PRIVACY NOTICE · 23 SEPTEMBER 2026
Your information belongs to your life.
This notice describes how the PolicyTrack application processes information. The service operator must provide its legal identity and contact details before public launch.
What we collect and why
We store account details, household memberships, insured people and assets, policy details, documents, extracted information, preferences and activity records. Account and wallet processing supports the service you request. Security logs support legitimate interests in preventing misuse. Optional AI processing requires your affirmative choice for each batch.
Vehicle MOT and tax checks
Adding vehicle insurance with a linked vehicle creates MOT and tax status records. When configured, we send the vehicle registration to the DVLA Vehicle Enquiry Service to retrieve MOT and tax status and due dates, and refresh these daily. We save the status, dates and time checked in your household wallet. These are status records, not official certificates or proof of tax payment. Manually edited records are not overwritten by automated checks.
Optional Gmail monitoring
When available, you can connect Gmail in Settings → Connected accounts. Google grants read-only mailbox access. We search for subscriptions, insurance and recurring bills from the past year, then check for new messages. Relevant email text, subject and sender are sent to OpenAI to extract account details; attachments and remote content are not fetched. Full email bodies are not saved. OAuth credentials, mailbox address and saved suggestions, including short supporting excerpts, are encrypted at rest. Suggestions are private to the person who connected the mailbox; imported records are shared with their selected household. Clear matches may be added automatically; uncertain matches and changes to existing records require review. Disconnecting stops monitoring and deletes local credentials and suggestions while keeping imported wallet records and reminders. You can also revoke access in your Google account. Gmail data is used only for these user-facing features, not advertising or model training. Provider security retention may still apply.
AI processing and international transfers
If you choose AI reading, uploaded files are sent to the configured provider. This implementation supports the OpenAI API, whose business/API data is not used for model training by default. Requests use store:false; this does not remove all possible abuse-monitoring retention. The service operator must agree suitable processing terms, transfer safeguards and any required retention controls before processing live personal data.
Who can access information
Other members of your household can view its shared wallet. Hosting, storage, email and AI providers process data as necessary to provide the service. The operator must identify its actual subprocessors and processing regions at launch. PolicyTrack does not sell policy documents or use them to build advertising profiles.
Retention, deletion and backups
Records remain while you use the service, unless you delete them. Deleting a document removes the active file; deleting a policy or sole-member household also removes its documents and extraction records. When you leave a shared household, other members retain shared policy records. Production operators must enforce a documented backup expiry, with a recommended maximum of 30 days, and reapply deletion records after restoration.
Your rights and choices
Settings provides export, email preferences and deletion controls. You may also request access, rectification, erasure, restriction or portability and object to applicable processing. Withdrawing AI permission prevents future optional batches; it does not undo completed processing. Contact the operator through the Contact page. UK users may raise concerns with the Information Commissioner’s Office.
Cookies and sensitive information
PolicyTrack uses essential session, security and preference cookies. It installs no advertising or analytics trackers. Insurance may reveal health or other sensitive information; only upload records you are entitled to share. The operator must assess its lawful basis and safeguards for special-category data before public operation.