CAR ConfidenceCAR Confidence
Log in

CAR Confidence

Privacy policy

Last updated: 19 October 2026

The short version

You can check any vehicle on this site without an account, without giving us your name and without giving us an email address. We use two analytics tools, Google Analytics and Microsoft Clarity, and only if you say yes when the site asks. We have no advertising and no advertising cookies.

The list of cars you check is held on your own device by default. Nothing about it reaches our servers unless you sign in, turn on a link to another device or sort it by distance, which sends place names only. If you do sign in, we hold your email address and your list of cars, and you can delete both from inside the site at any time.

The rest of this page sets out the detail, including every company that handles data on our behalf and where each one is based.

Who we are

CAR Confidence gives UK car buyers vehicle history checks, MOT analysis, valuation guidance and AI written summaries. The data controller is CarConfidence Ltd, a company registered in England and Wales with company number 17142653. Our registered office is 61a Bridge Street, Kington, HR5 3DJ, United Kingdom.

You can reach us about anything in this policy through the contact form on this site, at /contact-us, which goes straight to the team.

What we collect, and when

Checking a vehicle, with no account. You give us a registration number. We look it up against public records and show you the result. We keep the result in a short lived cache so that reopening it does not repeat the lookup, and we count lookups against your network address to stop automated abuse. That count is stored as a one way hash, so it cannot be read back as an address.

Signing in with Google. We ask Google for two things only: an identifier for your account and your email address. We deliberately do not request your name or your profile picture, and Google does not send them. We never see your Google password. We create a session for your browser and store a one way hash of it, so a copy of our database does not let anyone sign in as you.

Your garage. This is the list of cars you have checked, along with anything you add yourself: a shortlist marker, the asking price, where the car is, whether a dealer or a private seller is selling it, a link to the advert, the mileage the advert states and your own notes. It can also hold adverts you have saved before you know the registration. On a device that is not signed in, it exists only in that browser. When you sign in, a copy is kept on our servers so it survives a lost phone or a new device.

Buying a report. Payment is handled entirely by Stripe. Card numbers never reach our servers and we cannot see them. We keep a reference to the Stripe session, the registration, the options you chose and the finished report, so that your link keeps working and so we can answer a billing question. If you are signed in when you buy, we also note which account bought it, so the report appears in your garage on any device you sign in on. The payment in Stripe also records the page of this site your visit began on and the name of the site that sent you there, as described under Counting what brings people here.

Voice summaries from George. If you ask for one, the written summary is sent to a speech provider and the audio is held for two hours so you can play it. If you ask for it on WhatsApp, we receive the number you message us from and pass it to the delivery provider to send the audio back. We keep a message reference for a day so a retry does not send you the same thing twice.

Contacting us. The form asks for a name, an email address and a message. It is sent to the team as an email and is not saved to our database.

Sending feedback. The Feedback button on reports and in your garage asks for your message and, only if you want a reply, an email address. It also sends the line the form shows you: which report or garage page you were on and, on a report, the registration. It is sent to the team as an email and is not saved to our database.

Counting what brings people here. Whether or not you allow analytics, we count each free check, each time a paid report is reviewed before payment, each checkout and each purchase against two things: the page of this site your visit began on and the site that sent you there. That is just the name of the site (such as google.com) or the campaign tag on the link you followed. We keep daily totals of those counts and nothing else. They hold no registration, no network address and nothing about you. Nothing is stored on your device to do this.

Analytics, only if you say yes

The first time you visit, the site asks whether we may use analytics. Nothing in this section happens unless you say yes. If you say no, or do not answer, neither tool is loaded. You can change your answer at any time with Cookie settings in the footer of the site.

Google Analytics counts visits. It tells us which pages are read, which site sent the visitor, roughly where in the world they are and what kind of device they use. We tell it which page you are on with everything after the question mark removed apart from campaign tags, so it does not receive a registration, a report link or a garage link. We also tell it the page your visit began on and the site that sent you, because this question is usually answered a page or two after you arrive. It is also told when certain things happen: a free result is shown, a checkout is started, a paid report is bought or opened, a voice summary is ready or a report is downloaded, emailed or shared. Each of those says which kind of report it was, and nothing about the car or about you.

Microsoft Clarity shows us how a page is used: where people click, how far they scroll and where they give up. It works by recording the layout of the page and your movements on it. The words and pictures on the page are hidden from it before anything leaves your browser, and so is anything you type. It does record the address and the title of the page and the names of the files the page loads. On a free check those include the registration you looked up and a stock picture of that model of car.

Clarity is never running on your garage or on the link to a paid report. If you move to either from a page where it is running, the site loads that page afresh without it.

We do not use either tool for advertising, and both are told so: the advertising features in Google Analytics are switched off and Clarity is told that advertising storage is refused.

What we do not collect

Some of these appear in most privacy policies. They do not apply here, and it is more useful to say so plainly:

  • No advertising, no advertising cookies and no data sold or shared with advertisers.
  • No name and no profile picture from your Google account, because we never ask for them.
  • No password, because sign-in goes through Google.
  • No card or bank details, because Stripe handles payment.
  • No marketing list, and no marketing email. We email you a report you asked for, and nothing else.
  • No stored chat history and no stored search history beyond the cars in your garage.

Cookies

We set four cookies of our own. Each is needed for the site to work or to remember a choice you made, so we do not ask your permission for them.

  • __Host-cc_session keeps you signed in. It lasts thirty days, or until you sign out.
  • __Host-cc_oauth_state and __Host-cc_oauth_verifier exist for a few seconds during sign-in. They stop somebody else starting a sign-in that finishes as you.
  • cc_consent remembers your answer to the analytics question, yes or no, so the site asks once and not on every page. It lasts 180 days.

A fifth, cc_staff, is never set for visitors. The people who run Car Confidence set it on their own browsers so that their own testing is left out of the figures. It lasts a year.

If you say yes to analytics, the two tools set cookies as well. Google Analytics sets _ga and one beginning _ga_, which tell one visitor from another and last up to two years. Clarity sets _clck and _clsk, which last up to a year. Microsoft also sets cookies of its own on its clarity.ms and bing.com addresses when Clarity loads. If you say no, none of these are set. If you change a yes to a no, we remove the ones on this site straight away.

The garage itself is held in your browser storage rather than in a cookie, so it is never attached to a request and never sent anywhere automatically.

Photos you add to a car in your garage are kept in your browser. If you are signed in, they are also saved to your account, so they show on any device where you sign in. If you are not signed in, they are never uploaded to us. Either way they are not carried by a link to another device and not included in a backup file. Each photo is saved again at a smaller size before it is kept, which drops the location and camera details a phone photo can carry.

Sorting the garage by distance is the one exception, and only if you choose it. You type where you are, and we look up that place and the places written against your cars so we can work out how far away each one is. Only the place names or postcodes are sent, through our server, to postcodes.io. Your starting point and the answers stay in your browser.

Where your vehicle data comes from

When you enter a registration we retrieve public record information from the DVLA and the MOT history service run by the DVSA. For paid reports we also use a vehicle data provider for valuation, outstanding finance, insurance write-off and stolen markers. We do not add to those records or send them anything about you beyond the registration being checked.

A registration number can relate to an identifiable person, usually the keeper rather than you. We only ever use it to produce the check you asked for.

Companies that handle data for us

We keep this list specific rather than saying "trusted third parties", because the point of the list is that you can check it:

  • Vercel, hosting and serving the site. Our functions run in London.
  • Neon, the database holding accounts, saved garages, photos saved to an account and report orders. Our production database is in London.
  • Upstash, which holds the short lived cache of check results and voice audio, the abuse counters and the daily totals of checks and sales. Ours is in London.
  • Stripe, payment processing.
  • Google, sign-in, and Google Analytics if you have said yes to analytics.
  • Microsoft, Clarity, if you have said yes to analytics.
  • DeepSeek, the AI model that writes report summaries and vehicle comparisons.
  • ElevenLabs, turning the written summary into the voice you hear from George.
  • Twilio, delivering voice summaries over WhatsApp.
  • Resend, sending report emails, contact form messages and feedback.
  • postcodes.io, a free public UK postcode service, finding places on a map when you sort your garage by distance.

Each handles data on our instructions for the purpose above. Google and Microsoft also use what the analytics tools receive under their own privacy terms, which is one reason those tools stay off unless you say yes. We do not sell personal information.

Data sent outside the UK

Our own storage sits in London. Some of the companies above operate elsewhere, so certain data leaves the UK.

The one worth calling out is the AI text analysis. It is produced by DeepSeek, which operates from China. What we send is the vehicle record we are analysing: make, model, year, mileage, MOT results and whether a dealer or a private seller is selling it, if you have told us. When you have written notes about the car, we send those too. We do not send your email address, your account identifier or your payment details.

Because of this, please do not paste a seller name, phone number or address into a note. Nothing in the product needs them, and a note travels with the analysis.

Speech, WhatsApp delivery, email and payment providers also process data outside the UK, mostly in the United States and the European Economic Area. So do Google and Microsoft for the analytics tools, if you have allowed them. Where a transfer needs a safeguard under UK data protection law, we rely on the terms those providers offer for it.

How long we keep things

  • A car you have shortlisted, marked as sold or written anything against (a price, a location, an advert link, an advertised mileage, a note, an advert description or additional notes) stays in your account for as long as the account exists, until you remove it.
  • A car you checked and added nothing to is removed from your account thirty days after you last checked it. A car still in play stays; a passing look does not.
  • A car removed from your account is kept aside for thirty days, so one removed by mistake can be put back, and then deleted. Deleting your account deletes it straight away.
  • Photos saved to your account are deleted when you remove their car from your garage, and are not kept aside with it. Photos of a car that has left your garage any other way are deleted once they have been in your account for thirty days. Deleting your account deletes them straight away.
  • An advert you saved before knowing its registration stays until you remove it or attach it to a checked car.
  • A link to another device is deleted thirty days after it was last opened. Opening it starts that clock again.
  • A paid report stays available through its link for thirty days from purchase.
  • A free check result sits in the cache for about an hour.
  • Voice audio is deleted two hours after it is made.
  • Daily totals of free checks, report reviews, checkouts and purchases are kept for about thirteen months.
  • Sign-in sessions last thirty days and expired ones are cleared daily.
  • Payment and transaction records are kept for as long as UK tax and accounting law requires, which is currently six years.
  • Analytics, if you have allowed it. Google Analytics keeps the detail of each visit for fourteen months, after which only totals remain. Microsoft keeps Clarity recordings for thirty days and the figures drawn from them for up to thirteen months.

The copy of the garage in your own browser is yours, and it stays until you clear it or use the option in the site to remove a car.

Why we are allowed to hold it

Under UK GDPR we rely on four bases. Performing a contract with you covers running a check you asked for, taking payment and delivering a report. Legitimate interests covers keeping the service working, stopping automated abuse of the lookup and improving the product, balanced against the fact that we collect very little. Legal obligation covers keeping financial records. Consent covers the two analytics tools: you give or refuse it when the site asks, and you can withdraw it at any time through Cookie settings.

Signing in is optional and you can withdraw from it at any time by deleting your account, which is not the same as consent being our legal basis for the service itself.

Your rights

You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to restrict how we use it, object to us using it or ask for it in a portable form.

For an account, the fastest route is in the site itself. Open the garage, then Garage settings, and "Delete my account and data" removes your account, your sessions, your saved garage and its photos from our servers immediately. The copy in your own browser stays on your device, because it is yours, and the site tells you so at the time.

For anything else, use the contact form on this site and say what you would like us to do. We aim to reply within one month, which is the period the law allows.

If you are unhappy with how we have handled a request you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you came to us first so we can put it right.

AI, and what it is not

Parts of a paid report are written by an AI model working from the vehicle records described above. It reads the same figures the page shows you, and it is instructed not to introduce any it has not been given.

It can still be wrong. An AI summary is research to help you decide. It is not financial, legal or mechanical advice, and it is not a substitute for inspecting the car or having a mechanic look at it. Nothing on this site makes an automated decision that has a legal effect on you.

Security

Traffic is encrypted in transit. Session tokens are stored as one way hashes rather than as the token itself. Access to production systems is limited to people who need it. Proof that a report was paid for is verified on our servers rather than taken from your browser.

No online service can promise perfect security, and we are not going to pretend otherwise. What we can say is that the amount of personal data here is small by design, which limits what any failure could expose.

Children

This site is meant for people buying a car, and it is not intended for anyone under 16. We do not knowingly collect information from children.

Changes

If we change what we collect or who handles it, we update this page and the date at the top. Where a change matters to people with accounts, we will tell them directly.