AIDriveSmart ("we", "us", "our") operates the aidrivesmart.co.uk platform connecting learner drivers with driving instructors. This policy explains how we collect, use, and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller

AIDriveSmart is the data controller for the personal data described in this policy. Contact us at admin@aidrivesmart.co.uk for any data protection query.

2. Information We Collect

• Account data: name, username, email address, password (hashed), role (student/instructor/admin).
• Profile data: phone number, address, pickup location coordinates, transmission preference, instructor bio and hourly rate.
• Booking data: lesson dates, times, durations, feedback, skill progress, test results.
• Payment data: processed by Stripe; we store transaction references and amounts, never full card numbers.
• Communications data: AI chatbot conversation history (retained for 24 hours in Redis), support messages.
• Technical data: IP address, device/browser type, and cookies (see our Cookie Policy).

3. How We Use Your Data

• To create and manage your account and provide the booking service.
• To process payments and instructor payouts via Stripe.
• To send booking confirmations, reminders, and receipts via email (SendGrid), WhatsApp/SMS (Twilio).
• To power the AI chatbot assistant (OpenAI / Anthropic) — chatbot messages are sent to these providers to generate a response but are not used to train their models where a business/API agreement is in place.
• To maintain the security, integrity, and performance of the platform.

4. Legal Basis for Processing

We process your data on the basis of: performance of a contract (booking and payment), legitimate interests (platform security, service improvement), consent (marketing communications, optional cookies), and legal obligation (accounting and tax records).

5. Sharing Your Data

We share limited data with the following processors strictly to deliver the service: Stripe (payments), SendGrid (email), Twilio (WhatsApp/SMS), OpenAI and Anthropic (chatbot), and Google/GitHub/Microsoft (optional social login). We do not sell your personal data.

6. Data Retention

Account and booking records are retained for as long as your account is active and for a reasonable period afterwards to meet legal, accounting, and dispute-resolution requirements. Chatbot conversation history is automatically deleted after 24 hours.

7. Your Rights

Under UK GDPR you have the right to: access your data, request correction or erasure, restrict or object to processing, and receive your data in a portable format. To exercise these rights, email admin@aidrivesmart.co.uk or use the account deletion option in your profile settings. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

8. Security

Passwords are hashed, payment details are handled entirely by Stripe (PCI-DSS compliant), and access to personal data is restricted by role-based permissions.

9. Children

Learner drivers must be at least 15 years and 9 months old (the minimum age to hold a provisional UK licence) to register. We do not knowingly collect data from children under 13.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be notified via email or an in-app notice.