Privacy policy

Who we are

Curbed is made by B Squared Software Development Ltd, a company registered in England and Wales. Curbed is the damage and maintenance record for vehicle fleets: drivers report from the vehicle, the workshop and the office handle it, and the record stays attached to the vehicle.

This policy explains what personal data Curbed processes, why, for how long, and what your rights are. Our contact details are at the bottom of this page.

Two roles

For the website at curbed.cab, we are the controller.

For the Curbed app your company uses, your company is the controller. It decides who gets an account and what is recorded; we process that data on the company’s behalf, under an agreement with the company. Questions about your account, or requests to see, correct or delete data in your company’s Curbed, therefore go to your company first. We help the company answer them.

What we process in the app

Account: your name, email address, role, language preference and the times you sign in. Your password is stored only as a salted hash, never in readable form.

Reports: the description, photos, odometer readings, fuel details, the vehicle and the timestamps, linked to the account that recorded them.

Notifications: if you turn them on, a push subscription for your browser or the push token of your iPhone, so we can reach you about reports assigned to you.

Technical: server logs with IP address and browser type, kept briefly for security and troubleshooting.

What we process on the website

The website has no accounts. It uses three cookies of its own: one for your language preference, one holding the company addresses you entered if you use the company chooser, and one recording your answer to the question about Google Analytics below. The second is set only when you submit the form yourself, and the third only when you answer.

We count visits ourselves, using our own software on our own server in Germany. It sets no cookies and stores nothing on your device. It records the page you read, the site or link you arrived from, any campaign parameters in that link, your browser, operating system and device type, and the country your connection comes from. It never follows you to another website, and you can switch it off for this browser further down this page.

The demo company at demo.curbed.cab is the one part of Curbed where we also count what you do: which role you sign in as, the pages you open and the buttons you press, the same way and on the same server. Signing in there sets a session cookie, and if you arrived through a link carrying a short tag (the name of a firm we sent it to, or which of our pages you came from), two more cookies remember that tag for 30 days. Nothing you type there reaches a real company, and all of it is deleted every 12 hours.

If you allow it, we also use Google Analytics. It sets its own cookies and sends the page you are reading, the link you arrived from, your IP address and details of your browser to Google LLC in the United States. Google provides the service for us and also uses some of that data for its own purposes, such as keeping the service running and improving it. You can change your answer at any time further down this page.

The Google tag itself loads on every page, before you answer and after you say no. Until you allow it, it sets and reads no cookies and no identifier, and sends Google only a cookieless signal from each page: the time, the page, details of your browser and whether you have agreed, along with your IP address, which every request to Google carries. Google uses it to estimate totals rather than to recognise you. We would rather say that plainly than let you assume nothing happens before you click.

If you ask for a demo, we keep what you tell us: your name, your company, your email address, and — if you fill them in — the size of your fleet and your message. We also record which page you asked from, which language you were reading, the site or link that brought you, and any campaign parameters in that link, so we can see which of our own marketing actually reaches people. We use it to answer you and to work out whether Curbed suits your fleet, and we do not pass it to anyone else.

We do not do any of this in the app. Measuring the website tells us whether our own marketing works; the app holds your company’s records, we hold them under our agreement with your company, and nothing in it is measured for us.

AI: photos and translation

Curbed does not send your photos to any AI service. There was a period when damage photos were sent to a provider in the United States for an automatic suggestion; that feature is switched off and is no longer on for any company. Photos stay on our servers in Germany.

If photo analysis ever returns, it will not do so quietly: it will be described here first, and a company will switch it on itself or leave it off.

Text is a different matter. A company can switch on automatic translation in its settings; it is off unless they do. When it is on, we send what is written on a report — the description, notes and the account of what was repaired — to an AI language model at Ollama in the United States, which translates it for colleagues reading the app in the other language. That text leaves the European Union to be translated. Your name, your email address and photos are not sent, but anything somebody wrote into that text is.

If a company switches translation off, nothing more is sent from that moment. Translations already made stay stored with the report and visible until somebody changes the text, at which point its translation is removed.

Where data is kept and who else sees it

Curbed runs on servers operated by Hetzner Online GmbH in Germany, within the European Union.

Push notifications are delivered through the push service of your browser or device (Apple, Google or Mozilla). The content of a web push message is encrypted in transit and cannot be read by that service. Notifications to the iPhone app go through Apple’s Push Notification service: Apple receives your device’s push token and the content of the notification — which kind of event it is, the vehicle’s fleet number or an applicant’s name, never a description or a photo — and relays it to your phone.

If your company has switched on automatic translation, the text of reports goes to Ollama in the United States to be translated, as described above. If it has not, nothing from the app goes to Ollama.

If you allow Google Analytics on the website, that data goes to Google LLC in the United States. The transfer is covered by Google’s data processing terms, which incorporate the European Commission’s standard contractual clauses and the UK addendum to them. This applies to the marketing website only, never to the app.

We do not sell data and do not share it with anyone other than the providers named above, unless the law requires us to.

How long we keep data

Reports, photos and the vehicle record are kept for as long as your company has a Curbed account. That is the point of the product: a record per vehicle that is still right years later.

When a company leaves, it can export everything first. We then delete that company’s data within 30 days.

You can delete your own account at any time, in the app under Account. Your name, email address and sign-in details are erased immediately and you are signed out everywhere; your reports remain part of the vehicle record without your name. A company can also deactivate an account, and can ask us to erase personal data. Push subscriptions lapse when you turn notifications off or the subscription expires. Server logs are kept briefly.

If you asked for a demo, we keep your name, company, email address and anything you wrote for 24 months, and then we remove them. What is left — which page you asked from, which language, and which link brought you — no longer says who you are, and we keep it to see which of our own marketing works.

Security

Every connection is encrypted (TLS). Passwords are stored with argon2. Data belonging to different companies is strictly separated, and within a company your role decides what you can see.

Your rights

Under the UK GDPR and the EU GDPR you have the right of access, rectification, erasure, restriction of processing, data portability and objection to processing.

For data in your company’s Curbed, make your request to your company; we help the company respond within the statutory time. For the website, email us directly.

You can also complain to a supervisory authority: in the United Kingdom the Information Commissioner’s Office (ICO), in the Netherlands the Autoriteit Persoonsgegevens, or the authority of the country where you live.

Children

Curbed is a work tool and is not intended for anyone under 16.

Changes

If we change this policy, we update the date at the top. For a material change we inform your company, which informs you.