Privacy Notice

MotorSnoop Privacy Notice. Version 1.2. Last updated: 10 October 2026.

This notice explains how MotorSnoop uses personal data: what we collect, why, who we share it with, how long we keep it, and your rights. It applies when you use our website, use the free vehicle lookup or buy a report. It also covers people whose information can reach us without dealing with us directly, such as a seller named in an advert or the officers of a dealer company.

The key points

• We collect only what we need to check one vehicle and send you the report: the registration, your email address and anything you choose to add, such as the advert text.
• You buy as a guest. There are no accounts, no passwords and no uploads.
• We do not use artificial intelligence or machine learning. Your report is produced by fixed rules and set wording.
• Our website sets no cookies and uses no analytics, advertising or tracking.
• Our database and the servers that build your report are in London. Our payment and email providers also process some data outside the UK, including in the United States. Section 7 explains.
• We delete your report 365 days after we build it, and we erase your personal details from your order 365 days after you place it. We keep a basic accounting record of the payment for about six years, because tax law requires it.
• We never sell your personal data, and we do not send marketing.
• For anything about your data, email hello@motorsnoop.com. A person reads every message.

1. Who we are

MotorSnoop is run by MOTORSNOOP LTD, a company registered in England and Wales with company number 17279674. Our registered office is 167-169 Great Portland Street, London, England, W1W 5PF. We are registered with the Information Commissioner's Office (ICO) under number ZC176926.

We are the controller of the personal data this notice describes. That means we decide why and how it is used, and we are responsible for it.

You can contact us about anything in this notice by email at hello@motorsnoop.com, or by post at our registered office.

2. The personal data we collect

When you use the free vehicle lookup. You enter a registration, and we use it to look up the vehicle's make, model and colour in the government's public MOT records, so that you can check it is the right vehicle. We do not store the registration at this point. We store it only if you go on to place an order.

When you place an order. At checkout we collect:

• the registration of the vehicle you want checked;
• your email address, which you type twice so that we can catch mistakes;
• whether the seller is a private individual or a dealer;
• the make and model shown by the free lookup, if it found the vehicle;
• the text of the advert, if you choose to paste it. If it contains a full vehicle identification number (VIN), we remove the VIN before we store the text;
• the dealer's company number, if the seller is a dealer and you choose to give it;
• your confirmation that you have a legitimate reason to check the vehicle, and when you gave it;
• your request that we deliver your report straight away, and your acknowledgement that you give up your 14-day right to cancel once delivery begins, with the time of each;
• the version of the checkout wording you saw, which also identifies the version of our terms you accepted by continuing to payment.

The confirmations you tick at checkout are part of your contract with us and of consumer law. They are not consent for data protection purposes.

When you pay. You pay on Stripe's hosted checkout page, not on our website. Stripe collects your card details and any billing details its page asks for. We never see your full card number. We give Stripe your email address, so that it can send your receipt. We do not give Stripe the registration or any details of the vehicle. Stripe tells us whether the payment was held, taken, released or disputed, and gives us a payment reference, which we store with the payment status. We can see limited payment details, such as the card type and the last four digits of the card, in our Stripe account, but we do not copy them into our own systems.

Your order and your report. We record the date of your order, the amount, the payment reference and status, when we sent your order confirmation, when we told you that we could not complete your report (if that happens), and, if you dispute the payment with your card provider, the state of the dispute. We also keep operational notes, such as whether an order needed a person to look at it. When we build your report, we store the finished report, the date the checks ran, when we emailed your link, and a scrambled fingerprint of your link. We do not store the link itself.

When you email us. We keep your message, your email address and our reply, so that we can deal with what you asked.

Technical data. To stop bulk or automated use, we record the internet (IP) address that each request to our vehicle lookup, checkout and report pages comes from, and count the requests from that address in each one-minute period. Our hosting provider also handles IP addresses to deliver our pages, and keeps short technical logs of requests that include IP addresses and browser details.

What you must give us. To buy a report you must give us the registration and your email address, tell us whether the seller is a private individual or a dealer, tick the three confirmations and accept our terms. Without them we cannot take your order. The advert text and the company number are optional. Without them, the report covers less.

We do not ask for your name, postal address or phone number.

3. People who are not our customers

Some of the information we handle is about people who do not deal with us directly.

Sellers named in an advert. An advert you paste may include the seller's name, phone number or location. We use the advert only to compare its claims with the records, for example the mileage. Your report does not repeat the advert text. We never research private sellers.

Officers of dealer companies. If you tell us the seller is a dealer and give us a company number, we look up that company's public record at Companies House. Your report shows the company's name, number, status and date of incorporation, and the role and appointment date of each current officer, such as a director. It does not show the officers' names. We use no other source of information about the dealer.

Vehicle keepers. The data from our vehicle data supplier can include the dates on which a vehicle's registered keeper changed, and your report can show those dates. It never shows who the keepers were.

Registrations. Organisations with access to keeper records can link a registration to the vehicle's keeper. We use registrations only to check the vehicle.

If your information reaches us in any of these ways, you have the rights in section 9. Email hello@motorsnoop.com.

4. Why we use your data, and our lawful basis

UK data protection law requires a lawful basis for each use of personal data. Ours are as follows.

To take your order and supply your report: performance of our contract with you. This covers the free lookup you use to start an order, checking the registration with our data sources, building your report, emailing you your order confirmation and your link, telling you by email if we cannot complete your report, letting you open your report for 180 days, and dealing with your questions, complaints and refunds.

To keep records the law requires: legal obligation. We keep accounting records of each payment for tax purposes, and we use personal data to respond when you exercise your data protection rights.

For our legitimate interests. Where we rely on legitimate interests, we have weighed them against your rights and kept the data to the minimum we need. Our legitimate interests are:

• preventing fraud and misuse, and running a safe and reliable service;
• meeting the conditions of our vehicle data licence, explained below;
• keeping evidence of your checkout confirmations and of when we delivered your report, so that we can show we met our legal duties and deal with complaints, disputes and legal claims;
• keeping your report for 365 days, so that we can deal with questions and complaints about it;
• answering card disputes, explained in section 6;
• comparing the advert you paste with the records, and giving you the Companies House facts about a dealer you may buy from.

Misuse monitoring that our vehicle data supplier requires. Our licence for vehicle data requires us to check that each customer has a legitimate reason for each check, to monitor use, and to prevent bulk or systematic access. That is why we ask for your purpose confirmation and why we limit requests. Today our monitoring works like this:

• each IP address can make up to 60 requests a minute to our vehicle lookup, checkout and report pages. Requests above that are refused until the next minute;
• if an order, or a pattern of orders, looks unusual, for example many checks placed with one email address, a person may review it, and may refuse or suspend orders as our terms (section 8.8) allow.

We do not build a profile of you, and we do not use your data for marketing. You can object to any use based on legitimate interests: see section 9.

5. How your verdict is decided

Your report ends in a verdict: "Nothing found in our checks", "Something to check" or "Serious concerns found". The verdict is decided automatically, by fixed rules applied to the records about the vehicle. The same facts always give the same verdict. We do not use artificial intelligence or machine learning to write reports, to decide verdicts or for anything else.

The verdict describes the records about a vehicle. It is not a decision about you. It does not have any legal effect on you, and it does not decide whether you can buy, insure or finance the car. If you think a verdict rests on a fact that is wrong, email us. A person will review it and reply.

6. Who we share your data with

We never sell your personal data. We share it only as follows.

Providers who work for us. These providers process personal data only on our instructions, under contracts that require them to protect it:

• Vercel hosts our website and runs the servers that build and show your report. We have set those servers to run in London.
• Supabase hosts our database in London. Its backups stay in the UK.
• Cloudflare sends our emails: your order confirmation, the email with your link and, if we cannot complete your report, an email telling you so. It receives your email address and those emails, which contain your order details or your link and never any details of the vehicle or the report.
• Stripe processes your payment.

Stripe in its own right. Stripe also uses payment data for its own purposes, such as preventing fraud and meeting its legal duties. For those purposes Stripe is a separate controller, and Stripe's own privacy notice applies.

Our data sources. To build your report we send:

• the registration to our vehicle data supplier, which returns the vehicle history and status data in your report. We send it nothing else about you;
• the registration to the government's MOT history service, run by the Driver and Vehicle Standards Agency (DVSA), for the vehicle's make, model, colour, MOT history and recorded mileage. The free lookup uses the same service;
• for dealers, the company number to Companies House.

Our vehicle data supplier, if something goes wrong. If we believe the conditions on vehicle data in our terms have been broken, or there is a security incident involving vehicle data, we may have to tell our vehicle data supplier and give it the information it needs to look into it, such as the details of the order concerned. We do this to meet our licence conditions and to protect the data, which is in our legitimate interests. Our terms (section 8.7) explain this.

Card disputes. If you dispute a payment with your card provider, Stripe tells us, and we withhold access to the report while the dispute is open, as our terms (section 7.5) explain. To answer the dispute, we may send Stripe, for your card provider, evidence about your order, such as when you gave your checkout confirmations and when we delivered your report. We do this to defend the payment, which is in our legitimate interests.

Professional advisers. We may share information with our accountants, lawyers and insurers where they need it to advise or protect us.

When the law requires it. We may share personal data with the police, regulators or courts where the law requires or allows it, for example to prevent or detect crime or to deal with a legal claim.

If our business changes hands. If our business is sold or transferred, your data may pass to the new owner, who must use it as this notice describes.

7. Where your data is kept

Our database, including its backups, is in London. The servers that build and show your report run in London. We process and store the vehicle data in your report only in the UK.

Some of our providers are based in the United States, and some personal data does leave the UK:

• Stripe may process payment data, including your email address, in the United States and in other countries, such as India. Stripe relies on the UK Extension to the EU-US Data Privacy Framework and on the ICO's International Data Transfer Addendum to the EU Standard Contractual Clauses.
• Cloudflare sends our emails through its worldwide network, so the emails it sends for us, including your email address and your link, may be processed in the United States and in other countries outside the UK. Cloudflare keeps a delivery record of each email, such as the address it went to, when it was sent and whether it was delivered. We have set Cloudflare not to keep a copy of what our emails say. Cloudflare relies on the UK Extension to the EU-US Data Privacy Framework and on the ICO's International Data Transfer Addendum to the EU Standard Contractual Clauses.
• Vercel has its main processing facilities in the United States. Our servers run in London, but Vercel's technical logs, which include IP addresses, may be processed outside the UK. Vercel's contract with us protects this with the ICO's Addendum to the EU Standard Contractual Clauses.
• Supabase stores and mainly processes our database in London. Its staff work in several countries, and its contract allows limited access where it is needed to provide the service, such as technical support. Supabase's contract protects any such access with the ICO's Addendum to the EU Standard Contractual Clauses.

UK law treats data sent to a US organisation that has joined the UK Extension to the EU-US Data Privacy Framework as adequately protected. The ICO's Addendum is a set of contract terms approved by the ICO for transfers outside the UK. You can ask us for more information about these safeguards.

8. How long we keep your data

• Your report: deleted automatically 365 days after we build it. Your link stops working after 180 days, but we keep the report until day 365 to deal with questions and complaints.
• Your link: we never store the link itself. Its scrambled fingerprint is deleted with the report.
• Raw data from our vehicle data supplier: not kept. We use it to build your report and then discard it. Your report keeps only the finished wording, which never shows more than the last three characters of a VIN.
• Your personal details on the order: the registration, your email address, the advert text, the make and model, the company number and your purpose confirmation are erased automatically 365 days after you place the order. This applies to every order, including a checkout you did not finish and an order we could not complete.
• The accounting record of the order: the order date, amount, payment reference and status, whether the seller was private or a dealer, when we sent your order confirmation, when we told you that we could not complete your report (if that happens), the state of any card dispute, our operational notes, and the record of your two confirmations about delivery and cancellation, with their times and the wording and terms version. We keep this for about six years, because tax law requires accounting records and the confirmations show that we met consumer law. After the first year it no longer includes your email address or the registration.
• Payment messages from Stripe: a technical record of each message Stripe sends us, holding only Stripe's reference for the message, its type and when it arrived. It makes sure each payment is handled only once. We keep these with our accounting records.
• Request counts by IP address: deleted by a daily automated job once they are more than a day old, so none is kept for more than about two days.
• Hosting logs: kept by Vercel for up to a day.
• Emails we send you: Cloudflare keeps its delivery record of each email for a limited period under its own retention policy; we can see up to 30 days of this activity. It does not keep a copy of what the email says.
• Emails you send us: kept for up to two years after our last exchange, so we can deal with your request and any later complaint or dispute, then deleted.
• Payment data held by Stripe: kept by Stripe under its own retention rules, as a separate controller.

9. Your rights

You have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct data that is wrong or incomplete;
• ask us to erase your data;
• ask us to restrict how we use your data;
• object to our use of your data where we rely on legitimate interests;
• ask for the data you gave us in a format you can reuse, where we use it to perform our contract with you.

To use any of these rights, email hello@motorsnoop.com. Tell us the email address you used and roughly when you bought, so that we can find your order. We may ask for information to confirm who you are. There is normally no fee. We reply within one month. If your request is complex, we may take up to two further months, and we will tell you why within the first month.

Some limits apply. For example, we cannot erase records the law requires us to keep, such as accounting records, or records we need to deal with a legal claim. If we cannot do what you ask, we will explain why.

10. Complaints

If you are unhappy with how we have handled your personal data, please tell us first at hello@motorsnoop.com. We will acknowledge your complaint within 30 days and tell you what we are doing about it.

You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection. Its website is ico.org.uk and its helpline is 0303 123 1113.

11. Cookies and similar technologies

Our website does not set any cookies. It does not use local storage or any similar technology to store information on your device, and it loads no analytics, advertising, social media or other third-party scripts. Because of this there is nothing to ask your consent for, so we do not show a cookie banner.

Your report link works without cookies. The code that opens your report sits after the "#" sign in the link. Browsers do not send that part of a link to a website's servers, so it does not appear in server logs. The report page reads it on your device and sends it to us to open your report.

When you pay, you are on Stripe's checkout page, which Stripe runs. Stripe uses cookies there, for example to prevent fraud, under its own cookie policy.

If we ever add cookies or similar technologies that are not strictly necessary, we will ask for your consent first and update this notice.

12. Security

We use technical and organisational measures suited to the risk. For example:

• your link is a long random code, we store only a scrambled fingerprint of it, and an expired link never shows a report;
• our database can be reached only with secret credentials held by our servers, and its public data interface is switched off;
• connections to our website, our database and our providers are encrypted;
• card details are entered on Stripe's page and never reach our systems;
• we remove full VINs from adverts you paste, and a report never shows more than the last three characters of a VIN;
• our emails never contain details of the vehicle or the report.

If a personal data breach is likely to cause a high risk to you, we will tell you without undue delay. We will report a breach to the ICO where the law requires it.

13. Children

Our service is for adults. You must be 18 or over to buy a report. We do not knowingly collect personal data about children.

14. Changes to this notice

We may update this notice, for example if we change a provider or the law changes. We show the version and date at the top of this page, and we keep earlier versions.

Version 1.2, effective 10 October 2026.