Who we are

CarBuyerCheck (“we”, “us”) is a service of Prado Consulting Limited, a company registered in England and Wales (company number 17312359), with its registered office at Solutions House, Unit 10 Deepmore Close, Station Road, Wolverhampton WV10 7DB. It covers the website at carbuyercheck.uk, the CarBuyerCheck iPhone and Android apps, and the CarBuyerCheck browser extension.

Prado Consulting Limited is the data controller for the personal data described here and is registered with the Information Commissioner’s Office under reference ZC242546. Contact us at info@carbuyercheck.uk about anything in this policy.

Checking a car

When you check a car, on the website, in an app or with the extension, you send us its registration. We send the registration to the DVSA’s MOT History service to fetch the car’s MOT record. The sample registrations are fictional and never leave our server.

We save the finished report as a snapshot under a random link, so the link keeps working and shows the same report later. The snapshot holds the registration, the car’s details, its MOT history and the score. It doesn’t say who asked for it. Anyone with the link can open it, so share it only with people you want to see it.

A registration identifies a car, not a person, but it can count as personal data when it’s linked to someone. We don’t link it to you unless you’re signed in (see Accounts).

Your free check

Each device gets one free check without an account. To count it, we give the device a random ID: a cookie in your browser (the extension uses the same one), or a value the app keeps on your phone. We store only a scrambled (hashed) copy of that ID, with the registration and report link of your free check, so checking the same car again stays free. It isn’t linked to your name or email.

When you sign up, your free check is added to your account’s recent checks.

AutoTrader adverts

The apps can open AutoTrader in a browser inside the app, and the extension works on the AutoTrader advert you’re viewing. Either way, the car’s details are read only when you ask for a check.

• The page is read on your device. Only the car’s details leave it: the advert’s address and title, make, model, year, mileage, fuel type, asking price, number of owners and MOT expiry date. Seller names, phone numbers, email addresses and the rest of the page are never sent.
• In the apps, those details are sent with the registration you confirm, and saved in the report snapshot so the report can compare the advert with the official record.
• The extension sends a registration, or, when an advert shows no registration, only the make, model, fuel type and year. It keeps your last five checks in your browser, and uninstalling it removes them.
• AutoTrader pages load from AutoTrader, which may set its own cookies under its own privacy policy. The in-app browser keeps those cookies on your phone, as any browser would. We don’t receive them. We’re not affiliated with AutoTrader.

Accounts: Sign in with Apple or Google

Your first check doesn’t need an account. To check more cars, sign up free with Apple or Google, on the website or in the apps. Your saved cars, recent checks and checklist ticks then follow you between devices. We never see your Apple or Google password.

What we receive

• From Apple: an identifier unique to CarBuyerCheck, your email address (or Apple’s private relay address if you chose to hide yours), and your name the first time you sign in, if you share it. Apple also gives us a token that lets us revoke the sign-in when you delete your account.
• From Google: an identifier unique to your Google Account, your email address and whether Google has verified it. We ask Google for nothing else: not your contacts, files, calendar or profile photo.

What your account stores

• Your name and email address, as received above.
• Your saved cars (the registration and a link to its report), your 20 most recent checks and your checklist ticks.
• One sign-in session for each device or browser, with its type (website, iPhone or Android) and when it was created and last used. We store only a scrambled (hashed) copy of the session key. The key itself stays in your phone’s secure storage, or in a cookie in your browser.

If you sign in with Apple and with Google using the same email address, and both confirm it’s verified, the two sign-ins open the same account.

How we use Apple and Google data

Only to sign you in, let you check more cars and keep your cars in sync. We don’t use it for advertising, we don’t sell it, and we don’t share it with anyone else. We don’t email you. CarBuyerCheck’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Deleting your account

On the website or in the app, open your account and choose Delete account. Your account, saved cars, recent checks, ticks and sessions are deleted straight away, and we revoke our Apple sign-in. If you stop using Sign in with Apple for CarBuyerCheck in your Apple Account settings, Apple tells us and we delete the account in the same way. Removing CarBuyerCheck from your Google Account’s connected apps stops future sign-ins, but Google doesn’t tell us, so delete the account in the app or email info@carbuyercheck.uk as well.

On your device, and cookies

The website keeps My cars and your checklist ticks in your browser’s local storage, and in your account too when you’re signed in. Clearing your browsing data removes the browser’s copy. The apps keep your lists, ticks and recently opened reports on your phone so they work offline.

The website sets three cookies, each needed for the service to work:

• cbb_visitor: the random ID that counts your free check. Kept for a year.
• cbb_session: keeps you signed in, for up to 180 days.
• cbb_auth: ties a sign-in to the browser that started it, so nobody can sign you in to their account. Lasts 10 minutes.

There are no advertising or analytics cookies, and no advertising or analytics code in the website, apps or extension.

Local vehicle crime

This lookup is optional. If you use it, your postcode goes to Postcodes.io to find its location, and Police.uk receives only the coordinates. We don’t save the postcode.

Who else receives data

• DVSA (MOT History service): the registrations you check.
• Apple and Google, when you sign in with them. They know you use CarBuyerCheck, under their own privacy policies.
• Postcodes.io and Police.uk, only for the local vehicle crime lookup.
• OneProvider, which hosts our server in Düsseldorf, Germany, and processes data only on our instructions.

Payments aren’t switched on yet. When they are, we’ll add the payment provider here before anything can be bought.

Why we’re allowed to use it

Under UK data protection law, we use your data to provide the service you ask for: the check, and the account if you create one. We also rely on our legitimate interests to keep the service secure and working: counting each device’s free check, limiting how many requests one connection can make, preventing abuse and keeping report links working.

How long we keep it

• Report snapshots: while the service runs, so their links keep working. Send us a report’s link and we’ll delete it.
• Your free check: the hashed device ID with the registration and report link, for a year after that check.
• Your account and what it syncs: until you delete it.
• Sign-in sessions: until you sign out, or after 180 days without use.
• A sign-in in progress: 10 minutes at most, including the device’s free-check ID so the free check can join your account. The one-time code that returns you to the app lasts 2 minutes.
• Your IP address: held in memory for a few minutes to limit how many requests one connection can make. We don’t keep access logs.

Security and where data is stored

Everything travels over HTTPS. Our server is in Germany, which UK law recognises as giving adequate protection. Every sign-in token from Apple or Google is checked for its signature, issuer, app and expiry before we accept it, and session keys are stored only in hashed form. Apple and Google may process your sign-in outside the UK under their own safeguards.

Your rights

You can ask to see the personal data we hold about you, correct it, delete it, restrict or object to how we use it, or receive a copy of it. Email info@carbuyercheck.uk. We’ll reply within one month.

If you’re unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We’d appreciate the chance to put it right first.

Children

CarBuyerCheck is for people buying a car and isn’t aimed at children.

Changes to this policy

When the policy changes, we’ll update it here and change the date at the top. See also our terms of use.