Privacy Policy

CarVouch.co.uk is operated from the United Kingdom. Our contact email is .

Who we are

CarVouch is a UK-based service that helps used car buyers spot potential red flags before viewing a vehicle. We take your privacy seriously and comply with UK GDPR.

Data we collect

• Account data: name, email address, and hashed password when you register.
• Scan data: vehicle registration numbers you submit, advert text, asking price, and mileage.
• Payment data: Our payment provider processes payments. We store confirmation of the amount and credits granted. We never store card details.
• Usage data: IP addresses (hashed with a salt), browser user agent, pages visited.
• Cookies: a session cookie, CSRF token, and an anonymous guest token cookie.

How we use it

• To provide the CarVouch scan and AI report service.
• To process payments and grant credits.
• To send transactional emails (report ready, password reset).
• To improve the service and detect abuse.
• Marketing emails only if you opted in at registration.

Data sharing

We share data only with:

• DVLA / DVSA: registration numbers are sent to their APIs to retrieve official vehicle data.
• Experian (via One Auto API): when you purchase or run a Full Vehicle Check, the registration (and optional VIN) is sent to our API partner One Auto API Limited, which queries Experian AutoCheck services to return finance, stolen, write-off, keeper and related provenance data. Experian is an independent data controller for its databases; see Experian’s privacy notice.
• OpenAI: scan context is sent to the OpenAI API for AI report generation.
• Payment provider (Stripe / Square): payment processing. See their respective privacy policies.
• Our email provider: for transactional emails only.
• Cloudflare (Turnstile): browser and device signals are processed by Cloudflare's invisible bot-detection challenge to protect our forms from automated abuse. See the Cloudflare Turnstile Privacy Addendum.
• Google Analytics (Google LLC): if you consent to analytics cookies, anonymised usage data (pages visited, session duration) is shared with Google Analytics 4. No personal data such as your name or email is sent. See Google's Privacy Policy.

We do not sell your data to third parties.

Data retention

We retain account and scan data for as long as your account is active. You may request deletion at any time by emailing us. Deleted accounts and scans are soft-deleted for 30 days before permanent removal.

Your rights

Under UK GDPR you have the right to: access, rectify, erase, port, and restrict processing of your personal data. Contact us at to exercise these rights.

Bot protection (Cloudflare Turnstile)

We use Cloudflare Turnstile in invisible mode to protect our forms from automated abuse. When you visit a page protected by Turnstile, your browser silently runs a challenge in the background. Cloudflare may collect browser and device signals (such as user-agent, screen properties, and interaction patterns) to determine whether you are human. No visible CAPTCHA or interaction is required.

This processing is governed by the Cloudflare Turnstile Privacy Addendum, which we are required to reference as a condition of using invisible mode.

Cookies

We use cookies to keep the site running and, with your consent, to understand how visitors use CarVouch. You can manage or withdraw your consent at any time using the "Cookie settings" link in the footer of every page.

Strictly necessary cookies

These are set automatically and cannot be disabled — the site cannot function without them.

Analytics cookies (optional — only set with your consent)

We use Google Analytics 4 to understand how visitors find and use CarVouch. These cookies are only set after you click "Accept all" or enable analytics in the cookie banner. Under UK GDPR and PECR, your explicit opt-in is required before these cookies are placed.

Last updated: June 2026