1. Who We Are
Dashoo is operated by GW Digital ("we", "us", "our"). We are the data controller responsible for your personal data. If you have questions about this policy or wish to exercise your rights, contact us at:
Email: support@gwdigital.solutions
Support: support@gwdigital.solutions
2. What Data We Collect
| Category | Data | Purpose | Legal Basis (GDPR/UK GDPR) |
|---|---|---|---|
| Account | Email, name, auth provider | Account creation and authentication | Contract performance |
| Location | Precise GPS coordinates | Speed/location overlays on recordings | Consent |
| Media | Video/audio recordings | Core dashcam functionality | Contract performance |
| Device | Model, OS version, accelerometer | Crash detection, compatibility | Legitimate interest |
| Usage (app) | Screens viewed, features used, subscription and paywall steps, a pseudonymous app instance ID and account ID | Understand how the app is used, fix problems and improve it | Legitimate interest |
| Usage (website) | Pages visited, device and browser type, approximate location derived from IP address, analytics cookies | Understand how dashoo.app is used and whether our ads lead to downloads | Consent |
| Subscription | Purchase history, tier | Manage access to features | Contract performance |
| Company (Dashoo Fleet) | Only if you join a company: work email; Work trips (date, time, distance, rough start and end area, driving events); footage from Work trips; vehicle checks, defect reports and incident reports you share; mileage claims and receipts | Give your employer records of work driving, as described below | Contract performance (your employer's contract with us); your employer's legitimate interests |
| Advertising ID | Device ad identifier (free tier only) | Serve relevant ads | Consent |
3. How We Use Your Data
- Provide and maintain the dashcam recording service
- Process subscriptions and manage your account
- Detect crashes and protect critical footage
- Sync recordings to cloud storage (Pro users only, with your consent)
- Display advertisements (free tier only)
- If you join a company on Dashoo Fleet, share your Work trips and the forms and reports you choose to share with that company (see below)
- Send service-critical notifications (e.g. subscription expiry)
- Understand how the app and website are used, using Google Analytics, so we can fix problems and improve them
- Measure whether our adverts lead to downloads and subscriptions (only with your consent)
Using Dashoo through your employer (Dashoo Fleet)
If your employer invites you to Dashoo Fleet and you accept, your company decides what work records it needs and is responsible for how it uses them. We process them on its behalf. You see exactly what your employer can and can't see on the join screen before you agree, and you can leave a company at any time in Settings → Company.
Your employer can see: your work email and that you've joined; trips you mark as Work (date, time, distance, a rough start and end area and driving events, never the route); footage from Work trips; and vehicle checks, defect reports, incident reports and mileage claims you submit or share. A Work trip is shared after your company's review window (24 hours unless they change it), and until then you can change it to Personal. An incident report is shared only when you choose to share it, and you can take it back until your company has acted on it.
Your employer never sees: Personal trips (they stay on your phone), your GPS route or live location, or your personal recordings and backups. The mileage log in the app stays on your phone.
Company administrators can also look up a vehicle's registration with the DVLA, and receive email alerts about failed checks and incidents. Company billing is handled by Stripe and involves the company's administrators, not drivers.
4. Third-Party Services
| Service | Purpose | Data Shared | Location |
|---|---|---|---|
| AWS (Amazon Web Services) | Authentication, cloud storage, backend | Account data, encrypted videos (Pro) | EU (Ireland) |
| RevenueCat | Subscription management | User ID, purchase events | USA |
| Google AdMob | Advertising (free tier) | Advertising ID, device info | USA |
| Google Maps | Location display | GPS coordinates | USA |
| Meta Audience Network | Advertising (free tier), through AdMob mediation | Advertising ID, device info | USA |
| Google Play Integrity (Android) | Check the app is genuine and unmodified, to prevent abuse | A device-integrity token; no recordings or personal content | USA |
| Stripe (Dashoo Fleet) | Company subscription billing | Company administrators' billing details; no driver data | USA / Ireland |
| Amazon SES (AWS) | Sign-in, invite and alert emails | Email address and message content | EU (Ireland) |
| DVLA (Dashoo Fleet) | Vehicle lookup by company administrators | Vehicle registration number | UK |
| Apple / Google | Payment processing | Payment handled by store | USA / Ireland |
| Google Analytics (Firebase in the app, GA4 on dashoo.app) | Usage analytics; with your consent, ad conversion measurement linked to Google Ads and AdMob | App instance ID, pseudonymous account ID, usage events, device info, approximate location from IP; on the website, cookies set only after you accept | USA |
| Google Ads (dashoo.app only) | Measure whether our Google ads led to an app store visit | Download-click events and browser identifiers, only after you accept cookies | USA |
| OpenAI Ads (dashoo.app only) | Ad conversion measurement for our ChatGPT ad campaigns | Page visit and download-click events, IP address, browser identifiers | USA |
Where data is transferred outside the UK/EEA, we rely on Standard Contractual Clauses (SCCs) or adequacy decisions as appropriate.
5. Data Retention
- Recordings: Stored locally on your device. Cloud backups (Pro) are retained for 7 days from the date of upload, after which they are automatically and permanently deleted from our servers. You can delete cloud backups at any time from within the app.
- Trip summaries (Pro): for each journey we store its date and times, distance, duration, average and top speed, and a coarse start and end area (a UK postcode district such as "SW1A", or a town elsewhere), so your trip history survives a new phone. Your GPS route is never uploaded. Trip summaries are kept while your account is active and deleted with your account.
- Incident reports (Pro): reports you sign off in the app are backed up with their photos, so you can still give them to an insurer if you lose or change your phone. A report can contain details you enter about other people involved, such as names, contact details and number plates. Drafts are never uploaded. Backed-up reports are kept while your account is active and deleted with your account. They are not subject to the 7-day limit on recordings.
- Company records (Dashoo Fleet): Work trip records and the forms, reports and claims you share are kept by your company while its account is active. Work footage is kept for 30 days; clips from impact events and photos on forms are kept until your company unlocks or deletes them. If you leave a company, records already shared stay with it. Your recordings and personal history stay with you.
- Account data: Retained while your account is active. Deleted within 30 days of account closure.
- Crash reports: Retained for 12 months for debugging purposes, then automatically deleted.
- Analytics: Google Analytics event data is retained for 14 months, then automatically deleted. Aggregated reports that cannot identify you may be kept longer.
6. Your Rights
All Users
- Access your personal data
- Correct inaccurate data
- Delete your account and associated data, see how to delete your account
- Withdraw consent at any time. In the app, use Settings → General → Privacy & ad choices to change ad consent (and, on iOS, Settings → Privacy & Security → Tracking). On dashoo.app, use the "Cookie preferences" link in the footer.
EU/EEA & UK Residents (GDPR / UK GDPR)
- Right to data portability
- Right to restrict processing
- Right to object to processing based on legitimate interest
- Right to lodge a complaint with your supervisory authority (UK: ICO at ico.org.uk)
California Residents (CCPA/CPRA)
- Right to know what personal information is collected, used, and shared
- Right to delete personal information
- Right to opt-out of the sale or sharing of personal information
- Right to non-discrimination for exercising your rights
- We do not sell your personal information.
Canadian Residents (PIPEDA)
- Right to access your personal information held by us
- Right to challenge the accuracy and completeness of your data
- Right to withdraw consent (subject to legal or contractual restrictions)
Australian Residents (Privacy Act 1988)
- Right to access and correct your personal information
- Right to complain to the Office of the Australian Information Commissioner (OAIC)
- We will not disclose your personal information to overseas recipients without your consent or appropriate safeguards
New Zealand Residents (Privacy Act 2020)
- Right to access and correct your personal information
- Right to complain to the Office of the Privacy Commissioner
7. Children's Privacy
Dashoo is not intended for use by anyone under the age of 17. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.
8. Data Security
We implement appropriate technical and organisational measures to protect your data, including:
- Encryption in transit (TLS 1.2+) and at rest (AES-256)
- AWS Cognito for secure authentication
- Access controls and audit logging
- Regular security reviews
9. Automated Decision-Making
We do not use your personal data for automated decision-making or profiling that produces legal effects.
10. Changes to This Policy
We may update this policy from time to time. We will notify you of material changes via the app or email. Continued use after changes constitutes acceptance.
11. Contact & Complaints
For privacy enquiries: support@gwdigital.solutions
UK supervisory authority: Information Commissioner's Office (ICO), ico.org.uk
EU supervisory authority: Contact your local Data Protection Authority
Australia: Office of the Australian Information Commissioner, oaic.gov.au
New Zealand: Office of the Privacy Commissioner, privacy.org.nz