Privacy and your data

MotorComp is a synthetic demonstration. These notes describe what this proof of concept actually does. They are not a privacy notice for a live service.

What is stored

Your account (an email address and a scrypt password hash), your case answers, uploaded files, text read from them, facts you confirm or correct, timeline changes, assessments, drafts and a short change history.

Where

On the single local proof-of-concept host, in a private SQLite database and a private file store outside the web root (directory permissions 0700, files 0600). Files are not encrypted at rest beyond the host's own disk setup, and there are no off-site backups made by MotorComp.

Who can see it

Only your signed-in account. Every case, file, preview, fact, draft and export request checks that the case belongs to you. Anyone with administrator access to the host machine can read the files.

What goes to an AI provider, and when

• Reading a document (only when you press Read with AI): the text MotorComp extracted from that file, up to about 24,000 characters. The file name is not sent. Before anything is sent, MotorComp replaces identifiers its patterns recognise (bank sort codes and 8-digit account numbers, card numbers, IBANs, National Insurance numbers, email addresses, UK mobile numbers and UK postcodes) with a "[redacted]" marker. This is pattern matching, not a guarantee: names, street addresses, vehicle registrations and anything else it doesn't recognise are sent as written, which is why only fictional details may be used. Images are read on this machine with local OCR (tesseract); the image itself is not sent.
• Generating an assessment or draft (only when you press the button): your intake answers and the document facts you confirmed, as a numbered list. Each fact's source is described only as "your account" or "a document, page N", not by file name. The same redaction is applied to the whole request. Unchecked suggestions are not sent. Your intake answers can include names (for example the dealer or finance company) and free-text descriptions; those are sent as you wrote them. The model only chooses from MotorComp's fixed list of statements and says which facts each relies on; MotorComp writes every sentence you see from your own facts and drops any choice your facts don't support.
• Requests go through the Teknetik AI gateway (Kong) to OpenRouter and then the selected model provider (the model requested is set by the server operator; each result shows the model name the gateway reported). MotorComp doesn't add your sign-in email, account id or session details to requests, but personal details inside the document text or your answers can still be sent if the patterns above miss them. The gateway and providers keep their own logs and usage records; deleting your case here does not delete those. Provider retention, training and data-location terms have not been verified for this demonstration.

How long it is kept

Retention for this proof of concept: data is kept until you delete it, or until the operator wipes the demonstration host. There is no automatic expiry yet; a retention period still needs to be decided before any wider use.

Original files

MotorComp shows previews as page images it renders itself. The original file you uploaded is kept unchanged and is only offered as a download, to open in your own viewer. PDFs containing scripts, actions, links, forms or attachments are refused at upload, checked on the file's parsed structure rather than its raw bytes.

Deleting

You can delete a single file (its preview images, extracted text and suggested facts go with it), a whole case (all files and derived data), or your whole account from Your account. Deletion removes the database rows and the files from disk straight away. There is no recycle bin. Database pages may persist in free space until SQLite reuses them.

N.B. For research purposes only. Consult a qualified professional.