Privacy
Last updated 6 October 2026. How It Was is operated by Avolaunch Technologies Ltd (company number 14600671), registered in England and Wales. Registered office: Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA, United Kingdom. Contact [email protected] about your data.
What we handle
The free draft is stored on your device in browser storage. It contains the vehicle and collection details, notes and photos you add. It is not sent to our online record storage unless you choose the online record and complete checkout. Clearing browser data can remove a draft.
For a paid online record, we store the vehicle and collection details, your notes, original photos, photo hashes and a server receipt time. Your full private link is generated in your browser; the server stores a hash of its access token for record access. When we email your creator link or you request email sharing, the complete link is temporarily processed by our server and email provider to send your messages. Anyone you give the complete link to can see the record. We do not provide public search for records.
We also store the creator email you choose before checkout, which may differ from your billing email, to send your creator link once the paid record is saved. The creator link permits deletion and should be kept private. We retain the creator address and email queue status with the record; deletion removes them from our record storage.
Stripe processes your payment and collects the email and payment details you enter at Checkout. We keep a Stripe session reference with the record so we can confirm payment and help with support. We do not store your card number. When you contact support, we use your message and checkout email to handle your request. Cloudflare processes requests, stores the online record in our private D1 and R2 services, and provides the Turnstile check used at checkout.
If you email a private record link, we pass the recipient addresses, link and limited vehicle details to Resend for delivery. Each recipient gets an individual message. We do not add them to a marketing list. Our short-lived sharing ledger stores a request fingerprint, record reference, count and queue status without recipient addresses or the complete link; entries older than seven days are cleared when email sharing is next used. Resend processes the message and delivery logs under its own data protection arrangements. Messages already sent and PDFs downloaded cannot be recalled by deleting the online record. Only share with intended recipients; recipient links allow viewing only; the creator link also allows deletion.
Why we use it
We use record data to provide the online service you purchase (performance of a contract); payment and support details to administer purchases and meet applicable accounting obligations; and limited technical and security data to prevent abuse and keep the service working (our legitimate interests). We do not sell record photos or use them for advertising.
Access, storage and deletion
A completed online record is accessible for 12 months from finalisation. A scheduled cleanup removes the record and its photos after that period. You can delete it sooner using its private link. Deletion of the online record does not delete Stripe's separate payment records or a support email already sent. If a payment succeeds but the upload does not finish, contact support so we can help complete or refund it. You can also delete your local draft in the walkthrough or clear this site's browser storage.
We use Cloudflare for website delivery, bot checks, database and private photo storage, Stripe for checkout, and Resend for email sharing. Their processing may involve locations outside your country. We rely on the relevant provider's data protection arrangements for those transfers. For details of their own processing, see the providers' privacy notices.
Your choices and rights
You can ask us for access to, correction of or deletion of personal information we hold about you, and may have rights to restrict or object to processing, or to receive a portable copy. These rights depend on the circumstances. Email [email protected]. We may need to verify your connection to a private record before acting. You can also complain to the UK Information Commissioner's Office.