MotorCommandAI Privacy Policy
Last updated: 1 November 2026
This policy explains what personal data MotorCommandAI handles, why, where it goes and how long it is kept.
Who we are
MotorCommandAI is provided by CommandStack Technologies Ltd, 124 City Road, London, EC1V 2NX ("we", "us").
Company number: 17550104. Registered in England and Wales; the address above is our registered office.
ICO registration: ZC287545.
Contact us about privacy, or to complain, at info@commandstacktechnologies.co.uk.
MotorCommandAI is business software for motor dealers and vehicle service businesses ("dealerships"). It is sold only to businesses, for use by their staff.
Our role
- For staff accounts and the security of the service (your name, email address, dealership and site memberships, sign-in and device records), we are the controller. Your dealership's account owner gives us your name and email address when they invite you.
- For the dealership's own records (its customers, vehicles, quotes, invoices, jobs and documents), the dealership is the controller and we act as its processor. We only handle those records on the dealership's instructions, under our Terms of Service, and the dealership is responsible for the legal basis for them.
- If you are a customer of a dealership, for example you received a quote link or used its enquiry form, the dealership's own privacy notice explains how it uses your data. Contact the dealership first; we will help it respond.
What stays on the phone
A dealership's operational records are stored on the staff member's iPhone, in storage that iOS encrypts and keeps unreadable after a restart until the phone is first unlocked. Photos, signatures and documents are stored as protected files. They are not uploaded to our servers or synchronised between phones, except for the features listed below or by restoring an encrypted backup.
If the phone's iCloud Backup or computer backup is switched on, iOS includes these records in that backup. Those backups are held by Apple or on your computer, under your own account and settings, not by us.
Data that leaves the phone, and why
- Staff accounts. When you sign in, your name, email address, dealership, site and role are held by our account service, so we can confirm who you are and what your role lets you see and do. Sign-in codes and passwords are handled by our login provider; MotorCommandAI never sees your password. A device-bound session is kept in the phone's Keychain.
- Customer links. When staff send a quote, invoice, signed order or tracking page to a customer, the document and the details on it are published on our service at a private link. This includes the customer's name, contact details, address, vehicle and price, and on invoices the dealership's bank details for payment. The customer's response (for example accepting or declining, and the name they type) is recorded with the date, their IP address and browser details, as evidence of the response, and returned to the dealership.
- Transport enquiries. Enquiries submitted through the dealership's web form (names, phone, email, vehicle, collection and delivery addresses and notes) are held for the dealership. How long depends on its inbox (see "How long we keep it").
- Transport Office. If a dealership uses the Transport Office web page, its phone sends a copy of each transport job to our service so the people the dealership approves can see its jobs on a computer. The copy holds the vehicle's registration, make and model, the customer's name and phone number, the collection and delivery towns and postcodes, the date, the job's stage and when each stage happened. It holds no prices, costs, invoices, notes, photos, signatures or street addresses. People sign in to the page with their staff account and see only what their role allows; a cookie keeps them signed in for up to 8 hours. Notes they add for the driver are kept with the job and shown on the dealership's phone.
- Vehicle lookups. When staff look up a registration, it is sent to the DVLA Vehicle Enquiry Service and the DVSA MOT History service and, where those are unavailable, to the MotCheck vehicle-data service. Only the registration is sent; they return the vehicle's details.
- Vehicle tracking. For transport jobs with a tracker, the tracker's latest position is held so the dealership and its customer can follow the delivery.
- Vehicle listings and part-exchange photos. Listing pages and part-exchange upload links hold the photos and vehicle details the dealership or its customer chose to share.
- MCAI, the assistant. MCAI sends data to OpenAI, a third-party AI service, only after MCAI's OpenAI setting is switched on, on that phone. That setting is the dealership's decision: under our Terms, the dealership must authorise its staff before they switch it on. When MCAI is used, your request and the workspace details needed to understand it are sent. Before sending, we remove unrelated fields and replace recognised names, contact details, registrations and record IDs with temporary references. This is pseudonymisation, so the request is still personal data, and free text you type can still contain personal details. Data migration uses the same setting, but it sends sample rows or the selected file without those temporary references. Our requests ask OpenAI not to store them for later use. OpenAI may still keep each request for up to 30 days to check for abuse, then deletes it. With the setting off, nothing is sent to OpenAI.
- Encrypted backups. Where a dealership uses Backup & Recovery, the phone encrypts its records with the dealership's key before upload. We store the encrypted backup but cannot read it without that key.
- Notifications. If you allow notifications, Apple's push notification service delivers them using a device token. A notification shows only the customer's response, the vehicle registration and the amount, never a customer's name.
- Security. The app creates an installation identifier and sends it when you sign in and with each request, so a workspace stays bound to the phones approved for it. Our service keeps that binding while the phone is enrolled, and short-lived security records, such as request counts per IP address, to prevent abuse. Our service's error logs are designed not to contain customer data: before an error is logged, link addresses, email addresses, phone numbers, registrations and IP addresses are removed from it.
- Feedback and support. If you send feedback or email us, we receive what you choose to include and keep it as long as we need it to help you. Our email is provided by Microsoft.
On the phone, if you choose to use them: Face ID unlocks the app (handled by iOS; we never receive face data), the camera captures vehicle photos and documents, the microphone and speech recognition let you dictate instructions (processed by Apple, which may use its servers), and Calendar receives transport bookings you confirm. You can refuse any of these and still use the rest of the app.
Who processes data for us
Our sub-processors, which handle data on our instructions under contract:
- Cloudflare: hosting, storage, customer links and security for our service.
- Amazon Web Services (Amazon Cognito): staff sign-in.
- OpenAI: the MCAI assistant, only when its setting is on.
- Microsoft (Microsoft 365, supplied through GoDaddy): our email, for support, privacy and other messages you send us.
Other organisations that receive data to provide their own service:
- DVLA and DVSA, which return vehicle and MOT details for a registration.
- MotCheck, which returns vehicle details for a registration when the DVLA and DVSA services are unavailable.
- Apple, which delivers notifications and provides maps and speech recognition.
- The OpenStreetMap Foundation, whose map servers draw the map on a customer's tracking or transport job page. The customer's browser fetches map images for the area around the vehicle, so those servers receive the browser's IP address, that area and our website's address, but not the page's private link.
Some of these organisations may process data outside the UK. Where they do, the transfer relies on the safeguards UK data protection law requires: UK adequacy regulations (such as the UK–US data bridge, for certified US providers) or the International Data Transfer Agreement or Addendum in the provider's data processing terms.
We do not sell personal data, use it for advertising or track you across other apps and websites. We do not use dealerships' records for our own purposes.
Our legal bases
- Staff account and security data: our legitimate interests in providing a secure service to the dealership that employs or engages you, and in preventing abuse.
- The dealership's records: we handle these on the dealership's instructions, as its processor; the dealership is responsible for the legal basis.
- Support, feedback and complaints: our legitimate interests in answering you and improving the service.
- Records the law requires us to keep: our legal obligations.
We do not make decisions about you based solely on automated processing.
How long we keep it
Some data is deleted automatically by our storage a set time after it was last written (sending or updating the same item again restarts that time). Other data is deleted by a clean-up our service runs every day. The rest is kept as the dealership's record until the dealership asks us to delete it.
- Customer links. A document link stops opening when it expires (up to 90 days), and its PDF file is deleted from storage 90 days after it was last published. A transport job page stops opening 7 days after delivery, 30 days after the job is declined or cancelled, or, while the job is still open, 90 days after the dealership last updated it. A tracking page is deleted 30 days after its last update, or 7 days after its last update once the vehicle is delivered. A copy of what was sent is deleted from our database 12 months after the link expires. The customer's response, with the name they typed, their IP address and browser details, is deleted 12 months after it was made. The dealership's phone keeps its own copy.
- Transport enquiries. Dealerships using the recoverable inbox keep every enquiry, collected or not, until they ask us to delete them, so a lost phone can recover them. For other dealerships, an enquiry not collected within 14 days expires, and is deleted 30 days after it expires. A collected enquiry is deleted 30 days after it was collected.
- Transport Office. A job's copy is replaced each time the job changes on the phone. When the job is deleted on the phone, its copy and its notes are deleted at once, leaving only a record that the job was deleted. Copies, those records and notes are deleted by our daily clean-up 12 months after the job last changed.
- Tracker locations. A tracker's latest position is deleted automatically 30 days after its last report.
- Part-exchange upload links. The link and the photos and details uploaded through it are deleted automatically 90 days after the link was created or last used.
- Vehicle listings. Deleted automatically 180 days after they were last published.
- Encrypted backups. We keep the 30 most recent backups and the latest backup of each of the last 30 days; our daily clean-up deletes older ones, and unfinished uploads after 2 days. All of a dealership's backups are deleted when it asks us, or when its agreement ends. The app does not delete a stored backup itself.
- Security counters. Deleted automatically after about an hour.
- Error logs. Kept by Cloudflare for 3 days.
- Cloudflare's request records. Cloudflare, which hosts our service, keeps its own records of requests made to it: the address requested (which can include the code in a private link) and the IP address. It keeps them for security and to run its network, for the period its terms set. We can't switch these records off, and we don't use them to identify anyone.
- Device bindings. Kept while the phone is enrolled; notification tokens are removed when a phone signs out or Apple reports them invalid.
- Staff accounts. Kept while the account is active. Deleting your account removes your name, email address and memberships from our account service at once, and we remove your sign-in identity from our login provider within one month. We keep a record that the deletion happened, containing only internal identifiers and the date, for 6 years, with our other account security records.
When a dealership leaves or asks us to delete its data
When a dealership's agreement ends, or its account owner asks us in writing (whichever is earlier), it has 30 days from that day to export its hosted records. If it tells us it does not need an export, that period ends on the day it tells us. Within 30 days after the export period ends, we delete the dealership's records from our service:
- customer-link copies and responses;
- transport enquiries;
- Transport Office job copies and notes;
- documents and photos;
- listings and part-exchange uploads;
- tracker positions;
- encrypted backups;
- its staff sign-in identities.
Sending an export does not change these dates. We then confirm in writing what we deleted. This is done by our team, not automatically. Copies in our hosting provider's recovery system expire automatically within a further 30 days, and our AI provider's abuse-monitoring copies of MCAI requests expire within 30 days of each request. We keep only what the law requires us to keep, and we will tell the dealership what that is, why and for how long.
Records on the dealership's own phones, and in those phones' backups, are under the dealership's control. We do not delete them, but we tell the dealership how to.
The app prevents issued invoices and signed documents from being deleted. How long the dealership must keep them is the dealership's legal duty.
Deleting your account and your rights
You can delete your account in the app under More → Account → Delete Account. This ends your sessions and removes your profile and memberships at once. Your sign-in identity is removed within one month. It does not erase your dealership's business records, which belong to the dealership.
Under UK data protection law you can ask to access, correct or delete your data, to restrict or object to its use, or to receive a copy. Contact info@commandstacktechnologies.co.uk. We respond within one month of receiving your request, or tell you within that month if we need up to two more months because the request is complex.
If you are unhappy with how we have handled your data, please complain to us first at info@commandstacktechnologies.co.uk; we will acknowledge your complaint within 30 days. You can also complain to the Information Commissioner's Office (ico.org.uk).
Children
MotorCommandAI is for business staff and is not intended for children.
Changes
We will update this page when our practices change and show the new date at the top. We will tell dealerships about significant changes.