Responsible entity: InAppBot Inc. ("InAppBot", "we", "our") operates DRI COPILOT, including the mobile application, website, and related services (the "Service"). This Policy explains how we collect, use, share, retain, and protect personal data when you use DRI COPILOT. Please read it carefully along with our Terms of Use and Cookie Policy.
1. Scope and acceptance
This Policy applies to:
- Users of the DRI COPILOT mobile application (iOS/Android), signed in or not.
- Website and landing page visitors.
- Individuals who contact our support team or engage with our communications.
By downloading, installing, registering, or using the Service, you accept the practices described in this Policy. If you do not agree, you should not use the Service. In jurisdictions where explicit consent is required for certain processing (such as push notifications), we will request it separately.
2. Information we collect
2.1 Information you provide
- Vehicle information: year, make, model, trim, body style, fuel type, color, nickname, VIN (if you scan or enter it), license plate (optional), and odometer readings.
- Service records: the work done, date, mileage, shop name, cost, parts, notes, and any receipt photos you attach.
- Photos you submit for analysis: pictures of dashboard lights, tires, fluids, parts, damage, receipts, or the odometer, together with basic vehicle context, sent to produce a reading.
- Fuel logs and maintenance activity you record.
- Account information (optional): if you sign in — with email, Google, or Apple — we receive your email address and the name your identity provider shares. An account is not required to use the core of the app.
- Support communications: messages you send us and their metadata.
2.2 Information collected automatically
- Device and app data: device model, operating system and version, app version, language, and time zone.
- Install identifier: a random identifier generated on your device, used to meter free allowances for users who are not signed in. It is not an advertising identifier.
- Push token: if you allow notifications, the token needed to deliver reminders.
- Purchase state: subscription status and entitlements, provided by Apple or Google through RevenueCat. We never receive your card details.
- Usage analytics: aggregate feature-usage events through Firebase Analytics (for example, that a vehicle was added). These events are not used for advertising and are not tied to an advertising identifier.
- Diagnostic data: crash and error information needed to keep the Service working.
2.3 What we do not collect
The app does not request location permission at all — there is no GPS collection, foreground or background. We do not access your microphone, contacts, calendar, or health data, and we do not collect advertising identifiers (IDFA/AAID). VIN scanning happens on your device: camera frames are processed locally and are not uploaded.
2.4 Information from other sources
- Public vehicle-safety records: owner complaints, manufacturer service bulletins, recalls, and investigations for vehicle models, from United States federal databases. These describe vehicle models, not people.
- VIN decoding: when you add a vehicle by VIN, the VIN is sent to the federal government's public decoder (vPIC) to identify year, make, model, and specifications.
- Subscription events from Apple and Google via RevenueCat.
3. How we use information
- Provide the Service: maintain your garage, compute maintenance schedules, health scores, forecasts, and cost summaries, and deliver reminders you enabled.
- AI analysis you request: when you submit a photo, we send it with basic vehicle context to our servers and to third-party AI model providers to produce the reading, extraction, or report you asked for (see Section 12).
- Model research reports: the known-failures report is generated per vehicle model and language and cached so all owners of that model share it. These reports are built from public records and contain no personal data.
- Metering: count free-allowance usage per account or per install identifier.
- Sync and features that need an account: back up your garage, operate household sharing and vehicle transfers.
- Subscriptions: validate entitlements and operate the paid tier.
- Support, safety, and legal: answer you, prevent fraud and abuse, and comply with legal obligations.
- Service improvement: understand aggregate usage to prioritize improvements.
We do not use your data for third-party advertising, and we do not sell it.
4. Legal bases for processing (EEA/UK)
If you are located in the European Economic Area (EEA) or the United Kingdom, we process your data under the following GDPR legal bases:
- Performance of contract (Art. 6(1)(b)): when processing is necessary to provide the Service you requested, including your garage, records sync, photo analysis, reminders, and subscriptions.
- Legitimate interest (Art. 6(1)(f)): Service security, abuse prevention, product improvement, operational analytics, and Service-related communications. We assess that these interests do not override your fundamental rights and freedoms.
- Consent (Art. 6(1)(a)): for push notifications and other optional permissions. You can withdraw your consent at any time from device settings.
- Legal obligation (Art. 6(1)(c)): when we must retain or disclose information by law, regulation, legal process, or binding government request.
5. When we share information
We do not sell personal data as defined by the California Consumer Privacy Act (CCPA/CPRA) or other state privacy laws. We do not share personal data for cross-context behavioral advertising as a primary practice of the Service.
We share limited information in the following scenarios:
- Service providers and processors: we share data with providers that process information on our behalf under contractual instructions, including cloud infrastructure, authentication, notification delivery, maps, payment processing, e-commerce, and technical support. These providers are contractually obligated to protect your data and not use it for their own purposes.
- Authorities and legal compliance: exclusively when there is a valid court order or binding legal mandate. InAppBot does not voluntarily disclose user data for enforcement or punitive purposes, and reserves the right to challenge requests it considers excessive, indiscriminate, or contrary to the privacy rights of its users.
- Protection of rights: to investigate fraud, abuse, security threats, violations of our Terms of Use, or illegal activities.
- Corporate transactions: in the event of a merger, acquisition, reorganization, asset sale, or bankruptcy, your data may be transferred as part of the transaction, with reasonable safeguards and prior notice when feasible.
- Content visible to other people: nothing you store is public. Household members share a subscription, not data — your records are not visible to them. A vehicle's records reach another person only if you transfer that vehicle with a claim code, or you yourself share an exported document.
- With your consent: in other cases where you have given express consent to share specific data.
6. Third-party providers and services
We use a small set of processors to run the Service. Each receives only what its function requires:
- Supabase — database, storage, and server functions (hosted in the United States). Your garage, records, and receipt photos live here.
- Google Firebase — sign-in (Firebase Auth), push-notification delivery (FCM), and aggregate analytics.
- RevenueCat — subscription status and entitlements. Payment itself is processed by Apple or Google.
- AI model providers — photos you submit for analysis are processed by a vision model provider (currently OpenAI) to produce the reading; the known-failures research is performed with xAI. Research queries contain only the vehicle's year, make, model, and language — never your identity. Per these providers' API policies, API content is not used to train their models.
- Apple App Store / Google Play — distribution, billing, and refunds under their own terms.
- Amazon Web Services (SES) — transactional email delivery.
- NHTSA vPIC — the public United States government VIN decoder. When you add a vehicle by VIN, the VIN is sent to this service.
What happens to a photo you scan: it is transmitted, with basic vehicle context, to produce the reading, and the resulting reading is stored in your history. The photo itself is not retained on our servers unless you attach it to a service record, in which case it is stored privately as part of that record.
7. Public vehicle-safety data
The known-failures report is built from public records — owner complaints, manufacturer technical service bulletins, recalls, and investigations published by the United States federal vehicle-safety authority. These records describe vehicle models, not individuals, and the generated reports are cached per model and language and shared by every user with that model. They contain no personal data. We do not control the accuracy or timeliness of government records.
8. International data transfers
Your data is primarily processed in the United States (us-east region). Our service providers (Supabase, Firebase/Google, RevenueCat, AI model providers, AWS) may process data in multiple countries where they operate data centers.
For transfers from the EEA, United Kingdom, or Switzerland, we apply appropriate transfer mechanisms, including:
- Standard contractual clauses (SCCs) approved by the European Commission.
- Adequacy decisions when available.
- Certifications or recognized frameworks (such as the EU-U.S. Data Privacy Framework when applicable).
- Supplementary technical measures (encryption in transit and at rest).
9. Data retention
- Your garage, records, and photos: kept until you delete them or delete your account. Content stored only on your device (an anonymous garage) is under your control and disappears if you uninstall the app.
- Scan history: readings are kept with your data; the submitted photo is not retained server-side unless attached to a record (Section 6).
- Model research reports: cached per model and language; they contain no personal data and persist independently of any account.
- Allowance metering: usage counters are retained on a rolling basis; the anonymous install identifier lives for the lifetime of the installation.
- Subscription records: retained as needed for accounting and audit, anonymized after account deletion.
- Security and diagnostic logs: retained for limited periods necessary for fraud prevention and service stability.
10. Data security
We implement a data security program with reasonable administrative, technical, and organizational controls, in accordance with NY SHIELD Act requirements and industry best practices:
- Technical: encryption in transit (TLS/HTTPS), encryption at rest in databases, role-based access controls (RLS - Row Level Security), session tokens with expiration, privilege separation between services.
- Administrative: minimum necessary access policies, permission reviews, centralized secrets management, and data processing contracts with providers.
- Organizational: provider evaluation, data access auditing, and incident response.
Payment data: NITRO PRO subscriptions are processed by the Apple App Store or Google Play Store, coordinated through RevenueCat, which receives only anonymous identifiers and purchase status — never card data. InAppBot never stores, processes, or transmits payment card data.
No system is 100% invulnerable. If we detect a security incident affecting your personal data, we will notify you in accordance with applicable law (including the NY SHIELD Act which requires notification without unreasonable delay).
11. Permissions and sensors
The app requests exactly three permissions, each at the moment you use the feature that needs it:
- Camera — to photograph what you want analyzed, and to scan a VIN. VIN scanning is processed on the device; frames are not uploaded.
- Photo library — to analyze a photo you already took, using the system picker.
- Notifications — to deliver maintenance reminders. Requested at the end of onboarding, or from the Reminders switch.
The app requests no location permission, in any mode. It also does not request microphone, motion, contacts, or health access. If an earlier version of DRI COPILOT held location permission on your device, the current app no longer contains the code to use it, and you can revoke it in system settings.
12. Artificial-intelligence processing
DRI COPILOT uses AI in four places, and labels the output where you see it: photo readings (dashboard lights, tires, fluids, parts, damage), extraction of receipts and odometer photos, the known-failures report for your vehicle model, and the optional photo step in the emergency guides.
- What is sent: the photo you chose and basic vehicle context (year, make, model, mileage, language). We do not send your name, email, or contact information to AI providers; research queries for the model report contain only the vehicle's year, make, model, and language.
- Who processes it: the third-party AI model providers listed in Section 6, acting as processors. Per their API policies, API content is not used to train their models.
- What comes back: a probabilistic reading or report. It can be wrong. The app enforces a minimum confidence before showing results, displays a permanent disclaimer, and never presents AI output as a professional diagnosis.
- No voice: the app has no voice features and never records audio.
13. Automated decision-making
The Service makes no automated decisions with legal or similarly significant effects on you. Automated processing is limited to generating the informational content described in Section 12 and to counting free-allowance usage. If you believe an automated limit was applied to you in error, contact team@dricopilot.ai and a person will review it.
14. Your privacy rights
Depending on your jurisdiction, you may have the following rights regarding your personal data:
- Access: request information about what personal data we hold about you and obtain a copy.
- Correction: request correction of inaccurate or incomplete personal data.
- Deletion: request deletion of your personal data, subject to legal exceptions (such as retention obligations).
- Restriction/Objection: restrict or object to certain processing of your data.
- Portability: receive your data in a structured, commonly used, and machine-readable format.
- Withdrawal of consent: withdraw consent granted (location, notifications, voice) at any time without affecting the lawfulness of prior processing.
- Non-discrimination: you will not be discriminated against or penalized for exercising your privacy rights.
- Authorized agent: you may designate an authorized agent to exercise rights on your behalf, with appropriate verification.
To exercise any right, send your request to team@dricopilot.ai with your name, contact method, and description of the right you wish to exercise. We will verify your identity before processing the request.
15. Notice for California residents (CCPA/CPRA)
In the last 12 months we have collected these categories of personal information:
- Identifiers: email address (if you sign in), device identifiers, push token.
- Commercial information: subscription and purchase state.
- User content: vehicle information, service records, and photos you store or submit for analysis.
- Internet or network activity: app interaction events and diagnostics.
We collect no precise geolocation, no biometric information, and no sensitive personal information categories as defined by the CPRA, and we have not sold or shared (for cross-context behavioral advertising) personal information. We use personal information only for the purposes in Section 3 and disclose it only to the processors in Section 6.
California residents have the right to know, access, correct, delete, and port their personal information, the right to opt out of sale or sharing (we do neither), the right to limit use of sensitive personal information (we collect none), and the right not to be discriminated against for exercising these rights. Exercise them from the app (More → Account) or by writing to team@dricopilot.ai. An authorized agent may submit requests on your behalf; we will verify identity through the account email.
16. Additional state privacy notices
In addition to California, the following state laws may grant you additional rights:
16.1 New York (NY SHIELD Act)
We maintain a data security program in compliance with the NY SHIELD Act, including reasonable administrative, technical, and physical safeguards to protect the private information of New York residents. In the event of a security breach involving private information of NY residents, we will provide notification in accordance with SHIELD Act requirements.
16.2 Colorado (Colorado Privacy Act)
Colorado residents may exercise rights of access, correction, deletion, portability, and opt-out of processing for targeted advertising or data sale. You can appeal our decision on a request by contacting team@dricopilot.ai with subject "Colorado Privacy Appeal".
16.3 Connecticut (Connecticut Data Privacy Act)
Connecticut residents have rights similar to Colorado, including rights to access, correction, deletion, portability, and opt-out. This also includes the right to appeal.
16.4 Virginia (Virginia Consumer Data Protection Act)
Virginia residents may exercise rights of access, correction, deletion, portability, and opt-out of processing for targeted advertising, data sale, or profiling with significant legal effects.
16.5 Texas (Texas Data Privacy and Security Act)
Texas residents have rights of access, correction, deletion, portability, and opt-out. No revenue threshold is required.
16.6 Oregon, Montana, and other states
We respect privacy rights granted by applicable consumer data privacy laws in any U.S. state where you reside. Contact team@dricopilot.ai to exercise your rights under your state's applicable law.
17. Account deletion
You can delete your account and associated data in either of these ways:
- In the app: More → Account → Delete account (a two-step confirmation).
- By sending an email to team@dricopilot.ai with subject "Account Deletion Request".
When deleting your account:
- Your profile, garage, service records, photos, reminders, and preferences are deleted from our servers.
- Cached model research reports persist — they are shared, model-level content with no personal data.
- Subscription and transaction records are retained as required by tax and accounting obligations, anonymized.
- Security and audit logs are retained as necessary for fraud prevention, for limited periods.
We process deletion requests within applicable legal timeframes (generally 45 days for CCPA, 30 days for GDPR). Deleting the app from your device does not delete server-side data, and does not cancel a subscription — cancel in your App Store or Google Play settings.
18. Minors
DRI COPILOT is not directed at individuals under 18 years of age. We do not knowingly collect data from individuals under 18 (nor under 13 under COPPA, nor under 16 under GDPR without parental consent). If we detect that data has been collected from a minor without valid legal authorization, we will take reasonable steps to delete it promptly. If you are a parent or guardian and believe your child has provided data to the Service, contact team@dricopilot.ai.
19. Changes to this Policy
We may update this Policy periodically to reflect changes in our practices, services, legal or regulatory requirements. When changes are material, we will notify you through reasonable means, which may include:
- Prominent notice within the application.
- Push or email notification.
- Publication on our website.
The "Last updated" date at the beginning of this Policy reflects the current version. Your continued use of the Service after the effective date of changes implies acceptance of the updated version. If you do not agree with the changes, you should stop using the Service.
20. Privacy contact
If you are in the European Union, United Kingdom, California, or another jurisdiction with specific privacy rights and wish to exercise your rights, include in your request: your full name, preferred contact method, jurisdiction of residence, and details of the right you wish to exercise. We will respond within applicable legal timeframes.
If you believe the processing of your data violates your data protection rights, you have the right to file a complaint with the competent data protection authority in your jurisdiction.