupil's last lesson, unless you request earlier deletion
Financial records: 7 years (legal requirement)
Support communications: 2 years

7. Third parties we share data with

Stripe - payment processing (Stripe's privacy policy applies to card data)
AWS - cloud infrastructure and SMS delivery (data stays in UK regions)
HMRC - MTD VAT submissions on your instruction
OpenAI - AI voice debrief transcription (where feature is used; audio deleted after processing)

We do not share your data with any other third parties without your explicit consent.

8. Your rights

Under UK GDPR you have the right to:

Access the personal data we hold about you
Correct inaccurate data
Request deletion of your data (subject to legal retention obligations)
Object to or restrict processing
Data portability - export your data in a machine-readable format
Withdraw consent at any time (where processing is consent-based)

To exercise any of these rights, email hello@drivepro.app. We will respond within 30 days.

You also have the right to lodge a complaint with the ICO at ico.org.uk.

9. Cookies

We use essential cookies to keep you logged in and remember your preferences. See our Cookie Policy for full details.

10. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by email. Continued use of DrivePro after changes take effect constitutes acceptance.