Privacy Policy
Last updated — 20 August 2026
Applies to: the OKTAN mobile app, oktanhq.com, and all related services.
1. The short version
- We collect what OKTAN needs to keep your car's record and nothing more.
- We do not sell your data. We do not show ads. We do not track you across other apps or websites, and we use no advertising identifiers.
- Usta never receives your name, email, plate, VIN, photos, receipts, costs or location.
- Sharing invoices to improve Usta is off unless you turn it on, and you can erase what you shared.
- You can access, correct, export and delete your data.
2. Who we are
OKTAN is operated by OKTAN HQ, [REGISTERED ADDRESS], the data controller for the information described here.
Privacy contact: privacy@oktanhq.com
Data protection contact / representative: Not appointed.
3. What we collect
You give us:
| Category | What it includes |
|---|---|
| Account | Email address, password (stored only as a salted hash), display name, optional profile photo, language, units, currency, plan |
| Vehicles | Make, model, year, trim, engine, colour, nickname, fuel type, octane, current mileage, and — only if you choose to enter them — VIN and plate number; car photo |
| Service record (Sijil) | Service and modification dates, mileage, service types, cost, shop or garage name, your notes, part and brand, confidence tier |
| Attachments | Receipt and service photos you upload |
| Glovebox | Documents you store — licence, insurance, registration, warranty or other — with title, expiry date and notes |
| Fuel and usage | Fill-ups, quantities, prices, and the maintenance intervals and open issues you track |
| Usta | Your conversations with Usta and the messages in them |
| Support | Anything you send us by email |
Collected automatically:
| Category | What it includes |
|---|---|
| Technical | Device model, device name, operating system, app version, language, IP address, timestamps |
| Diagnostics | Crash reports and error events, the labels of controls you tap, and your account identifier and email address so a report can be traced back to your account |
| Product usage | Which screens you open and which features you use, to see what works and what to improve |
| Usage of Usta | Counts of requests, to enforce plan allowances |
We do not collect: advertising identifiers, contacts, calendar, microphone, health data, browsing history, or any special-category data.
4. Device permissions and why
You control every permission below and can withdraw it at any time in your device settings. Declining a permission disables that feature only — the rest of OKTAN keeps working.
- Camera — to read your odometer and fuel-pump display so you don't type them, and to photograph receipts and documents. Odometer and pump text recognition happens entirely on your device. The image is not sent anywhere for that purpose.
- Photos — only the photos you pick, to set a car picture or attach a receipt.
- Location (while using the app) — to set your units and currency, and to name the fuel station when you log a fill-up.
- Location (background) — used only to remind you to log a fill-up when you arrive at a fuel station. We do not build a location history, do not track your journeys, and do not store your movements. Turn it off at any time and everything else keeps working.
- Face ID / Touch ID / biometrics — to unlock the app and confirm sensitive account changes. Your biometric data never leaves your device and is never accessible to us; your device only tells us whether the check passed.
- Notifications — to send maintenance, document-expiry and fill-up reminders. Reminders are generated on your device.
5. How we use your information
- To provide OKTAN: keep your record, calculate intervals, scores, fuel economy and reminders, and sync across your devices.
- To operate your account, plan and Usta allowance.
- To provide security: authentication, abuse and fraud prevention, rate limiting.
- To fix faults and improve reliability through crash and error diagnostics.
- To understand which features are used, so we can improve the app.
- To respond to support requests.
- To meet legal obligations.
Legal bases (where the GDPR or a similar law applies): performance of our contract with you (providing OKTAN); our legitimate interests (security, fraud prevention, fixing faults, understanding which features are used, protecting the service); your consent (background location, notifications, sharing invoices to improve Usta, and analytics cookies on the website); and legal obligation.
Cookies & the website. On oktanhq.com, analytics cookies are set only after you accept them — the banner on your first visit is the consent, and that consent is our legal basis for website analytics. Decline, and nothing analytics-related is stored; change your mind at any time by clearing this site's storage to see the banner again. Storage that is strictly necessary — remembering your language and your cookie choice — is always used and needs no consent. In the mobile app, product analytics runs under the legitimate interest described above.
6. Usta — exactly what leaves and what does not
When you ask Usta a question, OKTAN sends a strictly limited, structured summary of the car in question to our private gateway, which forwards it to a model provider.
What is sent:
- your message and your chosen language;
- the vehicle's make, model, year, trim, engine, fuel type, octane and current mileage;
- service history entries — date, mileage, service type, your notes, and confidence level;
- maintenance intervals and open issues you track;
- a yes/no flag for whether an entry has an attachment.
What is never sent:
- your name, email address, account identifier or any contact detail;
- your plate number or VIN;
- any photo, receipt, document or attachment;
- any cost, price or amount;
- any shop, garage or fuel-station name;
- your location.
How the model provider handles it. We route every Usta request through our model-routing provider to a specific model, with zero-data-retention routing enabled and data collection, logging and training denied on every request. The provider processes the request to produce the answer and does not retain it or use it to train models.
Anything you type is treated as untrusted content and is never interpreted as an instruction to the system.
Your Usta conversations are stored in your account so you can return to them. You can delete a conversation at any time.
7. Helping Usta read invoices better — opt-in only
If you import an invoice, OKTAN may ask once whether you want to help improve Usta's invoice reading. This is off unless you turn it on.
If you turn it on, we keep — for that purpose only:
- What is shared: the invoice image, our reading of it, and the corrections you made.
- What is never shared: your Sijil, your car, your plate, or your identity.
- What it is used for: training Usta to read invoices. Nothing else, and no third party.
- Turning it off: Settings › Data & Privacy. Turning it off stops sharing new invoices. Invoices already shared stay on file until you erase them, which you can do in the same place — we erase the samples and the stored images, and confirm when it's done.
We record which version of this consent you agreed to, so a change in what we ask for requires a fresh agreement.
8. Who receives your data
We do not sell your personal data and do not share it for advertising. We share it only with service providers who process it on our instructions, under contract, and only in these categories:
| Category of recipient | What they receive |
|---|---|
| Cloud hosting and storage | Your account, records, photos, receipts and documents |
| Model provider behind Usta | Only the limited vehicle context described in §6 — under zero-data-retention, with logging and training denied |
| Mapping and location lookup | Approximate coordinates only, to return a place name or find nearby fuel stations |
| Error and crash diagnostics | Technical diagnostics, your account identifier and email address, device name and IP address, and the labels of controls you tap. If you report a bug from inside the app, what you write and any screenshot you choose to attach |
| Product analytics | Which screens you open and which features you use, with app version and device type. No free text, no photos, no documents |
| App stores and payment processing | Handled under their own privacy policies. We never receive your payment card |
We will name the specific provider in any category on request — email privacy@oktanhq.com.
We may also disclose data if legally required, to enforce our Terms, or to protect the rights, safety or property of OKTAN or others. If we're ever part of a merger or acquisition, your data may transfer — we will notify you and this policy continues to apply until replaced.
9. International transfers
Our providers may process data outside your country, including in the European Union and the United States. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. Contact us for details.
10. How long we keep it
- Your records — for as long as your account is active.
- After you delete your account — we delete or irreversibly anonymise your personal data within 30 days, except where law requires us to keep it longer. Encrypted backups are purged on our normal backup cycle, within 90 days.
- Deleted items — records you delete in the app are marked deleted immediately and removed on our purge cycle.
- Shared invoice training data — kept until you erase it, or until your account is deleted.
- Diagnostics — retained by our diagnostics provider for up to 90 days.
- Product analytics — retained by our analytics provider for up to 12 months.
11. Security
- Passwords are stored only as salted hashes — we never see your password.
- Data is encrypted in transit (TLS) and at rest.
- Session tokens are held in your device's secure hardware store (iOS Keychain / Android Keystore).
- Access to your data is enforced per-owner at the database level, so one account cannot reach another's records.
- Your app never holds a database, storage or model-provider credential — all access goes through our authenticated backend.
- Sensitive account changes require a biometric or password check.
No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authority as required by law.
12. Your rights
You may:
- access the personal data we hold about you;
- correct anything inaccurate — most of it directly in the app;
- delete your account and your data;
- export your data, including a PDF of any car's profile and history;
- withdraw consent at any time — background location, notifications, or invoice sharing — without affecting what was lawful before;
- object to or restrict certain processing;
- complain to your local data protection authority.
To exercise a right you can't complete in the app, email privacy@oktanhq.com. We respond within 30 days. We may need to verify your identity first. These rights are free; we may charge only for a manifestly excessive or repetitive request.
13. Children
OKTAN is not for children under 16. We do not knowingly collect their data. If you believe a child has given us personal data, contact privacy@oktanhq.com and we will delete it.
14. Changes to this policy
We may update this policy. We will post the new version with a new "Last updated" date and, for material changes, notify you in the app or by email before it takes effect.
15. Contact
OKTAN HQ · [REGISTERED ADDRESS]
Privacy: privacy@oktanhq.com · General: support@oktanhq.com