Privacy policy

Who we are

Caroat is operated by Internet Plus Services Ltd, a company registered in England and Wales. Internet Plus Services Ltd is the data controller for personal information collected through caroat.co.uk. For privacy questions, use our contact page or email info@caroat.co.uk.

What we collect

Vehicle registrations you search. A registration plate identifies a vehicle rather than an individual. We cache searched registrations and vehicle records to deliver fast page loads and keep vehicle summary pages available without unnecessary repeated API lookups. Vehicle photos may also be stored so the same image can be shown again quickly.

Your email address. When you purchase a vehicle report or bundle, or activate V5C alerts, we collect your email address to deliver report links, track remaining bundle credits, send order receipts, and let you retrieve purchased reports later from the help page.

V5C logbook monitoring details. If you activate V5C alerts, we retain your email address and monitored vehicle registration for the duration of your selected watch period (3, 6, or 12 months) to send automated logbook change alerts.

Customer support inquiries. When you submit a message via our contact form, we collect your name, email address, subject, optional vehicle registration, and message text so we can reply.

Payment details. Payment card processing is handled by Stripe. Card details are entered into Stripe Elements; Caroat never sees, collects, or stores card numbers. We retain the transaction reference, timestamp, purchase amount, and related order records needed to fulfil and support the purchase.

Technical and security data. We process IP addresses and request metadata for rate limiting, bot protection, fraud prevention, and short-lived security diagnostics. To count visits we keep a one-way code made from the IP address, never the address itself. Daily visit records are deleted after 90 days; the code alone is kept so a returning visitor is not counted twice. We may also store a short-lived browser cache of a vehicle photo you have already viewed, on that device only, for about seven days.

Lawful basis for processing (UK GDPR)

• Performance of a contract: processing your email address, vehicle registration, and payment records to generate, deliver, and store purchased reports, redeem bundle credits, and run active V5C alerts.
• Legitimate interests: protecting the service, preventing automated scraping and fraudulent card testing, caching vehicle records and images for speed and cost control, and collecting privacy-preserving performance diagnostics.
• Legal obligations: retaining financial transaction records to comply with UK accounting and tax law.
• Consent: where we rely on consent for a specific optional alert or similar choice, you can withdraw it at any time.

Where vehicle data comes from

Free vehicle specifications and road tax data come from the DVLA Vehicle Enquiry Service. MOT records come from the DVSA MOT History Service. Comprehensive history records covering insurance write-offs, police stolen registers, and outstanding finance agreements are provided by licensed commercial vehicle data partners.

Third-party data processors

We use trusted processors to run the platform:

• Stripe: payment processing and fraud prevention.
• Hosting and database providers: running the website, storing orders and reports, and privacy-preserving performance metrics.
• Email providers: transactional email for report delivery, report retrieval, V5C notifications, and contact replies.
• Security providers: bot prevention on search and contact forms, and IP rate limiting.

We do not share your personal information with any other vehicle check service.

Some processors store or process data outside the UK, including in the United States. Where that happens, we rely on appropriate transfer safeguards used by those providers, such as the UK International Data Transfer Agreement or UK addendum to the EU standard contractual clauses, or another lawful transfer mechanism.

Data retention

• Reports and buyer emails: kept indefinitely so you can open a report you paid for whenever you need it. There is no automatic purge of purchased reports.
• Unused bundle report credits: valid for 12 months from purchase, then they expire.
• Report retrieval links: short-lived access tokens emailed from the help page typically expire within about 30 minutes once issued.
• Active V5C monitoring: kept for the active monitoring term (3, 6, or 12 months), after which tracking stops.
• Contact form submissions: kept for up to 12 months for support continuity.
• Payment and tax records: kept for six years to meet UK statutory financial requirements.
• Cached vehicle records and images: kept while useful for delivering vehicle pages and reports. Non-personal vehicle cache entries may be refreshed or replaced when newer official or commercial data is fetched.
• Security and rate limiting logs: kept for short periods (hours or days) before automatic expiry.

If you ask us to delete your personal data, we delete your report rows, access tokens, report credits, and the email field on related orders. Anonymised usage statistics that do not identify you may be kept.

Cookies and local storage

Caroat uses only strictly necessary cookies or similar storage needed to verify report access and security sessions. We do not use third-party advertising cookies, advertising pixels, or behavioural profiling tools. A browser on your device may also keep a short local copy of a vehicle photo you already viewed, for about seven days, so the picture loads again without another download.

Your rights

Under UK data protection law you can ask to access the personal information we hold about you, correct it, delete it, restrict processing, object to processing based on legitimate interests, and receive a portable copy of information you provided to us where that right applies. We do not make solely automated decisions that produce legal or similarly significant effects about you.

Deleting your email record removes your ability to retrieve previously purchased reports. To exercise any of these rights, contact us via our contact page or email info@caroat.co.uk. If you remain unhappy, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Children

Caroat is aimed at adults buying or checking UK vehicles. We do not knowingly collect personal information from children.

Changes

If our privacy practices change, we will update this page and revise the date above.

See also our terms and conditions.