Privacy Policy

Last updated: 16 April 2026  ·  Fizzy Milk Labs

1. Who We Are

My Garage is a vehicle management service operated under the trading name Fizzy Milk Labs ("we", "us", "our"). Our service is accessible at fizzymilklabs.co.uk. You can contact us at mechanic@fizzymilklabs.co.uk.

2. What Data We Collect

When you create an account and use My Garage, we collect the following:

• Account information — your name, email address, and a bcrypt hash of your password. We never store your password in plain text.
• Garage slug — the unique URL identifier you choose for your garage.
• Vehicle data — details you enter about your vehicles: make, model, year, registration, MOT dates, insurance dates, notes, and photos.
• Documents — files you upload (MOT certificates, service invoices, insurance documents, etc.), stored encrypted on our servers.
• Service history — records you add manually or that are auto-extracted from uploaded documents.
• Usage data — basic server logs including IP addresses and request timestamps, retained for up to 30 days for security and debugging purposes.
• Feedback messages — if you choose to submit feedback via the in-app feedback button.

3. Document Encryption

All documents you upload are encrypted at rest using AES-256-GCM encryption. The encryption key is derived from your password using PBKDF2 (100,000 iterations, SHA-256). This means we cannot read your documents. If you lose your password, document access cannot be recovered — we have no way to decrypt your files on your behalf.

This is a deliberate design decision to protect your privacy. If you reset your password, existing encrypted documents may become inaccessible.

4. How We Use Your Data

• To provide and operate the My Garage service.
• To send transactional emails — verification emails on signup, and MOT/insurance reminder emails if you have them enabled.
• To display your vehicle and document data back to you and any collaborators you invite.
• To improve the service — anonymised, aggregated usage patterns only.
• To fulfil any legal obligations we are subject to.

We do not use your data for advertising. We do not sell your data to third parties. We do not use your data to train AI models.

5. AI Document Reading

If you use the AI document reading feature (available on the AI Enhanced plan), the text content of your documents is sent to Anthropic via their API for processing. Only the document content is sent — no account details or personal identifiers are included in API calls. Anthropic's data handling is governed by their Privacy Policy. You are in control of which documents you choose to AI-read; it is not automatic.

6. Third Parties

We use a small number of third-party services to operate My Garage:

• Brevo (formerly Sendinblue) — transactional email delivery. Brevo processes email addresses and message content for the purpose of delivery. See Brevo's Privacy Policy.
• Anthropic — AI document reading (AI Enhanced plan only). See above.
• Stripe — payment processing (paid plans). When you subscribe, Stripe processes your payment card details. We never store your card details. See Stripe's Privacy Policy.
• HostingUK / Simpleservers — UK-based server hosting. Your data is stored on servers in the United Kingdom.

We do not use Google Analytics, Facebook Pixel, or any advertising or behavioural tracking services.

7. Data Storage and Security

Your data is stored on servers located in the United Kingdom. We implement reasonable technical and organisational measures to protect your data, including encrypted document storage, bcrypt password hashing, HTTPS, and strict session isolation between garage accounts.

No method of transmission over the internet or electronic storage is 100% secure. While we work hard to protect your data, we cannot guarantee absolute security.

8. Data Retention

• Active accounts — data is retained for as long as your account is active.
• Deleted accounts — when you request account deletion, your garage folder, database, and all uploaded files are permanently deleted within 30 days.
• Server logs — retained for up to 30 days then automatically purged.
• Feedback submissions — retained until reviewed and marked as resolved, then deleted.

9. Your Rights (UK GDPR)

Under UK data protection law, you have the following rights:

• Right of access — you can request a copy of the personal data we hold about you.
• Right to rectification — you can correct inaccurate data by editing it directly in your garage, or by contacting us.
• Right to erasure — you can request deletion of your account and all associated data.
• Right to data portability — you can export your documents as a zip file from within your garage at any time.
• Right to object — you can object to how we process your data where processing is based on legitimate interests.
• Right to restrict processing — you can ask us to pause processing of your data in certain circumstances.

To exercise any of these rights, contact us at mechanic@fizzymilklabs.co.uk. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

10. Cookies

My Garage uses a single session cookie (garage_dash) which is essential for keeping you logged in. This cookie is set when you sign in and deleted when you sign out. We do not use tracking cookies, advertising cookies, or any third-party cookies.

Because we only use an essential session cookie, we are not required to display a cookie consent banner. If you disable cookies in your browser, you will not be able to stay logged in.

11. Children

My Garage is not directed at children under 13 years of age. We do not knowingly collect personal data from children. If you believe a child has created an account, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top of this page will reflect any changes. For material changes, we will notify you by email. Continued use of My Garage after changes constitutes acceptance of the updated policy.

13. Contact