Privacy Policy

To provide our automated advert analysis, we collect the following types of data:

We use the data we collect for the following core purposes:

• Generating Reports: We use the VRM to query the UK Government's DVSA MOT database.
• AI Analysis: We securely transmit the advert text, MOT data, and your uploaded images to our Large Language Model partners (such as Google Gemini or Anthropic) to generate the buyer's guide.
• Security: To enforce our "1-per-IP" rate limits and block malicious traffic.
• Communication: To send you updates about our platform (only if you explicitly opted in).

We do not sell your personal data to car dealerships, marketers, or data brokers. We only share data with the strict infrastructure partners necessary to run the app:

• Government APIs: The DVSA (to retrieve MOT history).
• AI Providers: Large Language Model providers (such as Google Gemini). We use enterprise-tier APIs, meaning your data is not used by these companies to train their public AI models.
• Cloud Hosting & Databases: Vercel and Google Firebase/Firestore (to host the website and store the generated reports securely).
• Payment Processing: Stripe (to process credit purchases securely). We never see or store your full credit card details. Stripe handles all payment data in compliance with strict PCI regulations.
• Email & Communication: Resend (to send you transactional emails and optional marketing updates).
• Security: Cloudflare (for bot protection).

International Data Transfers: Some of our infrastructure partners (like Stripe, Google, and Vercel) process data outside the UK (e.g., in the United States). Where this occurs, we ensure your data is protected through Standard Contractual Clauses (SCCs) and Data Processing Agreements (DPAs) provided by these partners, compliant with UK GDPR.

• Generated Reports: We store generated reports in our database so you can access them later via your unique link. You can request the deletion of a report at any time.
• Anonymised Records: If you delete your account, your financial transactions and report histories are scrubbed of all Personally Identifiable Information (PII). We retain the underlying anonymised data indefinitely for aggregated analytics, financial reconciliation, and system improvement.
• IP Addresses: We temporarily log IP addresses in our database for rate-limiting purposes (e.g., limiting free scans per 24 hours).
• Waitlist: Waitlist email addresses are retained until you unsubscribe or request deletion, and are used solely to notify you of launch discounts and product updates.

Under UK law, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Erasure (Right to be Forgotten): Under Article 17 of the GDPR, you can request full account deletion via your Account Settings. This initiates a process that permanently deletes your authentication record and fully anonymises all associated transaction and report data so it can never be traced back to you.
• Rectification: Correct any inaccurate data we hold.
• Data Portability: Request a copy of your data in a structured, machine-readable format.
• Object to Processing: Object to how we process your data, including for marketing purposes.
• Withdraw Consent: Unsubscribe from our emails at any time.

To exercise any of these rights, please email us at hello@caradvertcheck.co.uk. We will respond within 30 days.

We use essential cookies and local storage to keep the site secure (like Cloudflare Turnstile) and to manage your session state.

Firebase Authentication uses browser storage to maintain your logged-in session. This is essential for the service to function and cannot be disabled.

If you have any questions or concerns about how we handle your data, please reach out to our Data Protection Officer at:

Email: hello@caradvertcheck.co.uk