Privacy notice

This notice explains what RegReport collects when you check a car, and why. The controller details (business name, address and contact) will be added before launch.

What we collect

• The registration you enter. A registration can identify a person when combined with other data, so we treat it as personal data. We use it to fetch the car's records. In our database and logs we keep only a keyed hash (HMAC) of it, plus a display copy inside the report snapshot.
• Report snapshots. Each report is stored for 30 days so its link works, then deleted automatically.
• Your IP address. Used only to stop abuse (rate limiting). We store a keyed hash, never the address itself, and rate-limit records expire within days.
• Usage events. Counts such as "report generated" with no registration or IP attached.

If you create an account

Accounts are optional: checking a car works without one. If you sign up, we also keep:

• Your email address and a password hash. Passwords are stored only as an argon2id hash; we can't see or recover them.
• Your saved reports. Reports you make while logged in are linked to your account and kept while it exists (they aren't removed after 30 days like other reports), together with a count of the cars you've checked. You can delete one report or your whole history at any time from your account page.
• Sessions. When you log in we set a session cookie. We store only a hash of it, with when it was created and last used. Sessions end when you log out, after 7 days without use, or after 30 days at most.
• Security records. Counts of failed logins and sign-ups, keyed by a hash of the email address or IP address, to stop password guessing. They expire within days.

Deleting your account (from your account page) removes your email, password hash, sessions and saved reports straight away. Copies in our hosting provider's backups are overwritten on its backup cycle (details to be confirmed before launch).

Cookies. We use only strictly necessary cookies: the session cookie when you're logged in, and a short-lived security cookie (2 hours) that protects forms against cross-site request forgery. No advertising or analytics cookies.

Account emails. When account emails are switched on (email confirmation and password reset), we send them through Resend (Resend, Inc., USA), acting as our processor. It receives your email address and the message, keeps delivery logs for up to 30 days, and processes them in the USA and the EU under its data processing terms. We don't send marketing email.

What we don't do

• No advertising trackers and no third-party analytics.
• We don't sell data. We never send your registration to an AI service; the AI layer only sees vehicle and MOT facts (see below).
• Values you type into the price and running-cost calculators, your recent checks and checklist ticks stay in your browser (local storage on this device). Clear them from the home page or your browser settings.

Who we share it with

To build a report we send the registration to official sources (DVSA, and DVLA when connected). Hosting is on servers in the UK or EU (details to be confirmed before launch).

AI-written report text. The plain-English wording in reports (the verdict and explanations) is written by Anthropic (Anthropic Ireland, Ltd), acting as our processor. All scores, numbers and labels are calculated by our own code; the AI only words them. We never send it your registration, your IP address or any identifier for you. It receives only facts about the vehicle and its MOT history, such as make, model, year, engine, mileage readings, MOT results and advisories, and our calculated score. Anthropic doesn't use data sent through its API to train its models. Its processing may take place globally, including outside the UK, under its data processing terms.

Your rights

You can ask for access to, or deletion of, any data we hold about you. If you have an account, you can delete it and its history yourself at any time. Contact details will be published here before launch. You can also complain to the Information Commissioner's Office.

Lawful basis

Legitimate interests: providing the vehicle report you asked for, and protecting the service from abuse. For accounts: contract, meaning providing the account and saved history you signed up for.