Free Car Checks

Privacy Policy

Last updated: 16 July 2026

1. Introduction

Free Car Checks ("we", "our", or "us") provides a free UK vehicle check service at freecarchecks.org. This Privacy Policy explains what personal data we collect, why we collect it, and what your rights are. We've kept it in plain English, and it only describes processing we actually do.

We are based in the United Kingdom and comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Free Car Checks is the controller of the personal data described in this policy. You can contact us about anything in this policy at hello@freecarchecks.org.

2. Information We Collect

2.1 Vehicle lookups

When you run a free check, we collect:

  • Vehicle registration number (VRM): The registration you enter is sent to the DVLA Vehicle Enquiry Service and the DVSA MOT History API to retrieve tax, MOT and vehicle details. A registration number is usually vehicle data rather than personal data, but it can relate to you if the vehicle is yours.
  • The check result: We store a snapshot of the result returned by DVLA and DVSA so we can show it to you and reuse it as a short-term cache (see Section 5).
  • A hashed form of your IP address: We never store your raw IP address against a lookup. Instead we store a one-way keyed hash (HMAC-SHA256) of it, which we use solely for rate limiting and abuse prevention, for example stopping automated scraping of the service.
  • Browser user agent: The technical identifier your browser sends, stored with the lookup for abuse-detection purposes.

2.2 Information you provide

  • Email address: If you log in (we use passwordless email login links, with no passwords), save a check to your account, or ask us to email you a copy of a check result.
  • Name, email and message: If you contact us through the contact form.
  • Marketing preference: If you tick the optional marketing box, we record that choice. We only send marketing emails if you've opted in, and you can withdraw at any time.

2.3 Analytics (only with your consent)

If, and only if, you accept analytics in the cookie banner, we load Google Analytics and Ahrefs Analytics to understand how the site is used (pages visited, referring sites and similar aggregate usage data). If you don't consent, these tools are never loaded and no analytics cookies are set. See Section 8 for details.

We do not take payments, so we never collect payment or card information. The service is free.

3. How We Use Your Information (Lawful Bases)

3.1 Legitimate interests

  • Running your vehicle lookup against the DVLA and DVSA APIs and showing you the result
  • Caching recent results so repeat lookups of the same vehicle are fast and don't overload the government APIs
  • Rate limiting and abuse prevention using the hashed IP described above, so the free service stays available for everyone
  • Keeping the service secure and diagnosing technical problems

3.2 Contract / steps taken at your request

  • Creating and operating your account when you sign up or log in
  • Sending you a login link, saving checks to your account, and emailing you a copy of a result when you ask for one
  • Replying to messages you send us via the contact form

3.3 Consent

  • Analytics cookies and usage measurement, only if you accept analytics in the cookie banner
  • Occasional marketing emails, only if you tick the optional marketing box

You can withdraw consent at any time: via the link in the footer for analytics, or by emailing us for marketing. Withdrawal does not affect processing carried out before you withdrew.

4. Who We Share Data With

We use a small number of service providers to run the site, each processing data on our behalf:

  • DVLA & DVSA (data sources): The registration number you enter is sent to the DVLA Vehicle Enquiry Service and the DVSA MOT History API (official UK government services) to retrieve the check result. We do not send them your email, name or IP address.
  • Vercel (hosting): The website and its server code run on Vercel's infrastructure, which handles all requests to the site.
  • Neon (database): Check results, account details and saved checks are stored in a Neon Postgres database, encrypted in transit and at rest.
  • Resend (transactional email): Sends our login links, emailed check results and contact-form messages.
  • Upstash (rate limiting): Holds short-lived rate-limit counters keyed by your hashed IP. It never receives your raw IP address from us.
  • Google Analytics & Ahrefs Analytics (consent only): Loaded only if you accept analytics in the cookie banner. See Google's Privacy Policy and Ahrefs' Privacy Policy.

We do not sell, rent, or trade your personal information, and we do not share it with anyone else except where required by law.

5. Data Retention

  • Check results (cache): A result is reused as a cached copy for up to 6 hours, so anyone checking the same registration in that window gets the stored result rather than a fresh API call. After the cache window, lookup records (registration, result snapshot, hashed IP and user agent, never your raw IP) are retained as an operational log for abuse prevention and to understand how the service is used.
  • Rate-limiting data: The counters held by Upstash expire automatically, typically within about an hour.
  • Account data: Your email address and saved checks are kept until you delete your account. Deleting your account (available in your account settings) permanently removes your account and all your saved checks, and removes your email address from any lookup records it was attached to.
  • Login session: The session cookie set when you log in lasts up to 7 days (see Section 8).
  • Contact messages: Emails you send via the contact form are retained in our mailbox for as long as needed to handle your enquiry.

6. Your Rights Under UK GDPR

You have the following rights over your personal data:

  • Access: Request a copy of the personal data we hold about you
  • Rectification: Ask us to correct inaccurate or incomplete data
  • Erasure: Ask us to delete your personal data. You can also delete your account yourself at any time from your account settings
  • Restriction: Ask us to temporarily pause processing in certain circumstances
  • Portability: Request your data in a machine-readable format
  • Objection: Object to processing based on our legitimate interests

To exercise any of these rights, email hello@freecarchecks.org. We will respond within one month, as required by UK GDPR.

7. Children's Privacy

Our service is not directed at children under 16 and we do not offer accounts to children. We do not knowingly collect personal data from children; if you believe we have, please contact us and we will delete it.

8. Cookies and Similar Technologies

We keep cookies to a minimum. On your first visit you'll see a cookie banner, and non-essential cookies are never set until you accept them. You can change your choice at any time via the link in the footer.

8.1 Strictly necessary (no consent required)

  • Login session: fcc_session, an encrypted cookie set only when you log in, keeping you signed in for up to 7 days
  • Consent preference: fcc_consent_v1, stored in your browser's localStorage (not sent to our servers), records your cookie choices so we don't re-prompt you on every visit
  • Hosting infrastructure: our hosting provider (Vercel) may set strictly necessary cookies for routing and bot protection

8.2 Analytics (consent required)

Set only if you accept analytics in the cookie banner:

8.3 What we don't use

We do not set marketing or advertising cookies, and there are no payment-provider cookies; the service is free and takes no payments.

8.4 Withdrawing or changing consent

Open at any time to change or withdraw consent. Withdrawing analytics consent stops the analytics tools loading on your next page view.

9. Data Security

  • All traffic to the site is encrypted in transit (HTTPS/TLS)
  • Database storage is encrypted at rest
  • IP addresses are one-way hashed before storage; we never store them in raw form against lookups
  • Login is passwordless (emailed login links), so there are no passwords for us to store or lose
  • Session cookies are encrypted and inaccessible to scripts running in the page

10. International Data Transfers

Some of our service providers (such as our hosting, database, email and analytics providers) are US-based companies, so some data may be processed outside the UK. Where that happens, we rely on appropriate safeguards recognised under UK law, such as UK adequacy decisions, the UK International Data Transfer Agreement (IDTA), or Standard Contractual Clauses with the UK addendum.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we do, we'll update the "Last updated" date at the top of this page, and if the changes materially affect your rights and we hold your email address, we'll notify you by email.

12. Complaints and Regulatory Authority

If you have concerns about how we handle your personal data, you can:

  1. Contact us directly at hello@freecarchecks.org
  2. Lodge a complaint with the UK Information Commissioner's Office (ICO):
    • Website: ico.org.uk
    • Helpline: 0303 123 1113
    • Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

13. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

← Back to home