Terms of service

These terms govern the use of DamageBrief (damagebrief.com) by the businesses we provide it to and by their users. Where your organisation has signed a separate agreement with us, that agreement prevails over these terms where the two differ.

1. Who provides the service

damagebrief.com
Contact: hello@damagebrief.com · Privacy: privacy@damagebrief.com

"We" and "us" below mean the provider; "the customer" means the business that uses the service; "users" are the people the customer has accounts for.

2. The service

The customer uploads photos of a damaged vehicle and, where available, its documents. An AI model identifies the vehicle, assesses its visible damage, researches genuine parts, prices and labour times, and drafts a repair-cost estimate with nearby repair shops; the arithmetic of the estimate is computed by the service itself.

• An estimate is a draft. It is produced from photos and public sources, can be incomplete or wrong — hidden damage in particular can only be confirmed once the vehicle is taken apart — and is not a binding quote from any repair shop. The customer reviews it before relying on it or passing it on.
• Part prices and labour rates are references found at the time of the analysis; actual prices can differ.
• The repair shops listed are found from public data and are suggestions, not recommendations or endorsements.

3. Accounts

Accounts are set up by us for the customer; there is no self sign-up. Each user's sign-in is personal and must not be shared. The customer tells us without delay when a user leaves or an account may have been compromised, so the account can be closed. Every user of a client account sees all of that account's cases; only our administrators see every case.

4. Acceptable use

• Upload only material the customer is entitled to use, and only for assessing damage and its repair.
• The customer is responsible for having a legal basis for the personal data it uploads and for informing the people concerned, as the controller of that data (section 8).
• Do not try to break, overload or get around the security of the service, or to reach data of another customer.

5. Credits and fees

Reports are paid with credits from the customer's account: a case is charged once, when its first analysis starts; if that analysis fails, the credits come back; analysing it again is free. Prices are agreed with the customer; they are on request at hello@damagebrief.com. A customer may use its own AI key for a lower price; its AI requests then run under its own agreement with that provider.

6. Availability and changes to the service

We work to keep the service available and correct, and improve it over time. Unless agreed otherwise in writing, it is provided without a guaranteed level of availability. Maintenance and outages of the providers it depends on (such as the AI provider) can interrupt it.

7. Responsibility for results

Decisions taken on the basis of an estimate — to repair, to claim, to pay — are the customer's. Our liability is as agreed in the customer's contract with us and as the applicable law provides; nothing in these terms limits liability that the law does not allow to be limited.

8. Data processing agreement (Art 28 GDPR)

This section governs the personal data in the cases the customer uploads ("case data"). For case data, the customer is the controller and we are its processor.

8.1 Subject matter, duration, nature and purpose

We store case data and analyse it with the help of AI and map services to produce damage assessments, repair-cost estimates and lists of nearby repair shops for the customer, for as long as the customer uses the service and until the case data is erased (8.7).

8.2 Types of personal data and data subjects

Vehicle registration plates and VINs; names on vehicle documents (such as registration certificates); client names; crash dates and locations; photos, which can show drivers, passengers, bystanders and other vehicles. Data subjects: vehicle owners and keepers, drivers, other parties to the accident, people visible in photos, and the customer's contacts named in a case.

8.3 Our obligations

• We process case data only on the customer's documented instructions — these terms and the use the customer makes of the service are those instructions — unless the law requires otherwise, in which case we tell the customer first where the law allows (Art 28(3)(a)).
• Everyone who can access case data on our side is bound to confidentiality (Art 28(3)(b)).
• We take the security measures of Art 32 GDPR, among them: encrypted connections; files served only through access-checked pages; a client account's users see only that account's cases, only our administrators all of them; passwords stored as one-way hashes and keys encrypted; error reports scrubbed of personal data (Art 28(3)(c)).
• We help the customer answer data subjects' requests — with the export and erasure functions of the service and otherwise as reasonably needed (Art 28(3)(e)) — and with its obligations under Art 32–36 GDPR, as far as our processing is concerned (Art 28(3)(f)).
• We tell the customer without undue delay after becoming aware of a personal data breach affecting case data.
• We make available the information needed to show that these obligations are met, and allow for and contribute to audits by the customer or an auditor it mandates, on reasonable notice (Art 28(3)(h)).

8.4 Sub-processors

The customer authorises the sub-processors listed in section 4 of the privacy policy (the AI provider in use, Cloudflare, the OpenStreetMap services or, where configured, Google, and our hosting provider). We bind each to data protection obligations equivalent to these, and inform the customer of any intended addition or replacement before it takes effect, so that the customer can object (Art 28(2) and (4)).

8.5 Transfers

Where a sub-processor processes case data outside the European Economic Area, the transfer relies on the safeguards described in section 5 of the privacy policy.

8.6 The customer's obligations

The customer is responsible for the lawfulness of the case data it uploads and of its instructions, and for informing the people concerned.

8.7 Erasure at the end

Each user can download their own data, and the customer's users can delete its cases, at any time; at the customer's request we erase a user, or all of the customer's cases, with their files. The credits ledger is kept as financial records; an erased user is no longer named in it. When the contract ends, we erase the customer's case data — its photos, documents and AI runs included — unless the law requires us to keep it; on request, before erasure, we return it to the customer as an export (Art 28(3)(g)).

9. Ending the use of the service

The customer can stop using the service at any time; we can close accounts that breach these terms. Section 8.7 governs what happens to the case data.

10. Applicable law

Mandatory consumer and data protection rules that apply to the customer or its users remain unaffected.

11. Changes to these terms

When these terms change materially, we publish a new version with its own number and date and tell the customer before it applies. Earlier versions stay available below.