Privacy Policy

1. Who we are

SixLine is developed by Mihai-Cristian Angheluță PFA, a sole proprietorship (persoană fizică autorizată) registered in Romania, CUI 44655193, Romania. For the purposes of GDPR and UK GDPR, this entity is the data controller for the personal data described below. Contact: support@sixline.app; full legal details are in the Terms of Service.

2. What data we collect

Account data: if you sign in with Apple, your name (if provided by Apple on first sign-in) and email address (which may be an Apple private relay address); if you sign in with Google, your name, email address and Google account identifier and, if your Google account has one, a link to your profile picture (we don’t display or use it).

Vehicle data you enter: VIN, nickname, mileage, model, generation, year, engine, transmission, drivetrain, fuel type, and factory specifications (when you use VIN decode).

Maintenance data you enter: maintenance item names, service intervals, service history (mileage, date, cost, currency), and other expenses you record (name, date, amount, currency).

Documents you upload: document type, name, expiry date, and the file itself (e.g. insurance documents, invoices) if you choose to attach one. Saving attached files to your account in the cloud is a SixLine PRO feature; on the free plan they stay on your device.

Usage data: how many VIN decodes and “Scan invoice or iDrive” uses your account has used, to enforce the allowance included with SixLine PRO. Each time you use a paid feature (“Scan invoice or iDrive”, VIN-plate scan or VIN decode), we also record a usage entry linked to your account: which feature, which service provider and model handled it, the processing size, the estimated cost, the outcome (completed, refunded or failed) and the time it took. We keep it to operate the paid features, prevent abuse and understand our costs; it is not shared or used for advertising or tracking.

VIN scan confirmations: when you confirm a VIN read from a photo, we record the confirmed VIN with your account identifier as a usage record. It is deleted with your account.

App updates: when the app checks for or downloads an update, it sends a random per-install update identifier, the app and runtime version, platform and your IP address to our update provider.

Diagnostics: error context, message, stack trace, technical metadata and app version; reports may be associated with your account identifier when signed in. Error messages are technical text and can incidentally include a file name or a storage path. Diagnostics are deleted after about 30 days.

Usage analytics: events such as reaching a screen or a purchase step, together with the app version and platform, stored in our own Supabase database. They carry no identifier: nothing is stored on or read from your device for this purpose, so events cannot be linked to you, your account, your device or each other, and we do not record your IP address with them. They contain no name, email, vehicle or VIN and are not used for advertising or tracking. This is on by default; you can turn it off at any time in Settings → Share usage data.

Optional website analytics: with your permission, we use Google Analytics to measure pages visited, referring sites and campaign links (such as Reddit), browser and device information, approximate geographic location, how far you scroll (including which sections of the homepage you reach), which controls you use on the homepage (the live demo, the scan steps and the app tour) and clicks to the App Store. Google uses first-party analytics cookies to distinguish visits. We do not load Google Analytics until you accept analytics. You can reject or withdraw permission through “Cookie settings” in the website footer; this stops future collection and removes the website’s Google Analytics cookies. This choice is separate from the app’s “Share usage data” setting. We remember your website choice in local storage for up to 180 days; analytics cookies are configured to expire 180 days after their last update. Advertising storage and personalization are disabled.

Purchase data: confirmation that you purchased SixLine PRO or an extra pack, provided to us by Apple, Google Play or RevenueCat — we do not receive or store your payment card details.

3. How we use your data

We process account, vehicle and maintenance information to provide requested features, sync and backup, VIN decoding, VIN-plate reading, invoice extraction, purchases and allowance enforcement (GDPR Article 6(1)(b), performance of our contract). Data needed for a requested feature must be provided for that feature to work; optional uploads and analytics are not required to use unrelated features.

We process proportionate diagnostics and security information for our legitimate interests in detecting faults, preventing abuse and protecting the service (Article 6(1)(f)). You may object on grounds relating to your situation. Our own usage statistics (on by default) carry no identifier and rely on our legitimate interest in understanding and improving how SixLine is used (Article 6(1)(f)); you can turn them off at any time in Settings → Share usage data. Records required by tax or accounting law are processed to meet legal obligations (Article 6(1)(c)).

We do not use your data for automated decisions producing legal or similarly significant effects. AI extraction is a tool to help you enter information; review its output against the original document.

4. Third-party services we use

Apple — Sign in with Apple (authentication; on Android it opens in your browser) and In-App Purchase (payments for purchases made in the App Store, under the Apple terms applicable to your territory). Apple’s own privacy policy governs how they handle this. When you sign in with Apple, SixLine may also keep an Apple authorization token on our servers, used only to disconnect SixLine from your Apple ID when you delete your account. The token is deleted with your account or, if Apple cannot be reached at that moment, as soon as the disconnection succeeds.

Google (Google LLC) — Sign in with Google (authentication) and Google Play Billing (payments for purchases made on Google Play, under the Google terms applicable to your territory). When you sign in with Google, Google provides SixLine with your name, email address and Google account identifier and, if your Google account has one, a link to your profile picture (we don’t display or use it); we never receive your Google password. Google’s own privacy policy (https://policies.google.com/privacy) governs how it handles this and your Google Play purchases.

Supabase — hosts our database, file storage, and authentication infrastructure. Your account and vehicle data is stored on Supabase’s servers in the EU (Ireland).

Outvin — when you decode a VIN, the VIN itself is sent to Outvin, a third-party vehicle-data provider, to retrieve factory specifications. We send the VIN to perform the requested decode, not your account name or email. Decoded vehicle specifications and the VIN may also be cached to serve repeated lookups.

NHTSA — when you decode a VIN in the North American format, the VIN is also sent from our servers to the vehicle database (vPIC) of the U.S. National Highway Traffic Safety Administration, a public service of the United States government, to confirm details such as the model year, power and transmission. Only the VIN is sent, not your account name, email or IP address. The answer may be cached together with the decoded specifications.

Anthropic (Claude) — when you use “Scan invoice or iDrive” (including a photo of your car’s service history or service-due screen) or scan a VIN plate with your camera, the image or PDF you provide is sent to Anthropic’s API for analysis, to extract maintenance-relevant information or read the VIN. For an invoice or iDrive scan we also send the names of the maintenance items on that vehicle’s schedule, the vehicle’s model year, market and distance unit, and today’s date, so that the result can be matched to your schedule; we do not send your name, email, account identifier or VIN with it. SixLine asks for your explicit permission in the app before the first photo or PDF is sent (a “Before you scan” prompt names Anthropic, and your choice is remembered on the device); without it, nothing is sent. Depending on what your invoice or photo shows, this could include your name, address or license plate if visible. Crop or redact irrelevant personal information before sending a document. We do not store the scanned file itself unless you choose to attach it to a document. The details extracted from an invoice or iDrive photo are kept on our servers for up to 24 hours so that a scan interrupted by a lost connection can be recovered without being charged again; after that they are no longer available and are removed in routine cleanup. Anthropic processes the file under its own commercial API terms. Processing for a scan is separate from whether an attachment is backed up under PRO.

RevenueCat — manages and verifies your SixLine PRO purchase status, receiving purchase and transaction information from Apple or Google Play and an app user identifier used to associate entitlements with your account.

Google Analytics — provides optional website traffic measurement after you consent. Google may process this data outside the EEA, including in the United States. See Google’s Privacy Policy for details about its processing.

Expo (EAS Update) — delivers app updates. Each update check sends the information described under "App updates" above; it does not include your account, vehicles or documents.

Cloudflare — hosts the sixline.app website and processes technical request data, such as your IP address, to deliver and protect it.

Microsoft 365 — hosts the support@sixline.app mailbox; emails you send us are stored there.

We require each provider listed above to protect your data to a standard at least equivalent to this Privacy Policy, by contract or through its applicable terms.

5. International data transfers

Our core Supabase database is configured in Ireland. EU hosting does not by itself rule out access or processing outside the EEA by service providers and their subprocessors. Apple, Google, Anthropic, RevenueCat and Expo may process data in other countries, including the United States; vehicle-data providers may also process VIN lookups outside the EEA.

Transfers of personal data must have a lawful basis under GDPR Chapter V, such as an applicable adequacy decision or appropriate contractual safeguards, including EU Standard Contractual Clauses and supplementary measures where necessary. Contact support@sixline.app for information about the mechanism applicable to a specific transfer and a copy of relevant safeguards, subject to lawful redactions.

6. Data retention

Account and vehicle records are retained to provide your account and requested features until you delete them or your account, subject to lawful retention needs. Settings → Delete account removes the account and its linked database records and initiates removal of cloud attachments (the same on iPhone and Android). If you no longer have the app, you can request deletion at https://sixline.app/delete-account or by email to support@sixline.app. Deletion is not a guarantee of simultaneous erasure from every backup, log or external provider. If deletion fails or you need assistance with residual data, contact support@sixline.app.

Retention depends on the data and purpose: diagnostics and usage events are deleted after about 30 days; paid-feature usage entries until your account is deleted or for at most 400 days, whichever comes first; the shared VIN cache has no automatic expiry and is not linked to your account — it is kept to avoid paying for repeated lookups of the same VIN, and it contains vehicle specifications, not your name or email. These periods must be limited to what is necessary. Backup copies are subject to the hosting provider’s backup lifecycle and restricted recovery purposes. Records required for accounting, legal obligations or the establishment, exercise or defence of legal claims may be retained for the applicable statutory or limitation period, with access limited to that purpose.

Apple, Google and other providers may retain records for their own legal obligations under their respective roles. Contact us for assistance with an erasure request relating to data processed for SixLine. Usage statistics carry no identifier, so individual events cannot be attributed to you; they are deleted after about 30 days.

7. Your rights

Subject to the conditions in GDPR (and UK GDPR for users in the UK), you may request access, correction, erasure, restriction and a portable copy of your data, object to processing based on legitimate interests, and withdraw consent at any time. Contact support@sixline.app. We normally respond within one month; where a lawful extension is necessary, we will explain it within that month. We may request proportionate information to verify your identity.

You may complain to a supervisory authority, particularly where you habitually reside, work or where an alleged infringement occurred. Our establishment is in Romania, where the supervisory authority is ANSPDCP (www.dataprotection.ro). Contacting us first is not required.

We do not sell personal data or share it for cross-context behavioural advertising. Wherever you live, you can ask us for access, correction or deletion at support@sixline.app.

8. Data on your device

Vehicle and maintenance records are stored on your device before sign-in and as a local copy afterwards. If you add the SixLine Home Screen (iOS) or home-screen (Android) widget, a short summary of your next service (vehicle name, service item, status and mileage) is also stored on your device for the widget to display. Device security and operating-system backup settings affect these copies. Removing the app normally removes its local app data, but exported files, device backups and copies on other devices may remain. We cannot remotely erase those copies; manage them through your device, backup provider or the location where you saved them.

9. Children’s privacy

SixLine is not intended for children under 16. The minimum age for an Apple or Google account does not determine eligibility for SixLine. We do not knowingly collect personal data from children under 13, or under 16 where local law sets that age, and we delete it if we learn we have. If you believe a child has supplied personal data to us, contact support@sixline.app so that we can investigate and take appropriate action. Users must also meet the capacity and parental-authorization requirements in the Terms.

10. Changes to this policy

We will update this policy when our processing changes and provide appropriate notice of material changes before new processing begins. Where a new purpose requires consent, we will request it separately. Reading this policy or continuing to use the app does not itself constitute consent.

11. Contact

Contact: support@sixline.app. The controller is identified in section 1; full legal details are in the Terms of Service.

Questions about this Privacy Policy, or to exercise your GDPR or UK GDPR rights: support@sixline.app