Privacy

When you check a registration

• The registration. We send it to the DVSA MOT history service and to our vehicle-data supplier (VehicleMatic) to get the car's details, and keep their answers for seven days so a second look does not repeat the request. That copy is about the car, not about you: it does not say who asked.
• A lookup record: the registration, the country the request came from and the time. Not your IP address — the country is taken from a header our network provider (Cloudflare) adds, and nothing else about you is kept with it.
• Rate limiting: to stop one visitor running up our supplier costs, we count lookups per connection using a salted, one-way scramble of your IP address, held on our server for up to 24 hours.
• Server logs: our web server logs each request — your IP address, the page, the time and your browser type. The registration is removed from these logs before they are written. We use them to find faults and abuse.

Why: to give you the result you asked for, and our legitimate interest in running the service securely and within budget.

When you ask for the free MOT report

We record your email address, the registration and when we sent it, and send the report through our email provider, Resend. We use the address only to send that report. Why: you asked us to.

When you buy the paid full history check

We record your email address, the registration, the amount and the order's status, and payment references from Square. Your card details go to Square, not to us — we never see them. We buy the report from VehicleMatic using the registration only, and email it to you through Resend. If something fails we may be alerted with the order reference (never your card details). Why: to fulfil the order you placed, and to keep the records the law requires for a sale.

The monthly digest

Only if you tick the box. We keep your email address, when you joined and the registration you were looking at when you ticked it. Why: your consent, which you can withdraw at any time with the unsubscribe link in every digest — that deletes you from the list straight away and touches nothing else.

Cookies and tracking

This site sets no cookies, runs no analytics and loads nothing from any other company's servers when you view it. So there is no cookie banner: there is nothing to agree to.

Who else handles your data

• Cloudflare — carries all traffic to the site (sees IP addresses).
• Our hosting provider — [DAN: confirm Hetzner Online GmbH, Helsinki, Finland] — runs the server and holds its logs.
• Supabase — our database (registrations, email addresses, orders) — [DAN: confirm the project's region].
• Resend — sends our emails (your address, the report).
• Square — takes payments.
• VehicleMatic — vehicle data supplier (the registration only).
• DVSA — MOT history (the registration only).

Some of these process data outside the UK (Cloudflare and Resend, for example, in the United States). Where they do, it is under the safeguards UK law requires — [DAN: confirm each provider's transfer mechanism, e.g. the UK Extension to the EU–US Data Privacy Framework or the ICO's International Data Transfer Addendum].

How long we keep it

• Cached car data: 7 days.
• Rate-limit counts: up to 24 hours.
• Lookup records: [DAN: proposed 12 months].
• Server logs: [DAN: proposed 30 days; today they are removed by size, not age].
• Free report records: [DAN: proposed 12 months].
• Orders and payment records: [DAN: proposed 6 years, for tax records].
• Digest list: until you unsubscribe.

Your rights

You can ask for a copy of what we hold about you, have it corrected or deleted, object to how we use it, or withdraw consent for the digest — email [DAN: contact address]. We will answer within one month. If you are unhappy with our answer you can complain to the Information Commissioner's Office at ico.org.uk.

Last updated [DAN: date of approval].