Privacy Policy

1. Who we are

This app is operated by DriveTech Group Limited, a company registered in England and Wales (company number 17289782), registered office 16 Clifton Moor Business Village, James Nicolson Link, York YO30 4XG. We are the data controller for personal data processed through this service, except where we process data for an instructor or driving school (see section 3).

2. Who this policy covers

Instructors and trainee instructors (ADIs and PDIs) who use the app to run their business
Learners: pupils whose instructor uses the app, learners who book or pay online, and learners with their own account
Driving school and training provider staff who use our school or trainer portals
Visitors to our website, and anyone who sends us an enquiry

3. Our role

When an instructor keeps records about their pupils in the app (contact details, lessons, progress, notes), the instructor is the controller of those records and we process them on the instructor's behalf. Learners can ask their instructor for access to, correction of or deletion of those records, and we will help the instructor respond.

We are the controller for: your account with us, online bookings and payments, the booking fee, Theory Premium, requests to find an instructor, our website, analytics, security and support. A driving school is the controller of any data it keeps in its own systems.

4. What data we collect

Instructor account data: name, email address, phone number, address, coverage area and postcode, DVSA ADI or trainee licence number, business details, and your National Insurance number if you use HMRC features. If you connect Stripe to take card payments, Stripe holds your bank and identity details
Pupil records entered by an instructor or passed on by a driving school: name, email, phone number, address and postcode, date of birth, emergency and guardian contacts, driving licence number and uploaded licence documents, lesson history, syllabus and skills progress, test dates and results, lesson notes and reflective logs
Learner accounts: name, email address, password (stored hashed), sign-in records, theory and hazard perception practice history, and whether you have Theory Premium
Bookings and payments: lessons booked, amounts paid, booking fees, refunds and Stripe payment references. Card details are entered into and held by Stripe; we never see or store full card numbers
Enquiries: name, phone number, email address, postcode and lesson preferences when you ask us to find you an instructor, join a waiting list, or contact us
Instructor financial records: lesson charges, payments received, expenses and mileage, used for bookkeeping and Making Tax Digital
HMRC connection data: OAuth tokens (encrypted using AWS KMS), HMRC business identifiers, and fraud prevention header data (see section 5)
Voice debriefs: if an instructor records a spoken lesson debrief, the audio recording, its transcript and the lesson notes we extract from it
School and trainer portals: portal user accounts, and for trainee instructors, training bookings, training hours and theory progress shared with their training provider
Messages: messages sent between instructors and learners in the app, support emails, and live chat conversations
Push notifications: if you allow notifications, your browser's push subscription (an address and keys issued by your browser)
Technical and usage data: IP address, browser and device information, sign-in times and error reports. If you accept analytics cookies, also the pages you view, what you click, and recordings of your sessions (see section 9)

5. How we use your data, and our legal basis

To provide the app to instructors, learners, driving schools and training providers, including bookings, reminders, notifications and messaging (contract; for pupil records, on the instructor's instruction)
To take payments through Stripe, charge the learner booking fee, pay out to instructors, process refunds and bill Theory Premium (contract)
To match learners with instructors: when you ask us to find an instructor, we share your enquiry with instructors near you. Instructors may pay us to unlock your contact details so they can get in touch (steps you asked us to take; legitimate interests)
To share information with driving schools as described in section 7 (legitimate interests of the school, the instructor and us in running the school's instructor network)
To submit Income Tax updates to HMRC on an instructor's instruction via Making Tax Digital, and to send the fraud prevention headers the law requires with every request: IP address, device identifiers, browser information, screen size and timezone (contract; legal obligation)
To transcribe and summarise voice debriefs when an instructor uses that feature (contract)
To keep the service secure: spam and abuse protection on public forms (Google reCAPTCHA), fraud prevention, and error monitoring (legitimate interests)
To understand and improve the app through analytics and session recordings, only if you accept analytics cookies (consent)
To send service emails about your account, bookings and payments (contract), and marketing emails where you have agreed or are an existing customer, with an opt-out in every email (consent or legitimate interests)
To keep financial records for as long as tax law requires (legal obligation)

We do not sell your personal data.

6. Who we share data with

Your instructor, driving school or training provider, as described in sections 3 and 7
Stripe: card payments, instructor payouts (Stripe Connect), the booking fee and Theory Premium billing. Stripe also uses payment data for its own fraud prevention and legal obligations
Amazon Web Services: hosting of our database and files in Ireland (EU), email (SES), text messages (End User Messaging), sign-in (Cognito), encryption keys (KMS), and analysis of voice debrief transcripts (Amazon Bedrock, EU)
OpenAI: transcription of voice debrief recordings. The audio is deleted from our storage once transcribed
Google: "Sign in with Google" if you choose it; reCAPTCHA on public forms; and Google Tag Manager and Google Analytics, only if you accept analytics cookies
Meta: the Meta advertising pixel, only if you accept analytics cookies
PostHog (EU hosting): product analytics and session recordings, only if you accept analytics cookies
Sentry (EU hosting): error monitoring and, only if you accept analytics cookies, screen replays of sessions where an error occurs and of a small random sample (1%) of sessions, with all text and form inputs masked
Crisp: live chat on our website, loaded only when you click "Chat"
Push services run by your browser or device maker (for example Google, Apple, Mozilla or Microsoft), which deliver notifications you have allowed
postcodes.io: postcode lookups (only the postcode is sent)
HMRC: Making Tax Digital submissions on an instructor's instruction
Professional advisers, and courts, regulators or law enforcement where the law requires it

7. Driving schools

Some instructors work with a driving school that uses our school features. If yours does:

The school can see its instructors' names, contact details, coverage areas and learner numbers, and each instructor's learners' names and lesson and test progress
If the school connects its own customer system (CRM), we send it the instructor's name, email address and postcode, learner numbers, and updates such as when an instructor asks for learners, accepts or declines a learner the school introduced, or adds a learner of their own (identified by reference number only)
When a school introduces a learner, it sends us the learner's name, email address, phone number, postcode and lesson preferences, which we pass to the instructor. If the instructor accepts, the learner is invited to their portal

8. International transfers

Our main database and file storage are hosted by AWS in Ireland (EU), which the UK recognises as providing adequate protection. PostHog, Sentry and Crisp host our data in the EU. Some providers process data in the United States or elsewhere, including OpenAI, Google, Meta and Stripe. For those transfers we rely on the UK–US Data Bridge where the provider is certified, or on the ICO's International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.

9. Cookies, analytics and session recording

We use essential cookies to keep you signed in and secure. Analytics and advertising tools (PostHog, Google Analytics via Google Tag Manager, and the Meta pixel) run only if you choose "Accept all" on our cookie banner. With your consent, PostHog records how you use the app, including session recordings in the signed-in app and booking pages, with form inputs masked. You can change your mind at any time: see our Cookie Policy.

10. Data storage and security

We use encryption for data in transit (TLS) and at rest. HMRC OAuth tokens are encrypted using AWS KMS before storage. Access to personal data is restricted to authorised personnel only.

We are registered with the Information Commissioner's Office (ICO) under UK GDPR.

11. How long we keep data

Instructor accounts: kept while your account is open. When you delete your account, your pupils, lessons and lesson notes are deleted and your personal details are anonymised. Financial records (expenses and ledger entries) are kept for 7 years for HMRC record-keeping
Pupil records: kept until the instructor deletes them or deletes their account. Financial records linked to pupils are kept for 7 years
Learner accounts: kept while your account is open. When you delete it, we cancel any Theory Premium subscription and delete your login, profile, practice history and push subscriptions. Your instructor keeps their own records of your lessons and payments
Voice debrief audio: deleted once transcribed. Transcripts and notes are kept with the lesson record
Support communications: 2 years

12. Your rights

Under UK GDPR you have the right to:

Access the personal data we hold about you
Correct inaccurate data
Request deletion of your data (subject to legal retention obligations)
Object to or restrict processing
Data portability - export your data in a machine-readable format
Withdraw consent at any time (where processing is consent-based)

You can delete your account yourself: instructors in Settings, and learners in their account page. Instructors can also download their data from Settings. See how to delete your account. For anything else, email hello@orbitdriving.com. We will respond within one month.

You also have the right to lodge a complaint with the ICO at ico.org.uk.

13. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by email or in the app.