1. Who we are
Intravyn Ltd trading as Intravyn, company 17252837, is registered in England and Wales at Reeth Cottage, Aysgarth, Leyburn, DL8 3AH. The Data Protection Lead is Intravyn Ltd and can be contacted at legal@intravyn.com.
This Notice applies to authorised adult users acting for UK garage businesses and visitors to vehivyn.com and app.vehivyn.com.
2. When we are controller or processor
Intravyn is controller for website visitors, founding-workshop applications, account administration, security logs, service communications, optional direct marketing, supplier management, legal compliance, consent-based first-party and PostHog marketing analytics, and Meta advertising measurement.
Your garage business is controller for customer, vehicle, job, staff, quote, invoice and other personal data it chooses to enter. Intravyn processes that data on the garage’s documented instructions under the DPA. People whose information a garage enters should normally contact that garage first.
3. Personal data we use
- Founding-workshop application details: business and applicant name, website, operation type and any supplied description, technician and van numbers, approximate work volume, operational problems, founding-programme reason where requested, telephone, email, contact permission, source page and submission time.
- Account and business details: name, work email, company, role, credentials and verification state.
- Subscription and billing records: Stripe customer and subscription identifiers, selected plan, status, paid-period end, cancellation state, invoice history and legal-acceptance evidence. Vehivyn does not store full card details.
- Service and support records: requests, correspondence and operational activity.
- Technical and security information: IP address, user agent, authentication and audit events, device and request information.
- Marketing choices: email, channel, granted or withdrawn state, wording version, source and server timestamp.
- With optional-tracking consent, Vehivyn pseudonymous visitor and session UUIDs, page path, external referrer host, consent-policy version and time.
- With the same consent on the public marketing website, PostHog receives and may associate with a person profile complete page URLs including query strings and fragments; referrers and campaign parameters; page views and page-leave events; click, change, form-submit and copied-text interactions; visible page and element text; DOM element names and attributes; form interactions and non-password input values through session replay; timestamps; device and session identifiers; browser, operating-system and device information; viewport and screen sizes; and network-derived context. The website configuration does not mask or remove those fields after consent.
- With the same consent on the public marketing website, Meta Pixel page URL and referrer data, Meta cookie identifiers, IP address, user agent and other browser, device and network information. No advanced-matching fields are configured in the website code.
- Garage-controlled Customer Data described in the DPA processing schedule.
4. Purposes and lawful bases
| Purpose | Lawful basis |
|---|---|
| Review founding-workshop applications and contact applicants about qualification and a discovery call | Steps requested before contract and legitimate interests in selecting suitable B2B founding partners; contact follows the applicant’s express request |
| Create and administer approved business accounts; provide Vehivyn and support | Contract and steps requested before contract |
| Protect the service, prevent abuse and keep operational records | Legitimate interests in operating a safe, reliable B2B service; legal obligation where applicable |
| Send essential verification, account and service messages | Contract and legitimate interests; these are not marketing |
| Send optional product news and garage tips by email | Consent, recorded separately and withdrawable at any time |
| Measure public website use, navigation, form completion and signup conversion through first-party analytics and PostHog session replay so we can analyse and improve the marketing experience | Consent for optional storage/access and associated processing |
| Measure Meta campaign performance and support audience-based advertising on Meta services | Consent for optional storage/access and associated processing |
| Comply with law and establish or defend claims | Legal obligation and legitimate interests |
PostHog and Meta Pixel are limited to public marketing routes and are not installed inside signed-in garage workspaces. After consent, PostHog is configured for person profiles, full URL and referrer collection, broad interaction autocapture and session replay containing unmasked non-password form values, page text and DOM attributes. Heatmaps and error capture remain disabled. Vehivyn does not configure Meta advanced matching or send garage Customer Data through either integration.
6. International transfers
The primary Vehivyn server is in Manchester, United Kingdom. The PostHog integration is configured for PostHog Cloud EU, whose service data is hosted in Frankfurt, Germany, although PostHog, Inc. and its approved providers may process data from other countries. Other providers, including Meta, may also process data internationally. Where UK personal data is transferred internationally, Intravyn requires an applicable lawful transfer mechanism such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum, plus supplementary measures where appropriate. Provider terms are linked from the Subprocessors page or the recipient’s policy above.
7. Retention
Founding-workshop applications are retained only while needed to assess and follow up the application, maintain appropriate business records, comply with legal duties and handle claims. Account, security, support and Customer Data are retained for the service relationship and then only as needed for deletion/return, legal duties and claims. Transactional email records and backups follow documented operational schedules and are deleted or overwritten in the ordinary backup cycle, subject to technical and legal limits.
Consented raw Vehivyn first-party marketing page views and signup-attribution records have no scheduled age-based deletion. PostHog events, person profiles and session replays are retained for the periods provided by the configured project plan and settings. Their continued necessity and those settings are documented and reviewed at least annually. When a visitor withdraws optional-tracking consent, Vehivyn stops first-party and PostHog tracking and recording, clears PostHog browser analytics state, deletes first-party page views tied to the Vehivyn visitor UUID and unlinks it from signup attribution. Withdrawal does not automatically remove events, profiles or replays already held by PostHog; Intravyn handles applicable erasure requests with the provider. Known Meta cookies are expired and future pixel events stop; Meta controls retention of information it already received under its own policy.
Legal-acceptance and marketing-choice event records are retained as evidence of the agreement and consent history for as long as reasonably needed for legal compliance or claims.
8. Your rights
Depending on the circumstances, UK data-protection law gives rights to access, correct, erase or restrict personal data, object to processing, receive portable data, and withdraw consent without affecting earlier lawful processing. You may withdraw email marketing on the Marketing preferences page and optional website tracking through Cookie preferences.
Contact legal@intravyn.com. We may need to verify identity and authority. If the request concerns a garage’s Customer Data, we will assist the garage as processor.
9. Complaints and the ICO
Please contact us first so we can investigate. You may also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint or by the contact methods published by the ICO.
10. Changes to this Notice
We will publish changes here and update the version and effective date. We will request a fresh cookie decision before analytics resumes where a material purpose or provider change affects that consent. Material account-processing changes will be communicated where appropriate.
Contact us
Data Protection Lead, Intravyn Ltd, Reeth Cottage, Aysgarth, Leyburn, DL8 3AH.
Email legal@intravyn.com for legal or privacy matters, or support@intravyn.com for product support.