Privacy policy

1. Who we are

AUTO373 is a trading name. We decide how your personal information is used, which makes us the “controller” under UK data protection law. You can contact us about privacy at support@auto373.co.uk.

This policy covers auto373.co.uk, our free check, full reports and accounts. Our terms & conditions cover everything else.

2. What we collect and why

Vehicle searches

When you enter a registration or VIN, we use it to look up the vehicle’s records and show you the results. We don’t link a search to you unless you buy a report or are signed in. Why we can: to provide the check you asked for (our legitimate interests).

Emailing you a free check

If you ask us to email a free check, we use your email address and the registration only to send that one email. We don’t add you to a mailing list and we don’t keep your address afterwards, apart from our email provider’s delivery records. To stop the form being used to send unwanted emails, we count requests from each person (by their account, their check that they’re a person, or a scrambled form of their IP address) and to each email address (by a scrambled fingerprint, never the address itself), and delete those counts within 2 days. The same applies to sign-in emails. Why we can: you asked us to send it, and to prevent misuse (legitimate interests).

Buying a report

We collect your email address, the registration you checked and your order details (date, price and payment status). Your card details go directly to our payment provider; we receive only confirmation of payment and limited details such as the card type. We save the report itself, with the checks as they were on the day you bought it, so you can reopen it any time, and we give you a private link to it: anyone with the link can open the report, so keep it to yourself. If you use “Not helpful?” on your report, we keep your choice and the reason you give with your order, and email them to ourselves so we can reply. Why we can: to provide the report you bought (contract) and to keep financial records (legal obligation).

Accounts

If you create a free account, we keep your email address, how you sign in and the reports you’ve bought. If you sign in with Google or Apple, they share your name and email address with us. Why we can: to provide your account (contract).

How people use the site

We count visits ourselves, to see which pages and parts of pages help people and where they leave, so we can improve the site. When you view a page, we note which page it is (never the registration you checked), which sections were on your screen and for how long, which of our buttons you pressed, where you came from (such as a search engine, or a link with a tag like ?src=tiktok) and whether you’re on a phone, tablet or computer. We don’t use cookies for this or store anything on your device, we don’t record your name, email address or IP address, and we can’t recognise you on a later visit. If you buy a report, your order records where your visit came from, and you can tell us where you heard about us if you like. We don’t count browsers that ask websites not to track them (Global Privacy Control or Do Not Track). Why we can: to understand and improve our service (legitimate interests).

Contacting us

If you email us, we keep the conversation so we can help you and refer back to it. Why we can: to answer you (legitimate interests).

Keeping the service safe

Our hosting keeps short technical logs (such as IP address, browser and time of request), and our payment provider runs fraud checks. To stop misuse, we count how many checks, payments, emails and page views come from each visitor (by a scrambled form of the IP address) or each signed-in account, and delete the counts within 2 days. Before looking up a car for someone who isn’t signed in, we use Cloudflare Turnstile to check they’re a person, not an automated program; Cloudflare processes technical details about your browser and device to do this. Why we can: to protect the service and our customers (legitimate interests) and to meet legal duties.

3. People in vehicle reports

Reports describe vehicles. A full report can show how many keepers a vehicle has had and when it changed hands, but never a keeper’s name or address. We use a registration only to provide checks, and our terms don’t allow anyone to use reports to identify or contact keepers.

4. Cookies

We don’t use advertising, tracking or analytics cookies. When you sign in, we use a cookie that keeps you signed in. When you pass our check that you’re a person, two cookies remember it for an hour, and Cloudflare may use cookies to run that check. If you follow a creator’s or a friend’s link, a cookie keeps their discount on for 30 days. When you pay, a cookie lets this browser open the report you bought for 30 days. At checkout our payment provider may use cookies needed to prevent fraud. These are strictly necessary for what you asked for, so they don’t need your consent. Our own visit counting uses no cookies; if you turn it off, one cookie remembers that choice. If we ever want to add analytics cookies, we’ll ask you first.

5. Who we share it with

We share personal information only with:

• Service providers who run parts of AUTO373 for us and may use it only on our instructions: Stripe (payments), Supabase (accounts and our database), Resend (sending emails), Cloudflare (checking visitors are people) and our website host.
• Vehicle data sources: the DVSA, the DVLA and our licensed vehicle data providers receive the registration you check, not your name or email address.
• Google or Apple, if you choose to sign in with them.
• The police, fraud prevention agencies or regulators, where the law requires or allows it.
• Professional advisers, such as an accountant or solicitor, and anyone who takes over the business, who must protect your information in the same way.

We never sell your personal information.

6. Data outside the UK

Some of our service providers store or process data outside the UK, for example in the European Union or the United States. When they do, we make sure your information is protected by UK rules, such as UK adequacy regulations or approved contract terms.

7. How long we keep it

• Emailed free checks: we don’t keep your address; the request counts, which hold only a scrambled fingerprint of it, are deleted within 2 days.
• Accounts and saved reports: for as long as your account is open. If you close it, we delete your account details within 30 days, apart from order records.
• Buying without an account: your email address is kept with your report so you can reopen it or add it to an account later. Ask us and we’ll delete it.
• Order and payment records: 6 years, because tax law requires it.
• Emails with us: up to 2 years after our last contact.
• Technical logs: up to 30 days.
• Visit counts: 13 months, then deleted.

8. Your rights

You have the right to:

• get a copy of your personal information;
• have it corrected if it’s wrong;
• have it deleted, unless we must keep it by law;
• object to us using it, or ask us to limit how we use it;
• receive it in a format you can take elsewhere.

Email support@auto373.co.uk to use any of these rights. It’s free, and we’ll reply within one month. We may ask you to confirm your identity first.

9. Complaints

If you’re unhappy with how we’ve used your information, please tell us first at support@auto373.co.uk. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.

10. Children

AUTO373 is for adults. You must be 18 or over to buy a report or create an account, and we don’t knowingly collect information about children.

11. Changes to this policy

We’ll update this policy when what we do with personal information changes, and change the date at the top. If a change affects you significantly, we’ll tell account holders by email first.