1. Who we are
SoftVox Development S.R.L.
Aleea Pădurii nr. 6, Șelimbăr, Sibiu, Romania
Trade register: ROONRC.J2025038963002
VAT: RO51891812
support@softvoxdev.com
We operate the Car Whisperer mobile application (the "App") and this website, and we are the controller for the personal data described below.
2. The short version
- You do not create an account. The App gives your installation a random identifier instead.
- What you send for a diagnosis — your description, photos and sound recordings — is processed by OpenAI to produce the answer. It is not used to train their models.
- Photos you attach are uploaded to our storage so the AI can read them. They are deleted automatically after 90 days, and you can delete everything yourself at any time in Settings. Please read section 5 before photographing anything with a number plate in the frame.
- If you use the workshop search, a rounded version of your location goes to our server, which asks Google for workshops nearby. We keep neither the location nor the results.
- Our app servers are in the United States. Our app analytics are in the EU.
- The diagnosis reports you export are created on your phone. We never see them.
3. What we process and why
- Your problem description and follow-up messages — to produce the diagnosis you asked for. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.
- Photos of your vehicle or the fault — same purpose and basis.
- Sound recordings of your vehicle — same purpose and basis.
- Vehicle details you enter (make, model, year, mileage band, engine, transmission) — to make the diagnosis specific to your car. Art. 6(1)(b).
- Your first and last name, if you enter them in Settings — shown on your exported report. Optional, and stored only on your device. Art. 6(1)(a), consent.
- A random installation identifier — to apply usage limits and prevent abuse. Art. 6(1)(f), legitimate interest.
- Counts of AI requests and tokens used — to monitor cost and abuse. Not linked to the content of your messages. Art. 6(1)(f).
- Approximate location, or a town or postcode you type — to find repair workshops near you. Art. 6(1)(a), consent, given through the iOS permission prompt.
- Subscription status — to unlock the paid features. Art. 6(1)(b).
- App usage events (screens opened, features used, errors) — to understand how the App is used and to find faults. Art. 6(1)(a), your consent, where consent is required; otherwise Art. 6(1)(f), legitimate interest. In the EEA, Switzerland and the United Kingdom we ask before collecting anything, and nothing is collected unless you agree. You can change your choice at any time in Settings.
We never ask for your name, address, email, phone number or vehicle registration, and you should not put them into the description field. Anything you type there is sent for processing as written.
4. Who receives your data
- OpenAI — your description, photo addresses, sound recordings and vehicle details. United States.
- Supabase (our backend and file storage) — the same content, plus your installation identifier and usage counts. United States.
- Google (Places API) — a rounded location, or the town or postcode you type, sent by our server rather than by your phone. United States and worldwide. See the Google Privacy Policy.
- Brave Search — search terms used to illustrate an answer, for example "BMW 3 Series door latch". United States.
- NHTSA (the United States road safety agency) — your car's make, model and year when the assistant checks for safety recalls, sent by our server; and your vehicle identification number, sent by your phone, if you choose to enter one. United States. See section 7.
- Mixpanel (app analytics) — usage events tied to a random identifier. European Union, EU data residency.
- Superwall (paywall) — subscription status and a random identifier. United States.
- Apple — your purchase, under Apple's own privacy policy.
International transfers. Our backend and most of these providers are in the United States, so your data is transferred outside the EEA. Those transfers are made under the European Commission's Standard Contractual Clauses, which form part of the data processing agreements we have in place with these providers.
AI training. Content sent to OpenAI through our API account is not used to train OpenAI's models. We do not use your content to train any model of our own.
5. Photos and sound recordings — please read this one
When you attach a photo to a diagnosis, it is sent to our server together with your question, read by the AI, and then it is gone. It is not stored on our servers — not in a database, not in file storage. The only lasting copy is the one in the conversation on your own phone.
It used to work differently. Until August 2026 photos were uploaded to file storage and kept for 90 days, and this page said so. That is no longer how it works, and any photo uploaded under the old arrangement has since been removed.
Even so: photograph the fault, not the paperwork. Try to keep your number plate, VIN, documents, other people and your home out of the frame. The one deliberate exception is the quote check described in section 8, where the document is the point.
If you do not want a photo in your conversation at all, open Settings → Privacy & About → Delete my data in the App. That removes everything this installation holds, together with its usage counts and its identifier, and it takes effect immediately. You can also write to support@softvoxdev.com.
Sound recordings are sent for analysis and are not kept on our servers afterwards. A copy stays on your phone as part of the conversation.
6. Location and the workshop search
The App does not use your location until you tap "Find a workshop". At that point iOS asks for your permission. You can refuse, and the feature still works — you can type a town or postcode instead. You can withdraw the permission at any time in the iOS Settings app.
What is sent, and to whom. If you allow it, your coordinates are rounded to roughly 110 metres before they leave your device. They go to our own server, which queries the Google Places API on your behalf and passes the results back. They are not sent to Google directly from your phone, and the Google credentials are held on our server rather than inside the App.
What we keep. Neither your coordinates nor the workshop results are written to any database of ours — the request passes through and is gone. We do record that a workshop search happened, so that we can monitor usage against our quota, but not where it was or what it returned.
What stays on your phone. Google's terms allow us to keep only its identifier for a place. So if you pick a workshop, that identifier is stored in your local chat history, and the name, address, phone number and rating are fetched fresh from Google each time they are shown. We do not build a copy of Google's business directory, and we do not build any history of where you have been.
Workshop details shown in the App come from Google Maps and are marked as such. Google's own handling of these requests is governed by the Google Privacy Policy.
7. Vehicle details and safety recalls
Safety recalls. When a fault you describe could be a known manufacturer defect, the assistant checks the public recall database of NHTSA, the United States road safety agency. Only your car's make, model and year are used — never your identification number, and nothing that identifies you or your phone. The request is made by our server, not by your phone.
These are United States records. A recall listed there may not apply to a vehicle built for another market, and a vehicle never sold in the United States will have no entry at all — which does not mean it is free of defects. Only a dealer can confirm a recall against your particular vehicle.
Vehicle identification number (VIN). Entering one is entirely optional. There is no VIN field during setup, and the App works exactly the same without it. If you do enter one, in the car's detail screen, it is used for two things: to fill in details such as engine size, body type and drivetrain so that you do not have to type them, and to print it on the diagnosis report you share with a workshop, where it is what a mechanic needs in order to order the right parts.
Where it goes. To decode it, your phone sends the number directly to NHTSA. It does not pass through our servers, and it was built that way deliberately so that one fewer party sees it. We do not store your VIN on our servers at all — it stays on your phone with the rest of your car's details, and it leaves your device again only if you share a diagnosis report yourself.
You can remove it at any time by clearing the field in the car's detail screen, and "Delete my data" removes it along with everything else.
8. Checking a workshop quote
If you photograph a quote or an invoice from a workshop, the App reads the line items from it so that it can put the part prices beside what those parts cost in the trade. This only happens when you choose it. Nothing is read from your photo library on its own.
What is on such a document. Rather more than on a photo of a faulty part: usually your name and address, often your telephone number and e-mail, your number plate, your vehicle identification number and your mileage, plus the workshop's own details. We would rather say this plainly than let you find it out afterwards.
Where it goes. The pages travel with the request to our server and on to OpenAI, whose model reads them. They are not stored by us — not in a database, not in file storage — and the copy on your phone is the only lasting one. OpenAI's handling is governed by the OpenAI Privacy Policy. We do not permit OpenAI to use anything sent through the App to train its models.
What we ask the model for, and what we keep. Only the line items: the description, the quantity and the amount. Names and addresses are not extracted, not returned to the App and not written anywhere. What is kept in the conversation on your phone is the comparison itself — the descriptions, the amounts you confirmed and the price ranges we found. The image of the document is not part of it.
You can cover what you do not want to send. The part we need is the table of line items. The header carrying your name and address can be folded over, covered with a sheet of paper, or simply left out of the frame — the check works perfectly well without it.
The workshop's data. A quote also identifies the business that wrote it. We use those details for nothing: they are not extracted, not stored, and not passed to anyone. No record of which workshop quoted you is built anywhere.
"Delete my data" in Settings → Privacy & About removes the stored comparisons along with everything else.
9. Telling us whether the App helped
At the end of a diagnosis the App asks one question in the chat: “Did that fix it?” Answering is entirely optional, and tapping “Not yet” records nothing at all.
If you answer yes or no, we store that answer together with your installation identifier, the App version, the region your phone is set to (two letters — not your location) and the language of the conversation. If you answer no we offer you a text field. Whatever you write there is stored with that answer. Writing something is your choice; closing the field without typing is a perfectly normal way to leave it.
Why we do it. We want to know whether the App actually helps before we ask anyone to rate it in the App Store, and a complaint is far more useful to us than a one-star review. The legal basis is our legitimate interest in improving the App (Art. 6(1)(f) GDPR); for the free text it is your consent, given by choosing to write and send it.
Where it goes. Into our own database at Supabase, the same processor as in section 4. Nobody outside SoftVox can read it, it is never published, it is never attached to a review, and it is not sent to OpenAI or used to train anything. Please do not put personal details of yourself or anyone else in that text field — it is meant for what the App got wrong.
“Delete my data” in Settings → Privacy & About removes your answers and anything you wrote, along with everything else.
10. What stays on your phone
Your cars, your conversations, the photos as you see them in the chat, your ticked repair steps and your report-language preference are stored on your device. They are not copies we hold.
Exported PDF reports are generated on your device. We never receive them. Once you share a report, what happens to it is between you and whoever you sent it to.
Deleting the App deletes all of this local data, including your conversations. It does not, on its own, delete photos already uploaded to our storage or the usage counts held against your installation identifier — those are removed by the 90-day job described in section 5, or immediately if you use Settings → Privacy & About → Delete my data before you uninstall.
11. How long we keep things
- Uploaded photos — 90 days from upload, then deleted automatically. See section 5.
- Message content sent to OpenAI — not stored by us once the answer is produced. OpenAI may retain API content for up to 30 days for abuse monitoring.
- Installation identifier and usage counts — for as long as the installation exists, or until you use Delete my data.
- Location sent for a workshop search — not retained at all. It is used to make the request and discarded.
- Analytics events — according to Mixpanel's retention settings.
- Statistics of our own YouTube videos — the video identifiers and aggregated view statistics of videos we publish ourselves, for up to 36 months. See section 12.
- Android waiting list address — until an Android version has been announced to you, or until you ask us to remove it, whichever comes first. See section 12.
- Your answer to “Did that fix it?” and any text you wrote with it — for as long as the installation exists, or until you use Delete my data. See section 9.
- Local data on your phone — until you delete it, or delete the App.
12. This website and our YouTube channel
This website can use Google Analytics to count visits and understand which pages are read. Google Analytics sets cookies and processes your IP address.
It is not loaded unless you agree. The first time you visit, we ask. If you decline, or simply ignore the question, no analytics script is loaded and no analytics cookie is set. You can change or withdraw your choice at any time using Cookie settings at the bottom of any page.
The App itself does not use cookies.
Our YouTube channel. We publish our own videos on YouTube (@carwhisperer_app). An internal tool of ours, “CarWhisperer Marketing Publisher”, uses YouTube API Services to upload those videos to our own channel and to read the viewing statistics of our own videos. It does not access any other channel or any viewer’s data; the only YouTube data we keep are the identifiers of our own uploads and their aggregated statistics, which we keep for up to 36 months and then delete. Google’s handling of this data is governed by the Google Privacy Policy. The tool acts only under our own Google account, and we can revoke its access at any time in the Google security settings. Questions about it go to support@softvoxdev.com.
The Android waiting list. CarWhisperer is an iPhone app. If you reach our download link from an Android phone we show you a page saying so, where you can leave an e-mail address to be told once an Android version exists. Leaving it is entirely your choice and nothing on this site depends on it; the legal basis is your consent. We store the address, the two-letter country your visit came from, and which of our posts you arrived through — not your IP address, which we never receive. We use it for exactly one thing: a single message when there is an Android version to install. We do not send a newsletter, we do not profile you and we never pass the address to anyone else. Write to support@softvoxdev.com at any time and it is deleted, no reason needed.
13. Your rights
If you are in the EEA or the UK you have the right to access, correct, delete, restrict and object to the processing of your personal data, and to receive a copy of it. You may also lodge a complaint with your supervisory authority.
Deletion you can carry out yourself. Settings → Privacy & About → Delete my data removes, in one step, every photo your installation has uploaded, its usage counts, its identifier on our servers, and all data held on your phone. Your App runs it against your own installation, so no proof of identity is needed and nothing has to be looked up by hand.
For the other rights: because the App has no account, we usually cannot tell which data is yours from the outside. To exercise a right in relation to a particular uploaded photo, please send us the web address of that image, or enough detail for us to find it. Write to support@softvoxdev.com; we reply within 30 days.
14. Children
The App is a tool for vehicle owners and is not directed at children. You must be at least 16 years old to use it. We do not knowingly collect personal data from children. If you believe a child has sent us personal data, write to support@softvoxdev.com and we will delete it.
15. Security
Traffic between the App and our servers is encrypted in transit. AI provider keys are held on our servers and are not present in the App. Requests to our AI functions require a token issued to your installation. The exception is described in section 5: uploaded images are reachable by web address without authentication.
16. Changes
We will update this policy when the App changes. The effective date at the top tells you which version you are reading. Material changes will be announced in the App.
17. Contact
SoftVox Development S.R.L., Aleea Pădurii nr. 6, Șelimbăr, Sibiu, Romania — support@softvoxdev.com