Privacy

Who is responsible for the data

EMSHI is operated by Evoniti Ltd (company number 08033294), a company registered in England and Wales. Privacy requests and enquiries: hello@emshi.app or the contact page. If an organization provides EMSHI to its staff, tenants, or visitors, that organization may also be a controller for the data it enters and manages.

Data we expect to process

For requesters, EMSHI may process the QR token scanned, approximate technical information needed to run the service, an anonymous browser session identifier for the request, and request status.

For responsible contacts and administrators, EMSHI may process names, phone numbers, account email addresses, organization details, billing contact details, vehicle registrations, optional vehicle make/model/colour, location names, QR issue history, notification metadata, and audit records.

We do not intend to show requester identity to responsible contacts unless a feature explicitly says so, and requesters should not see contact names, phone numbers, email addresses, or group membership.

Why we use data

We use data to operate vehicle movement requests, notify responsible contacts, prevent abuse, support administrators, generate QR stickers, keep audit records, and maintain the security of the service.

Where analytics or optional marketing tools are added, they must stay off until the required consent has been collected. Analytics events must not include vehicle registrations, phone numbers, or other unnecessary personal data.

Who we share data with

We expect to use service providers for hosting, database storage, notification delivery, email, payments, CAPTCHA, consent management, and analytics. These providers should only process data under contract and only for the purposes needed to provide EMSHI. We may disclose information where required by law or to protect the service and its users.

How long we keep data

Organization activity log entries (admin actions such as edits, QR changes, and notification outcomes) are kept for up to 30 days, then deleted automatically.

Movement request records, event history, and related operational metadata are kept while your organization uses EMSHI and for a reasonable period afterward for abuse prevention, support, billing disputes, and legal compliance. When an organization account is deleted, tenant data including contacts, vehicles, QR records, and movement requests is hard-deleted.

Optional requester phone numbers collected on Driver flows are deleted within about 24 hours after a request completes, is cancelled, expires, or receives no response. Short action links and similar tokens stop working when the underlying request closes or expires.

Sign-in and verification codes, import upload files, notification delivery logs, and analytics data are kept only as long as needed for security, troubleshooting, and billing — not indefinitely. We review retention categories periodically.

Where EMSHI is offered

EMSHI is operated from the United Kingdom. The service is offered globally where use is lawful and our providers can deliver SMS, email, and payments. The Shop page is available in the United Kingdom only. You are responsible for ensuring your use complies with local law where you are.

Your rights

Depending on where you are, you may have rights to access, correct, delete, restrict, export, or object to the use of your personal data.

If you are in the United Kingdom, you may complain to the Information Commissioner's Office (ICO) at ico.org.uk. If you are in the European Economic Area, you may complain to your local data protection supervisory authority. We encourage you to contact us first at hello@emshi.app so we can try to resolve your concern.

Contact

Use hello@emshi.app or the contact page for privacy questions, access requests, or deletion requests.