Privacy Policy

CarVouch.co.uk is operated from the United Kingdom. Our contact email is .

Who we are

CarVouch is a UK-based service that helps used car buyers spot potential red flags before viewing a vehicle. We take your privacy seriously and comply with UK GDPR.

Data we collect

• Account data: name, email address, and hashed password when you register.
• Scan data: vehicle registration numbers you submit, advert text, asking price, and mileage.
• Payment data: our payment provider processes payments. We store confirmation of the amount and credits granted. We never store card details. On the iOS app, payments are processed by Apple; we receive purchase confirmation via RevenueCat.
• Usage data: pages or screens visited, features used, session duration, app version, and device type. On the website we also store IP addresses (hashed with a salt) and browser user agent.
• Device and identifier data: on our iOS app we collect device identifiers needed for analytics, crash reporting, push notifications, in-app purchases, and — only if you consent via Apple’s App Tracking Transparency prompt — your device advertising identifier (IDFA) for measuring the effectiveness of our advertising campaigns.
• Marketing attribution data: if you arrive via a paid advert or campaign link, we may store UTM parameters and click identifiers (such as gclid) in your browser session to understand which campaigns are effective.
• Cookies and similar technologies: session cookies, CSRF token, guest token, and — with your consent — analytics cookies on the website.

CarVouch iOS app

Our native iOS app uses the following services:

• Mixpanel: product analytics (screens viewed, sign-up and scan events). When you are signed in we link events to your account user ID. We do not send your name or email to Mixpanel from the app.
• Firebase Crashlytics (Google): crash and performance diagnostics to keep the app stable.
• Firebase / Google Analytics (Google): app usage events (installs, sessions, screens viewed, purchases) used to measure how the app is used and whether our Google advertising leads to installs and purchases. See Firebase Privacy.
• Meta SDK (Facebook): automatically logs app installs, app launches, and in-app purchases so we can measure the effectiveness of our advertising on Meta platforms (Facebook and Instagram). Your device advertising identifier (IDFA) is only used for this if you consent via Apple's App Tracking Transparency prompt; otherwise Meta receives privacy-preserving, aggregated attribution via Apple's SKAdNetwork. We do not send your name or email to Meta from the app. See Meta's Privacy Policy.
• RevenueCat: manages in-app purchases and links them to your CarVouch account.
• OneSignal: delivers push notifications (for example when a report is ready). Stores a push subscription identifier and links it to your account when you are signed in.
• Apple: processes in-app payments and, if you use Apple Search Ads to find us, provides privacy-preserving install attribution to Apple.

Analytics on the iOS app should be gated behind your consent where required by law. We are implementing an in-app consent step aligned with our website cookie banner.

How we use it

• To provide the CarVouch scan and AI report service.
• To process payments and grant credits.
• To send transactional emails and push notifications (report ready, password reset).
• To improve the service, measure feature usage, and detect abuse.
• To measure whether our advertising on Google, Apple Search Ads, Meta (Facebook and Instagram), and other platforms leads to installs and sign-ups — only with appropriate consent (ATT on iOS; analytics cookies on the web).
• Marketing emails and promotional push only if you opted in at registration.

Advertising and attribution

We run paid advertising (for example Google Ads, Apple Search Ads, and Meta Ads on Facebook and Instagram) to help people discover CarVouch. To measure whether an advert led to an app install or website visit, we may use:

• Apple App Tracking Transparency (ATT): on iOS, we may ask permission to use your device advertising identifier (IDFA) for ad attribution. You can decline and still use the app.
• SKAdNetwork: privacy-preserving install attribution on iOS, used by Apple and ad partners such as Google and Meta.
• Meta SDK app events: on the iOS app, the Meta SDK automatically logs installs, launches, and purchases for Meta Ads measurement (see the CarVouch iOS app section above).
• Enhanced conversions (Google): when you make a purchase on our website, we may share a hashed (SHA-256) version of your email address with Google Analytics / Google Ads to improve the accuracy of conversion measurement. The hash cannot be reversed to reveal your email; Google uses it only to match the conversion to an ad interaction.
• Apple Search Ads: privacy-preserving attribution for users who install via the App Store search ads.
• Campaign parameters: UTM tags and click IDs (e.g. gclid) on the website, stored in session when you land from an advert.

We use this data to understand campaign performance and improve our marketing. We do not sell your personal data to advertisers.

Data sharing

We share data only with service providers who help us operate CarVouch:

• DVLA / DVSA: registration numbers are sent to their APIs to retrieve official vehicle data.
• Experian (via One Auto API): when you purchase or run a Full Vehicle Check, the registration (and optional VIN) is sent to our API partner One Auto API Limited, which queries Experian AutoCheck services to return finance, stolen, write-off, keeper and related provenance data. Experian is an independent data controller for its databases; see Experian’s privacy notice.
• OpenAI: scan context is sent to the OpenAI API for AI report generation.
• Payment providers: Stripe / Square on the website; Apple In-App Purchase and RevenueCat on the iOS app. We never receive your full card number.
• Our email provider: for transactional emails only.
• Mixpanel: product analytics (EU data residency). On the website, name and email are sent to Mixpanel only when you are logged in and have consented to analytics cookies.
• Google Analytics (Google LLC): if you consent to analytics cookies on the website, usage data is shared with Google Analytics 4. See Google's Privacy Policy.
• Google Firebase (Crashlytics and Analytics): crash, performance, and app usage data from the iOS app. See Firebase Privacy.
• Meta Platforms (Facebook): app install, launch, and purchase events from the iOS app for advertising measurement, as described above. See Meta's Privacy Policy.
• Hotjar: if you consent to analytics cookies on the website, Hotjar records anonymised usage behaviour (mouse movement, scrolling, page interactions) to help us improve the site. Keystrokes in form fields are suppressed. See Hotjar's Privacy Policy.
• RevenueCat: in-app purchase management on iOS. See RevenueCat Privacy.
• OneSignal: push notification delivery on iOS. See OneSignal Privacy.
• Cloudflare (Turnstile): browser and device signals for bot protection on the website. See the Cloudflare Turnstile Privacy Addendum.
• Advertising platforms (Google Ads, Apple Search Ads, Meta Ads): aggregated or consented attribution data to measure campaign performance.

We do not sell your personal data to third parties.

Data retention

We retain account and scan data for as long as your account is active. You may request deletion at any time — see Delete your data below. Deleted accounts and scans are soft-deleted for 30 days before permanent removal.

Delete your data

You can request deletion of your CarVouch account and all associated personal data at any time:

1. Email us at from the email address linked to your account, with the subject line "Delete my account".
2. We will confirm your request and delete your account, scans, reports, and associated personal data. Deleted data is soft-deleted for 30 days (in case you change your mind), then permanently removed from our systems.
3. We will confirm by email once deletion is complete. Payment records we are legally required to keep (for tax and accounting) are retained for the statutory period, then deleted.

If you signed in through the iOS app, the same process applies — deletion covers data collected via both the website and the app. Data held by third-party providers listed above (such as Mixpanel, Meta, Google, RevenueCat, and OneSignal) is deleted or de-identified in accordance with our agreements with them; you can also exercise your rights directly with those providers via the privacy policies linked above.

Your rights

Under UK GDPR you have the right to: access, rectify, erase, port, and restrict processing of your personal data. Contact us at to exercise these rights.

Bot protection (Cloudflare Turnstile)

We use Cloudflare Turnstile in invisible mode to protect our forms from automated abuse. When you visit a page protected by Turnstile, your browser silently runs a challenge in the background. Cloudflare may collect browser and device signals (such as user-agent, screen properties, and interaction patterns) to determine whether you are human. No visible CAPTCHA or interaction is required.

This processing is governed by the Cloudflare Turnstile Privacy Addendum, which we are required to reference as a condition of using invisible mode.

Cookies

We use cookies to keep the site running and, with your consent, to understand how visitors use CarVouch. You can manage or withdraw your consent at any time using the "Cookie settings" link in the footer of every page.

Strictly necessary cookies

These are set automatically and cannot be disabled — the site cannot function without them.

Analytics cookies (optional — only set with your consent)

We use Google Analytics 4, Mixpanel, and Hotjar to understand how visitors find and use CarVouch. These are only activated after you click "Accept all" or enable analytics in the cookie banner. Under UK GDPR and PECR, your explicit opt-in is required before analytics cookies are placed.

Last updated: July 2026