This Privacy Policy explains how OilSpec ("we", "us", "our") collects and uses personal data when you use the OilSpec web application at lubed-up.com (the "Service"). We are the data controller for the personal data described below and comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
OilSpec is operated by Powerhouse Coding, contactable at support@powerhouse-coding.com. If you have questions about this policy or wish to exercise your data-protection rights, please email us at that address.
2. Data we collect
- Account data: name, business/garage name, email address, and an encrypted password (or your Google account identifier if you sign in with Google).
- Vehicle lookup data: registration numbers, VINs and vehicle details you submit or that we retrieve from third-party sources, plus the resulting lubricant and filter data. This is stored in your lookup history.
- Photographs: images you take of number plates or VIN etchings are uploaded to our AI vision provider for text extraction. Images are processed transiently and not retained beyond that request.
- Technical data: IP address, browser type, device information and error logs, collected to secure and improve the Service.
3. Legal bases
- Contract — to provide the Service you have signed up for.
- Legitimate interests — to secure the Service, prevent abuse, and improve it.
- Consent — for any non-essential cookies or marketing communications, where applicable.
- Legal obligation — to comply with UK law.
4. How we use your data
We use your data to authenticate you, run vehicle lookups, store your history, respond to support requests, and keep the Service secure. We do not sell your personal data.
5. Sharing with third parties
We use the following processors and sub-processors:
- Lovable Cloud / Supabase — hosting, database, authentication.
- Google — Google OAuth sign-in (if you choose it).
- Lovable AI Gateway (Google Gemini) — image OCR on plate/VIN photos.
- Public vehicle and lubricant data sources — e.g. GOV.UK Vehicle Enquiry Service and manufacturer oil selectors (Castrol, etc.) — queried with the registration or vehicle data you supply.
6. International transfers
Some processors may transfer data outside the UK. Where they do, transfers are protected by the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an adequacy decision.
7. Retention
Account and lookup data is retained for as long as your account is active. You can delete individual lookups from your dashboard. To close your account and delete all associated data, email us at support@powerhouse-coding.com.
8. Your rights
Under UK GDPR you have the right to access, rectify, erase, restrict, port and object to the processing of your personal data, and to withdraw consent at any time. To exercise these rights, email support@powerhouse-coding.com. You may also complain to the Information Commissioner's Office (ico.org.uk).
9. Security
Passwords are hashed and data is encrypted in transit. Access to the database is restricted by row-level security so users can only read their own records.
10. Changes
We may update this policy from time to time. Material changes will be notified via the Service or by email.