Privacy

Who is responsible

Operated by JP Carpentry and Construction Ltd. info@jpcarpenters.co.uk

This notice covers the iPhone app, its optional account service and this support website. We review it when the service changes.

Your van stays on your iPhone

VanBrain saves tool details, optional serial numbers and photos, consumable references, shopping items and job checklists locally. You can continue without an account. The current version does not upload or synchronise your inventory. Signed-in accounts use separate local records; copying your existing device records into an account is an explicit choice and keeps the originals.

Edit or remove records in the app. Local records remain until you remove them or the app’s data is removed. Your Apple device-backup settings may preserve additional copies.

Optional Apple and email accounts

If you choose to create an account or sign in, Supabase processes your email address, account identifier and authentication information to provide and secure your account. Email passwords are sent over an encrypted connection to the authentication service; VanBrain does not save your password on the device. Sign in with Apple shares an Apple authentication credential and the email address Apple permits, which may be a private relay address. VanBrain does not receive your Apple password.

Resend delivers account confirmation and password-reset emails and processes the recipient address, email contents and delivery status. These are service emails, not marketing. Resend states that email and log data on its Free plan is retained for 30 days, with point-in-time backups retained for 7 days. Its stored data is held in the United States; a European sending region does not change that storage location. Resend describes UK transfers as covered by Standard Contractual Clauses in its Data Processing Agreement. See Resend’s security and retention information. These provider arrangements are separate from deletion of a VanBrain account. Your session is stored using the iPhone Keychain. Signing out ends the device session; it does not delete your account or saved records.

We use account information to provide the account service you request and security records to protect it. Account records are retained while your account exists; delivery and security records are retained for service operation, security and applicable legal requirements. Contact the operator for access, correction or erasure of information held by us. We cannot remotely erase records stored only on your iPhone. Multi-device inventory sync is not available.

Public catalogue updates

VanBrain checks for updates to its public tool and consumable catalogue using a Supabase-hosted download. This request does not include your saved tools, photos, job records, account identifier or sign-in token. It may include a reference identifying the previously downloaded catalogue version so unchanged data need not be downloaded again.

The hosting service receives technical request information, including the network address needed to deliver the response, and handles operational and security logs under its own arrangements. Catalogue downloads do not synchronise your inventory. If an update cannot be verified, the app keeps its accepted local catalogue or bundled fallback.

Photos are optional

Camera access is requested when you choose to take a tool photo. The system photo picker shares only the content you select. You can use the inventory without camera access. A smaller copy of the chosen photo is saved with the tool.

Exports and sharing

Backups and sharing happen when you choose them. The app does not send your backup to us. Files providers and destinations you select handle those copies under their own policies. Delete exported and shared copies separately when you no longer need them.

Account-deletion recovery records

After an account-deletion request, the service temporarily keeps a recovery record with your account identifier, a hashed random recovery reference and request and expiry times. This lets the app check whether deletion completed if the connection was interrupted. It contains no inventory, photos or purchase history and is not used for advertising. The record expires after 30 days and is removed by the next successful scheduled cleanup. Provider logs and backups may have separate retention arrangements.

Short-lived counters limit repeated deletion recovery checks. They contain hashed recovery references and time buckets, not IP addresses or raw recovery references, and are removed after one hour by the next successful scheduled cleanup.

Amazon links

Version 1.0 disables Amazon purchase actions, including previously saved offers. Version 1.0.1 restores external Amazon UK buying links for verified catalogue items. Manufacturer reference links remain available in both versions; opening an external reference sends a normal web request to that source.

In version 1.0.1 and other purchasing-enabled builds, purchase actions open Amazon outside VanBrain. Links contain the selected product identifier and our affiliate tracking ID, not your serial numbers, job notes or inventory. Amazon handles browsing and purchases under its own privacy notice. VanBrain does not receive your payment details or order confirmation.

As an Amazon Associate we earn from qualifying purchases.

Diagnostics and feedback

The account service also keeps technical records of authentication requests, including the connecting network address, request path, response status, processing duration and request identifiers. We use these records to operate, troubleshoot and secure the account service. They may be associated with an account or request; we do not describe them as anonymous. These service records are separate from your local tool inventory and from advertising analytics. Provider retention and backup arrangements apply separately from deleting your VanBrain account.

The current app has no active analytics upload. Feedback and diagnostics made available through Apple TestFlight are handled through Apple’s testing service. Review what you share, particularly screenshots.

Contacting support

When you contact us, we use your email address, name if provided, message and any attachments to answer your enquiry and investigate problems. Our lawful basis is our legitimate interest in providing support and maintaining a reliable app. We use Google Workspace to receive and store correspondence. Relevant staff and service providers may access information to handle the enquiry or operate the service. We retain support correspondence for as long as needed to resolve enquiries, provide related support and meet legal obligations or handle disputes. We review retained correspondence and delete or anonymise personal information when it is no longer needed.

This website

These pages contain no advertising scripts, analytics scripts, embedded third-party content or contact form.

These VanBrain pages are hosted using ChatGPT Sites. The hosting service processes technical request information, such as IP address, browser information and request time, to deliver and protect the pages. We rely on our legitimate interest in operating a secure, available support website. Provider retention depends on service delivery, security and legal needs. Krystal manages the domain and DNS; it does not host our support mailbox. These VanBrain pages do not load the business website’s Google Analytics or enquiry form. Cloudflare provides network protection and may set the __cf_bm security cookie, which expires after 30 minutes of inactivity. This is used to distinguish automated traffic, not for VanBrain advertising. Cloudflare may process cookie data in the United States.

Providers and overseas processing

Google Workspace, OpenAI, Supabase and Resend may process information outside the UK. Their published terms describe applicable transfer safeguards, including adequacy arrangements and contractual safeguards for UK data. See Google’s data processing terms and OpenAI’s privacy policy for provider processing, retention and safeguards. Account providers explain their processing in Supabase’s privacy notice, Supabase’s data processing terms and Resend’s privacy notice. Cloudflare explains its security cookies and overseas processing. Contact us for information about safeguards relevant to your enquiry.

We may retain or disclose information where necessary to comply with a legal obligation or establish, exercise or defend legal claims. We do not use support enquiries for automated decisions with legal or similarly significant effects.

Your information rights

Depending on the circumstances, you can ask to access, correct or erase personal information held about you, restrict its use, object to processing or request a portable copy. Where processing relies on consent, you can withdraw it. Contact the operator above about information held through support or feedback. We cannot remotely access or erase the inventory stored only on your phone.

You can raise a concern with the Information Commissioner’s Office.