Privacy notice

Controller and contact

Charlie Miller, trading as My Pothole Claim, is the controller for this service. Privacy requests can be sent to hello@trustedbyspot.com.

Information we use

• name, email, phone number and postal address you provide
• vehicle registration, make, model and ownership information
• incident date, time, road, postcode, precise coordinates and circumstances
• damage descriptions, photographs, invoices, estimates and other uploaded evidence
• claim reference, document versions, payment status and security audit records
• limited technical information needed for security and aggregate service counts

Purposes and lawful bases

We use claim data to save your work, identify the likely road authority, prepare and re-supply the pack, process payment and provide support. This is necessary to take steps at your request and perform the contract.

We use limited security, fraud-prevention and aggregate operational records for our legitimate interests in protecting and improving the service. We retain transaction records where necessary to meet legal, tax and accounting obligations. We do not use claim data for advertising.

Who receives information

Netlify provides hosting, private file storage and the managed database integration. Stripe receives payment and customer-email information needed for Checkout. A transactional-email provider receives an email address only when a secure resume email is requested.

Postcodes.io may receive the incident postcode or coordinates, and GOV.UK may receive the postcode, to return public administrative-authority information. They are not sent the claimant name, vehicle registration, damage description or uploaded evidence. Highway authorities receive nothing from us automatically; you decide whether to submit the finished pack.

No AI decision-making

The road-authority lookup uses postcode, road and official administrative data. It does not use a single-use AI API, score legal prospects or make a decision with legal or similarly significant effects.

Retention

Unpaid saved drafts and their evidence are deleted after 30 days of inactivity. Paid pack data and uploaded evidence are kept for up to 18 months so the customer can re-download or correct the pack, then anonymised. Minimal payment and accounting records may be retained for up to six years where required.

Expired resume tokens and rate-limit records are removed automatically. A customer can download a machine-readable copy or delete a saved claim from the claim builder at any time. Deletion does not remove records that must be retained by Stripe or under law.

Security and transfers

Access links use high-entropy tokens stored in hashed form. Evidence is stored privately, validated by file type and signature, and not published. Providers may process data outside the UK; where this happens we rely on the provider's lawful transfer safeguards and contractual protections.

Your rights

Depending on the circumstances, UK data-protection law gives rights to access, correct, erase, restrict or object to processing and to receive portable data. Email us to exercise a right. We may need to verify the request.

You can complain to the Information Commissioner's Office at ico.org.uk. Please contact us first if you would like us to resolve an issue. Last updated: 14 August 2026.