Privacy policy

This policy explains what personal data EvelopCars collects, why we collect it, and what rights you have under the UK GDPR and the Data Protection Act 2018.

What we collect

• Registration marks you search for, together with the date and time of the search.
• Your email address, when you buy a report or create an account.
• Your name, if you provide one or sign in with a third-party provider.
• Order records: reference, tier, amount, payment status and the generated report.
• Standard technical data such as IP address and browser type, recorded by our infrastructure for security and abuse prevention.

What we do not collect

We never see or store your card details. Payments are handled entirely by Stripe, a PCI-DSS compliant processor. We do not sell, rent or share your personal data with advertisers.

Why we process it

• To perform our contract with you: producing, delivering and storing the report you paid for.
• For our legitimate interests: preventing fraud and abuse, monitoring service quality and understanding aggregate demand.
• To meet legal obligations: retaining transaction records for tax and accounting purposes.

Vehicle data

Vehicle records returned by our data suppliers relate to the vehicle, not to you. We do not receive the name or address of a vehicle's current or previous keepers, and we never display personal details of any third party.

How long we keep it

Order and report records are retained for six years to meet HMRC record-keeping requirements. Free preview searches are retained in aggregate form. You may ask us to delete your account and associated personal data at any time, subject to those statutory retention obligations.

Who we share it with

• Our data aggregator, to retrieve the vehicle record for the registration you searched.
• Stripe, to take payment.
• Our email provider, to deliver your report and order confirmation.
• Our hosting and database providers, who store the data on our behalf.

Your rights

You have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable format. To exercise any of these rights, contact us using the details on the contact page. You also have the right to complain to the Information Commissioner's Office.

Security

Data is transmitted over TLS and stored on access-controlled infrastructure. Report links contain a long random token; treat your report link as confidential, as anyone holding it can view that report.