Privacy Policy

1. Who We Are

CarX is operated by CyberSecAI Ltd, registered in England and Wales. For privacy enquiries, contact us at contact@proofx.co.uk or contact@cybersecai.co.uk.

2. Consumer App (iOS) -- No Account Required

The CarX iOS app does not require you to create an account, sign in, or provide any personal information. You can use the app anonymously.

We do not collect:

• Your name, email address, phone number, or any personal identifiers
• Your location or GPS data
• Your contacts, photos, or any other device data
• Your IP address in identifiable form (IP addresses are hashed before storage and cannot be reversed)

3. What Data We Do Collect

When you connect an OBD-II adapter and use CarX, the following vehicle diagnostic data is transmitted to our servers for analysis:

• Engine sensor readings: RPM, speed, coolant temperature, intake air temperature, throttle position, engine load, MAF rate, fuel level, battery voltage, odometer
• Diagnostic trouble codes (DTCs): Fault codes reported by your vehicle's onboard computer (confirmed, pending, and permanent)
• Chat messages: Questions you ask the AI assistant about your vehicle. These are sent to our processing engine for analysis and are not linked to any personal identity.

This data relates to your vehicle, not to you personally. Sensor readings (RPM, voltage, temperature) are numerical values that do not identify any individual.

4. Vehicle Identification Numbers (VIN)

The consumer iOS app does not read or transmit your VIN. VINs are only stored when a dealer manually enters them in the Dealer Portal for fleet management purposes. If you use the consumer app, your VIN is never collected.

5. How We Use Your Data

• To provide real-time vehicle diagnostic monitoring and live sensor dashboards
• To generate AI-powered health analysis, predictions, and recommendations
• To detect trends over time (e.g. battery decline, coolant spikes) for predictive analysis
• To create signed diagnostic reports verified by ProofX
• To improve the accuracy of our diagnostic models

6. Data Storage & Security

• All data is transmitted over HTTPS (TLS encryption in transit)
• Vehicle diagnostic data is stored on secure servers hosted by fly.io in the London (LHR) region
• Diagnostic reports are cryptographically signed for tamper protection
• Report viewer IP addresses are stored as SHA-256 hashes only -- we cannot identify you from these
• We do not sell, rent, or share your data with third parties for marketing or advertising purposes

7. Voice Data

If you use voice input, your speech is processed on-device using Apple's Speech Recognition framework. Raw audio is never transmitted to our servers. Only the transcribed text (your question) is sent to the AI for processing.

8. AI Disclaimer

CarX uses artificial intelligence to analyse vehicle data and generate responses. AI can make mistakes. Responses may be inaccurate, incomplete, or misleading. You should not rely solely on AI-generated advice for safety, financial, or repair decisions. Always verify important information with a qualified mechanic. AI output is provided "as is" with no guarantees of accuracy or reliability.

9. Predictive Analysis

CarX stores historical sensor readings to perform trend analysis and predictive health monitoring (e.g. battery decline rate, coolant spike detection). This data is vehicle telemetry only and does not contain personal information. Predictions are estimates based on available data and should always be verified by a professional.

10. Third-Party Services

CarX uses third-party services to provide its features. No personal identifiers are shared with any third party. Specifically:

• AI-powered analysis is performed by our proprietary processing engine. Chat queries are processed anonymously.
• Diagnostic reports are digitally signed for tamper-proof verification.
• In-app purchases are handled entirely by Apple. We do not receive or store your payment information.

11. Dealer Portal

The Dealer Portal requires an account (email and password). Dealer accounts store: email address, hashed password (bcrypt), business name, phone number, and website. Dealers may also enter vehicle information (name, VIN, registration, make, model) for fleet management. This data is entered voluntarily by the dealer and relates to vehicles in their care.

12. OBD-II Limitations

CarX provides OBD-II electronic diagnostics only. This covers engine sensors, battery, fault codes, and electronic control systems. It does not assess brakes, tyres, suspension, bodywork, exhaust, steering, or other mechanical components. Always consult a qualified mechanic for a full vehicle inspection.

13. Data Retention

• Sensor readings are retained for trend analysis purposes
• Diagnostic reports are retained indefinitely for verification purposes
• You can request deletion of your data by emailing contact@proofx.co.uk

14. Your Rights (UK GDPR)

• You can request a copy of any data we hold about you
• You can request deletion of your data
• You can request correction of inaccurate data
• Dealer account holders can delete their account by contacting us
• To exercise these rights, email contact@proofx.co.uk

15. Children

CarX is rated 4+ on the App Store. The app does not knowingly collect personal information from children. Since the consumer app requires no account or personal information, there is no age-gated data collection.

16. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via the app or website. Continued use of CarX after changes constitutes acceptance of the updated policy.

17. Contact

For privacy questions, data requests, or complaints:

• Email: contact@proofx.co.uk or contact@cybersecai.co.uk
• Company: CyberSecAI Ltd, England and Wales

Last updated: February 2026