Version 1.4 · Effective 11 October 2026
Who we are
10mil Technologies Ltd ("10mil", "we", "us") provides workshop management software for independent garages and mobile mechanics.
Registered in England and Wales, company number 17241824. Registered office: 66 Paul Street, London, EC2A 4NA. ICO registration number: ZC241695.
Contact for privacy matters: privacy@10mil.co.uk. General questions: hello@10mil.co.uk.
Who this policy covers
This policy explains how we handle personal data about workshop owners and their staff who use 10mil, and people who join our waitlist or contact us.
Workshops also use 10mil to store details about their own customers and vehicles. For that data, the workshop is the controller and 10mil acts as its processor. How we act as processor is set out in our Data Processing Agreement at www.10mil.co.uk/dpa, which forms part of our Terms. If you are a workshop's customer, please read that workshop's privacy notice in their customer portal, or contact the workshop directly.
When a workshop switches it on, 10mil sends MOT reminder emails to that workshop's customers on the workshop's behalf, as the workshop's processor. Customers can unsubscribe from any reminder email, and the opt-out applies to every workshop that uses 10mil.
When a workshop sends an estimate, quote or invoice by email, 10mil sends that email to the workshop's customer on the workshop's behalf, as the workshop's processor.
What we collect
- Account details: name, business name, email address, phone number, business address, password (stored encrypted).
- At workshop sign-up: your mobile/phone number and, if you add them, business address, website and social media links — used for account support and to spot fraudulent or duplicate accounts.
- How you heard about us: your answer at sign-up, the website that referred you, and any campaign tags (utm) in the link you followed.
- Business records you enter: bookings, quotes, invoices, expenses, staff details, customer and vehicle records.
- Payment information: handled by Stripe. We do not see or store full card numbers.
- Vehicle data: registration numbers and vehicle details returned by lookup services.
- Usage of AI features: the questions you ask and the answers returned.
- Phone calls, if you use the AI Receptionist: caller phone number, call recording and transcript.
- Records of emails we send you (welcome, trial and account emails) and whether they were delivered.
- Links in our emails to workshops record when they're clicked so we know the email reached you; we don't use tracking pixels.
- Technical data: device and browser type, sign-in times, and error and diagnostic logs (with personal details removed).
- Which days you use the app (from signed-in sessions), used to support you and improve 10mil.
Why we use it and our lawful basis
- To provide the service you signed up for (contract).
- To take subscription payments and process payments for your invoices (contract).
- To send account emails, such as your welcome email and trial-ending reminders (contract and legitimate interests).
- To understand which channels bring workshops to 10mil (legitimate interests).
- To send MOT reminder emails to a workshop's customers, on that workshop's instructions (as the workshop's processor).
- To keep the service secure, prevent fraud and fix faults (legitimate interests).
- To meet tax, accounting and legal obligations (legal obligation).
- To send service emails about your account (contract). We only send marketing emails if you have agreed, and you can unsubscribe at any time (consent).
Who we share it with
We use the following service providers to run 10mil. Each only receives the data it needs for its task:
- Supabase (via Lovable Cloud): database hosting, sign-in and file storage, EU region.
- Stripe: subscriptions and card payments.
- Twilio: phone calls and SMS, only if you use the AI Receptionist or texts (coming soon).
- ElevenLabs: voice synthesis, only if you use the AI Receptionist (coming soon).
- Resend: sending emails.
- Google (Gemini) and OpenAI, via the Lovable AI Gateway: AI features. We remove vehicle registrations and VINs before sending questions to AI models.
- Perplexity and Firecrawl: web research for diagnostic features.
- HaynesPro / Infopro Digital: technical repair data.
- CheckCarDetails: vehicle and MOT lookups.
- GSF Car Parts: parts pricing and ordering, if you link your account.
- Xero and QuickBooks: accounting sync, if you connect them.
- Meta Platforms Ireland Ltd: marketing cookies (Meta pixel) on our public website only, and only if you accept marketing cookies. It records page visits and a completed sign-up — never your name, email or phone, and never anything inside the app or customer portal.
The full list of services that process workshop customer data for us is in the Data Processing Agreement (www.10mil.co.uk/dpa).
We do not sell personal data.
International transfers
Some providers process data outside the UK. Where they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement/Addendum to protect it.
How long we keep it
- Account and business records: while your account is open. If you ask us to delete your account, it is deleted 14 days after your request, and you can cancel during those 14 days. Invoices and accounting records are kept for 6 years to meet HMRC requirements, in anonymised form where possible.
- Vehicle lookup failure logs: 90 days.
- Error logs: 90 days.
- Records of customer reminder emails: 2 years.
- Records of account emails we send you: 2 years.
- HaynesPro access audit log: kept as required by our licence agreement with HaynesPro, with registrations masked.
- AI Receptionist call recordings and transcripts: 90 days (this feature is not live yet).
- HaynesPro technical data is never stored. It is displayed to you and then discarded.
Your rights
You can ask us to access, correct, delete or export your personal data, to restrict or object to how we use it, or to withdraw consent. Email privacy@10mil.co.uk and we will reply within one month.
You can also delete your account yourself in Settings → Danger zone.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Cookies and local storage
On your first visit a banner asks what you're happy for us to use. Nothing non-essential is stored or loaded until you choose.
- Essential (always on): keeps you signed in, keeps the service secure and remembers your cookie choice (saved as "tenmil_consent").
- Analytics (only with your OK): a small note of which website referred you and any campaign tags in the link, so we know how workshops find us.
- Marketing (only with your OK): the Meta pixel on our public website pages, so we can see which Facebook and Instagram ads work. Meta Platforms Ireland receives the page visited, a completed sign-up event and its own cookies (_fbp). It is never loaded inside the workshop app, admin area or customer portal, and we never send it your name, email or phone.
Your choice lasts 12 months, then we ask again. We also ask again if the categories change.
You can change or withdraw your choice at any time with the "Cookie settings" link in the footer of every page, in the app's Settings and in the customer app. Withdrawing removes the analytics note and marketing cookies we set, and stops those scripts.
Changes to this policy
We will post any changes on this page and update the version and date above. For significant changes we will tell you by email or in the app.
Version 1.4 (11 October 2026) adds the cookie banner and consent choices, Meta as a marketing recipient (only with consent) and a link to the Data Processing Agreement. Wording update 11 October 2026: SendGrid removed from our providers (no longer used).
Version 1.3 (5 October 2026) adds estimate and invoice emails sent on a workshop's behalf.
Version 1.2 (4 October 2026) adds a record of which days you use the app.
Version 1.1 (3 October 2026) adds MOT reminder emails, sign-up source and account emails, error logs, new contact addresses and exact retention periods.