Privacy policy

Version 1 · in force since 29 October 2026

Taken from the service's current settings, not from the text: the AI provider in use, whether Google Maps Platform, Nominatim and Overpass are in use, the map tile server and the data-retention period — shown as they are today, 30 October 2026.

DamageBrief turns crash photos into a draft repair-cost estimate for businesses — fleet operators, insurers and claims handlers. This policy explains what personal data the service processes, why, on what legal basis, who receives it, how long it is kept and what your rights are.

1. Who is responsible

For the data DamageBrief decides about itself — user accounts, sign-in security, this website, cookie choices and our business contacts — the controller is:

damagebrief.com
Privacy contact: privacy@damagebrief.com

General questions and account requests: hello@damagebrief.com.

Case data is different. When a client company uploads a case — photos, vehicle documents, the vehicle's details, where and when the crash happened — that company is the controller of the case data: it decides what to upload and why. DamageBrief processes it only on the company's behalf, as its processor, under the data processing terms in section 8 of the Terms of service (Art 28 GDPR). If you appear in a case — as a driver, a vehicle owner, or a person visible in a photo — please contact the company that handled the claim. If you contact us instead, we pass your request to that company and help it answer.

2. What we process, why, and on what legal basis

Data	Why	Legal basis	How long
User accounts: name, e-mail address, password (stored only as a one-way hash), role (administrator or client user), the client account the user belongs to, when the account was created and changed	To give your organisation's staff access to the service	Performance of our contract with your organisation — Art 6(1)(b) GDPR where you are yourself our contracting party; otherwise our and your organisation's legitimate interest in performing that contract, Art 6(1)(f)	Until the account is erased — at your own or your organisation's request, or when the contract ends
Client accounts: the company's name, its users, its estimate defaults and — if it brings its own — its AI provider keys (stored encrypted, never shown again)	To run the service for the company: who may see its cases, what its estimates use, which key its AI calls run on	Performance of our contract with the company, Art 6(1)(b) — company data; personal data only where it names a person	While the company is a customer
The credits ledger of a client account: each grant, charge, refund or correction — when, how many credits, for which case, and which user or administrator made it	To charge for reports and keep every balance explainable line by line	Performance of the contract, Art 6(1)(b); financial records the law requires us to keep, Art 6(1)(c)	Kept as financial records while the account exists and as long as the law requires them; entries are never changed. When a person is erased, the entries stay but no longer name them (Art 17(3)(b) and (e) GDPR)
Sign-in sessions: when you signed in and last used the session, your IP address, your browser's identification string	To keep you signed in, and to detect and investigate misuse of accounts	Legitimate interest in the security of the service and of your account, Art 6(1)(f)	Until you sign out (signing out deletes the session) or the account is erased — a session you never sign out of is kept until then
The security check at sign-in (Cloudflare Turnstile): your IP address and characteristics of your browser, processed by Cloudflare	To stop automated attempts to break into accounts	Legitimate interest in security, Art 6(1)(f)	DamageBrief stores nothing from this check
Server logs: IP address, time, the address requested and the response. DamageBrief's own application log filters plates, VINs, client names, crash coordinates, e-mail addresses, passwords, keys and search terms out before anything is written; the web server and Cloudflare in front of it keep their own access logs of the requests	To run the service, find faults and detect attacks	Legitimate interest in a working, secure service, Art 6(1)(f)	As long as needed for these purposes, then deleted
Error reports: the technical details of an error, with personal data removed before the report leaves the application — no user identity; plates, VINs, client names, coordinates, e-mail addresses, search terms and keys are filtered	To find and fix faults	Legitimate interest in a working service, Art 6(1)(f)	As long as needed to fix the fault
Cookie choices: a random identifier of your browser, the choice you made, the policy version, the time, and a keyed one-way fingerprint of your IP address — not the address itself	To respect your choice, and to be able to show which choice was made (Art 7(1) GDPR)	Legal obligation, Art 6(1)(c)	Kept as evidence while the service runs; a later choice is added, never written over. It names no one
Erasure records: that an erasure was carried out, when, by which administrator and how many cases and files it removed, with a keyed one-way fingerprint of the erased e-mail address or client name	To be able to show that a request was carried out (accountability, Art 5(2) GDPR)	Legal obligation, Art 6(1)(c)	Kept while the service runs. They contain nothing that was erased
Messages you send us: your e-mail address, name and what you write	To answer you, and to set up accounts your organisation asks for	Steps before a contract and our legitimate interest in answering you, Art 6(1)(b) and (f)	As long as the correspondence is needed
Case data (as a processor — section 1): the client's name; the vehicle's type, make, model, plate, VIN, colour and first registration; the accident date and crash location (coordinates, city, country — also read from the photos' GPS data); photos of the damage, which can show people, other vehicles and their plates; vehicle documents such as registration certificates, which can name the owner; the AI's findings, the estimate, the report's translations and the nearby repair shops; the AI runs behind them (the AI's answers, token counts, costs — what was sent to the AI is not stored again, only a fingerprint of the instructions used)	To produce the estimate the client company asked for	The client company's own legal basis as controller; DamageBrief processes the data on its documented instructions (Art 28 GDPR)	Until the client company erases the case or asks us to; then the case is erased with its files and AI runs . The DOCX, PDF and ZIP reports are produced when they are downloaded and are not stored
Repair shops: name, address, telephone number and website of dealers and workshops near a crash, from public sources (OpenStreetMap, web search)	To show where the damaged vehicle can be repaired	Legitimate interest in showing nearby repair options, Art 6(1)(f) — this is public business information; it is personal data only where a shop is run by an individual	With the case it belongs to

Providing your account details is necessary for an account; without them you cannot use the service. Case data is provided by the client company, not collected from the people it concerns.

3. AI and automated processing

An AI model — currently Claude (Anthropic), chosen by an administrator — reads the photos and documents of a case, identifies the vehicle to assess, describes its visible damage, researches genuine parts, prices and labour times, and drafts the estimate; it also translates the report's texts into the report languages. The arithmetic of the estimate (labour times rate, parts, fees, VAT) is computed by DamageBrief itself, not by the AI.

The result is a draft for the client company's staff, who review it and decide what to do with it. DamageBrief makes no decision about any person, and nothing it produces has a legal or similarly significant effect on anyone by itself, so the rules on solely automated decisions (Art 22 GDPR) do not apply. The AI assesses vehicles and damage, not people; it is not asked to identify anyone in the photos.

Before a photo is sent to the AI provider, DamageBrief removes its metadata — including the GPS location — and reduces it to at most 2000 pixels on its long edge. A document uploaded as a PDF is sent as it was uploaded.

4. Who receives personal data

Only the service providers below, each for its stated purpose, and authorities where the law requires it.

Recipient	What it receives, and why	Where	Safeguard
Anthropic (Claude) — in use	For the AI analysis: a case's photos (metadata removed) and documents (PDFs as uploaded), the vehicle's details including plate and VIN, the crash location and city, the damage findings. For a report in another language: the report's English texts (findings, photo captions, line descriptions, notes), which can repeat details the AI saw. When the AI searches the web for parts, prices or repair shops, search terms derived from these (such as a part number or a city) are passed on to Anthropic's search provider	United States	Standard contractual clauses in the provider's data processing terms, or the EU–U.S. Data Privacy Framework where the provider is certified under it
OpenAI	The same as Anthropic, only while an administrator has switched the AI provider to OpenAI	United States	As for Anthropic
Cloudflare	Every request to damagebrief.com passes through Cloudflare's network (your IP address and the request), for delivery and protection against attacks; and the Turnstile check at sign-in	Global network; United States company	As for Anthropic
OpenStreetMap Foundation	Its address search (Nominatim — in use): a crash's coordinates, to find its city and country, and repair-shop addresses, to place them on the map — sent by our server, with no name or plate. Its map tiles (`tile.openstreetmap.org`): fetched by your own browser on the case pages, so it sees your IP address and which part of the map is shown.	United Kingdom; the map tiles are delivered through a worldwide content delivery network	The European Commission's adequacy decision for the United Kingdom; what we send names no one
OpenStreetMap data servers (Overpass API: `overpass-api.de`, and `overpass.private.coffee` as a fallback) — in use	A map area around the crash point, to find dealers and workshops near it — sent by our server, with no name or plate	Public community servers; their location is set by their operators	What we send is a map area that names no one
Google (Maps Platform) — not in use	Only while an administrator has configured a Google Maps key: a crash's coordinates, repair-shop addresses, and searches for repair shops near the crash (which name the vehicle's make)	United States	As for Anthropic
OVHcloud (hosting)	Everything above that DamageBrief stores — the servers, databases and files run on its infrastructure	European Union	No transfer outside the EU

When a client company uses its own AI key, the AI requests for its cases are made with that key, under the company's own agreement with the provider.

Two further tools are our own installations, not outside services: error tracking (a self-hosted Sentry, which receives only the scrubbed error reports described in section 2) and e-mail (a self-hosted Postal mail server on our hosting; DamageBrief currently sends no e-mail).

5. Transfers outside the European Economic Area

Anthropic, OpenAI, Cloudflare and Google are United States companies, so data they receive may be processed in the United States. Such transfers rely on the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914) in each provider's data processing terms, or, where the provider is certified under it, on the EU–U.S. Data Privacy Framework (Implementing Decision (EU) 2023/1795). Data sent to the OpenStreetMap Foundation goes to the United Kingdom, which the European Commission recognises as providing adequate protection. Write to privacy@damagebrief.com for information about these safeguards.

6. How long data is kept

The periods are in the table in section 2. Erasing a case erases its photos, documents, AI runs, estimate and repair shops together; erasing an account erases its sign-in sessions with it. Backup copies of the database and files are not edited; erased data leaves them as they are replaced in their normal rotation.

7. Your rights

Access and portability (Art 15, Art 20 GDPR): signed-in users can download everything held about their account — the account, its sessions and the cases they created, with the uploaded files — as a ZIP with a machine-readable JSON file, from their data page. Anyone can also ask us.
Rectification (Art 16): ask us to correct your details.
Erasure (Art 17): ask us to erase your account. An erasure removes the data itself; a minimal record that it was carried out is kept (section 2, erasure records).
Restriction (Art 18) and objection (Art 21): you can ask us to restrict processing, and object at any time to processing based on our legitimate interest.
Withdrawing consent: a cookie choice can be changed at any time on the cookie preferences page; withdrawing does not affect what was done before.
Complaint (Art 77): you can complain to a data protection supervisory authority, in particular in the EU or EEA country where you live, where you work or where you believe the infringement took place.

Write to privacy@damagebrief.com. We answer within one month; when a request is complex, we may take up to two further months and tell you so within the first month (Art 12(3) GDPR). For case data, we pass your request to the client company that is its controller and help it answer.

8. Security

Connections are encrypted (HTTPS only). Passwords are stored only as one-way hashes, and API keys encrypted. Every uploaded file is served only through an access-checked page — the users of a client account see that account's cases, and only DamageBrief's administrators see every case. Sign-in is protected by a rate limit and the Turnstile check, error reports are scrubbed of personal data, and no outside script runs on our pages except the Turnstile check on the sign-in page.

9. Cookies

DamageBrief sets only strictly necessary cookies: to keep you signed in, to protect forms and to remember your cookie choice. It uses no analytics, advertising or tracking. The complete list is in the cookie policy.

10. Changes to this policy

When this policy changes materially, we publish a new version with its own number and date. Earlier versions stay available below.