Privacy Policy

Draft — last updated October 2026. Subject to legal review before public launch.

What Autter does

Autter lets people send a private message to a vehicle owner by scanning a QR code, without either person exchanging personal information.

What we collect from vehicle owners

• Your mobile phone number, to verify your account and send you alerts. It is encrypted at rest and never shown to senders. Outside Canada and the US, where we can't send texts, we use your email address for this instead. It is never shown to senders either.
• Your email address, only if you choose to add one for email alerts.
• Your language and notification preferences.
• Messages sent to you, stored encrypted so you can read them in your inbox.
• Browser notification subscriptions, only if you enable them.

What we collect from senders

• The reason and message you write.
• Your phone number, only if you explicitly choose to share it with the owner.
• A one-way, keyed abuse-prevention fingerprint derived from your network connection and browser type. We don't store your IP address with your message, and the fingerprint can't be reversed to identify you. It is used only for rate limiting and to let owners block abusive senders.

What we don't collect

We don't collect licence plates, vehicle location, precise location of senders, or tracking data about who scans a code. We don't sell personal information or use it for advertising.

Service providers

We use Telnyx (SMS), Resend (email), Vercel (hosting) and a managed PostgreSQL provider. Some providers may process data outside Québec and Canada; we assess these transfers as required by law.

Retention

Messages are kept until you delete your account. One-time codes are deleted within 7 days. Rate-limit counters expire automatically. When you delete your account, your phone number, email and messages are erased; a minimal record may be kept where needed to handle open abuse reports or legal obligations.

Your rights

You can download a copy of your data and delete your account at any time from Settings. Under Québec's Act respecting the protection of personal information in the private sector (Law 25) and PIPEDA, you may also request access, correction, or de-indexing, or withdraw consent, by contacting us.

Staff access

Autter staff can't browse message content. Access to a specific message is limited to reviewing abuse reports, support requests or legal obligations, requires a written justification, and is recorded in an audit log.

Person responsible for personal information

Privacy Officer, Autter — privacy@autter.com