Privacy policy

Last updated 18 October 2026. This policy explains what DriveDesk collects, why, and the rights you have over it under UK GDPR.

Who we are

DriveDesk is a business platform for UK driving instructors and driving schools. For your own account data — the details you give us to run DriveDesk — we are the data controller. For data about your pupils (names, lesson history, progress, messages), the instructor or school is the data controller and DriveDesk acts as their data processor. If you are a pupil, questions about your data should go to your instructor first.

What we collect

• Account data: name, email, phone, password-free magic-link sign-in, business details, plan and billing status.
• Business data you enter: pupils, leads, lessons, payments, vehicles, expenses, website content.
• Receptionist data: chat transcripts, SMS/WhatsApp messages, phone-call events and, where enabled, call recordings and transcripts.
• Verification documents: photo ID and proof of address you submit when claiming a phone number (passed to our telephony partner for regulatory registration).
• Payment data: handled by Stripe — we never see or store full card numbers.
• Usage data: pages visited, feature use, device and browser, IP address, error logs.

How we use it

• Run the service: diary, CRM, pupil portal, websites, AI receptionist, marketing tools.
• Send sign-in links, lesson reminders, receipts and service notices (email via Resend, SMS/calls via Telnyx).
• Process subscriptions and instructor payouts (Stripe).
• Answer enquiries on instructors' behalf through the AI receptionist — including by phone when the instructor enables it.
• Keep the platform secure: fraud prevention, abuse limits, audit logging.

Legal bases

Contract (running your subscription), legitimate interests (keeping the service secure and improving it), consent where required (optional integrations, marketing), and legal obligation (tax records, regulatory number registration).

Who we share it with

• Cloudflare — hosting, databases, storage and AI models (UK/EU processing options where offered).
• Stripe — subscriptions and instructor payouts.
• Telnyx — phone numbers, calls and SMS, including the ID and address documents needed to register a UK number.
• Resend — sign-in links and notification email.
• OpenRouter — the AI models behind the receptionist, site editor and lesson debriefs. Prompts may contain CRM context needed to answer well.
• Meta, Google, TikTok, X, LinkedIn — only when you connect those accounts for publishing or ads.

We do not sell personal data. Transfers outside the UK rely on adequacy regulations or standard contractual clauses.

How long we keep it

Account data for the life of your subscription plus the legal retention period (typically 6 years for financial records). Receptionist transcripts, uploaded documents and pupil data follow the instructor's retention settings. Deleted accounts and their contents are removed within 30 days, except records the law requires us to keep.

Your rights

Access, correct, export, delete, restrict or object to processing of your data — in-app via Settings → Export, or by emailing hello@drivedesk.uk. Instructors can export every pupil record to CSV in one click. You can complain to the ICO (ico.org.uk) if you're unhappy with how we handle data.

Cookies

We use a session cookie for sign-in and a small amount of local storage for preferences. No advertising or cross-site tracking cookies.

DriveDesk · hello@drivedesk.uk · Terms · Data deletion