Privacy Policy

1. Who we are

Pothole Mole ("we", "us") is operated by the account owner of this deployment. For the purposes of the UK GDPR and the Data Protection Act 2018, we are the data controller of the personal data you provide through this service. Contact: [insert controller contact email].

2. What we collect

• Account data — email address and (if using password sign-in) a hashed password. If you sign in with Google, we receive your email and Google ID.
• Claim data you enter — name, postal address, phone number, vehicle details (make, model, year, registration), incident date, time, description, and repair cost.
• Location data — the road name, coordinates and address of the pothole you enter.
• Evidence files — photos of damage and the pothole, receipts/invoices, and any FOI response you upload.
• Correspondence — the letters we draft on your behalf and any council replies you paste in.
• Technical data — a session cookie required to keep you signed in.

3. Why we use it & legal basis

• To provide the claims-drafting service you asked us to perform — Article 6(1)(b) UK GDPR (performance of a contract).
• To keep the service secure and prevent abuse — Article 6(1)(f) (legitimate interests).
• To comply with our legal obligations (e.g. responding to lawful requests) — Article 6(1)(c).

4. Who we share it with (processors)

We do not sell your data. We share the minimum necessary with the following processors and third parties:

• Lovable Cloud / Supabase — hosts our database, authentication and private file storage. Data is encrypted at rest and in transit.
• Lovable AI Gateway — receives the claim details you enter so it can draft letters and rebuttals. Prompts may be processed by upstream large-language-model providers.
• Google — only if you choose Google sign-in.
• postcodes.io — reverse-geocoding your coordinates to find the correct council (coordinates only, no personal identifiers sent).
• FixMyStreet — public pothole reports near your coordinates (coordinates only).
• The council you address — when you send an FOI request or claim letter, the content is disclosed to that local authority. You are in control of when and how this is sent.

5. International transfers

Some processors above may process data outside the UK/EEA. Where they do, transfers are covered by the UK International Data Transfer Addendum or Standard Contractual Clauses provided by the processor.

6. How long we keep it

We keep claim data for as long as your account exists, so you can refer back to sent letters and evidence. You can delete individual claims at any time from your dashboard, or delete your entire account from the Account settings page, which permanently removes all your claims, files and correspondence within 30 days.

7. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you (export from Account settings).
• Have inaccurate data corrected (edit it in your claims).
• Have your data erased (delete claims or your whole account).
• Restrict or object to processing.
• Data portability — your export is provided as JSON.
• Complain to the Information Commissioner's Office (ICO) at ico.org.uk.

8. Security

Access to your data requires you to be signed in. Database access is restricted by row-level security so one user cannot read another user's records. Uploaded files are stored in a private bucket and served only via short-lived signed links. Passwords are hashed and checked against known-breached passwords (Have I Been Pwned) at sign-up.

9. Cookies

We use a strictly-necessary session token to keep you signed in. We do not use analytics or advertising cookies.

10. Changes

If we change this policy materially we will notify you by email or by a prominent in-app notice before the change takes effect.