Privacy Policy

LAST UPDATED: SEPTEMBER 2026 (v4)

This policy explains what personal data Scratch Spy ApS ("Scratch Spy", "we", "us") collects through this website, why, and what rights you have over it. It does not cover data processed on behalf of client fleets under a separate Data Processing Agreement, that is governed by the terms agreed directly with each fleet partner.

Who we are

Scratch Spy ApS is a company registered in Denmark. For any question about this policy or your data, contact us at kasper.rost@scratchspy.com or +45 27 11 56 06.

What we collect on this website

When you use the contact form on this site, we collect:

• Your name and company name
• Your email address
• Fleet size, if you provide it
• Any message you choose to include

When you sign up for a plan or join the Enterprise waitlist, we additionally collect:

• Your phone number
• The number of vehicles in your fleet
• Your country
• Your preferred billing currency
• Which plan or product you're interested in

We only collect what you actively submit through our forms. We do not passively track your browsing activity on this site.

Cookies, storage and tracking

This website does not use tracking or advertising cookies, and no analytics tools.

To remember choices you make, the site stores three small values in your own browser (local storage): your chosen language, your chosen currency and which type of business you told us you are. They never leave your browser, are not used to identify you, and you can remove them at any time by clearing your browser data.

The language we suggest is based on your browser's own language setting. We do not look up your location, and no geolocation service is used.

How we use your data

We use the information you submit solely to respond to your enquiry, for example, to arrange a conversation about becoming a client. We do not sell your data, and we do not use it for advertising.

Third parties who process this data on our behalf

Contact form submissions are delivered to us via FormSubmit (formsubmit.co), a form processing service that forwards the submission to our inbox. Their privacy policy is available at formsubmit.co.

The fonts on this site are currently loaded from Google Fonts. When a page loads, your browser contacts Google's servers, which receive your IP address. We plan to serve the fonts from our own server so that this no longer happens.

How long we keep it

We retain contact form submissions for as long as reasonably necessary to respond to your enquiry and maintain a record of business contact, typically no longer than 24 months from your last contact with us, unless you ask us to delete it sooner or we're required to keep it longer by law.

Enterprise waitlist entries are kept until Enterprise launches and we've had a chance to reach out, or until you ask us to remove you, whichever comes first.

Your rights

Depending on where you're located, you may have the right to access, correct, or request deletion of your personal data, or to object to our processing of it. To exercise any of these rights, email kasper.rost@scratchspy.com. We'll respond within a reasonable time, and in any event within the timeframe required by applicable law.

Where a deletion request concerns personal data referenced within a vehicle's incident history (for example, a former driver), we'll remove the personal data itself; the underlying incident record (that damage occurred, on which date, and in which area) may be retained in anonymized form as described under "Fleet and vehicle data" below.

Fleet and vehicle data

If your company becomes a Scratch Spy client or partner, the vehicle, telematics, and video data processed as part of the service is governed by a separate Data Processing Agreement between Scratch Spy and your company, not by this website privacy policy. Your company remains the data controller for that data; Scratch Spy processes it only on your company's instructions.

Vehicle history tied to the VIN, not the current owner. Incidents are linked to a vehicle's VIN, because the history of a vehicle is useful to whoever owns, insures or leases it next. How this works in practice:

• When a vehicle leaves your fleet (sold, returned at lease-end or scrapped), nothing is deleted. Your company's cases on that vehicle remain your company's records, under your control, for example for claims still in progress. The vehicle simply stops receiving new data.
• What a later owner, insurer or leasing company can see when they look up the VIN: the date of each earlier incident, what happened, the type of damage, and the outcome (for example repaired, or cost recovered). They never see which company owned the vehicle, the vehicle's name or plate in your fleet, drivers, photos, notes or the exact time and position.
• When your company stops using Scratch Spy, your company's data is deleted as agreed in the Data Processing Agreement, after you have had the chance to export it. Only an anonymous record of each incident on a vehicle with a VIN is kept: the date, an area of about 1 km, what happened, the type of damage, the repair cost rounded to the nearest 100, and the outcome. It contains no company identity, no names, no driver, no photo, no note and no exact time or position, so it cannot be traced back to your company or to any person.

The full terms are set out in the Data Processing Agreement, not this policy; if your company is a client, that agreement governs.

Anonymized insights across clients. Some features compare patterns across several client fleets, for example repair prices for a type of damage, or the same repair shop or third-party plate appearing in several fleets' incidents. These features only show aggregated or anonymized results, other fleets are never named, and a result is only shown once at least five separate fleets contribute, so that no single fleet's data can be singled out.

Retention of photos. Stills from cameras and dashcams attached to incidents are deleted automatically 90 days after upload. Photos of the damage taken by a driver are part of the claim evidence and are kept with the case for as long as the case is kept, as agreed in the Data Processing Agreement. A photo of a vehicle itself (to recognise it, not of an incident) is kept while the vehicle is in your fleet; please take it without people in the picture. No photo is ever part of the anonymous vehicle history.

Maps and vehicle models. Maps in the app are loaded from OpenFreeMap (map data from OpenStreetMap contributors), which receives the viewer's IP address when a map is shown and sets no cookies. The link to a larger map opens openstreetmap.org. When a VIN is entered, the VIN alone is sent to the US National Highway Traffic Safety Administration's public vPIC service to look up the make and model; no other data is sent.

Alerts to your own chat tools. If your company connects Slack or Microsoft Teams, new incident alerts (vehicle name, incident type and confidence) are sent to the channel your company chooses.

Changes to this policy

We may update this policy as the business evolves. The date at the top of this page reflects the last update.

← Back to homepage