Last updated: 14 August 2026
This Privacy Policy explains how Sorted Cars Ltd ("we", "us", "our") collects, uses, stores, and protects your personal data when you use sortedcars.co.uk ("Website") and our services. We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
The data controller responsible for your personal data is:
| Data Category | Examples | When Collected |
|---|---|---|
| Account information | Name, email address | When you sign in via magic link |
| Vehicle registration numbers | Registration plate entered for checks | When you run a check |
| Payment data | Processed by Stripe — we do not store card details | When you purchase a paid service |
| Usage data | Pages visited, features used, IP address, browser type, and the approximate location and network operator your internet provider is associated with (country, region, city) | Automatically when you browse the Website |
| Communication data | Emails sent to/from support | When you contact us |
When you use the free check. The free check does not require an account. We still record the page you arrived on, the registration you checked, and where the request came from — your IP address and the country, region, city and network operator that Cloudflare derives from it. We use this to understand how people find and use the free check, and to stop the service being abused. We do not store an identifier in your browser for this, and we do not use it to track you across other websites. These records are deleted after 12 months.
We do not collect special category data — such as data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, health, sex life or sexual orientation, or genetic or biometric data — and we do not collect criminal offence data.
| Purpose | Lawful Basis (UK GDPR) |
|---|---|
| Provide vehicle check reports | Performance of a contract (Art. 6(1)(b)) |
| Process payments via Stripe | Performance of a contract (Art. 6(1)(b)) |
| Send reports and transactional emails | Performance of a contract (Art. 6(1)(b)) |
| Send marketing emails (free tier lead capture) | Consent (Art. 6(1)(a)) |
| Improve our services and fix bugs | Legitimate interest (Art. 6(1)(f)) |
| Measuring site traffic and page performance | Legitimate interest (Art. 6(1)(f)) — we use Cloudflare Web Analytics, which sets no cookies and builds no profile of you |
| Understanding which pages are used, so we can improve the Website | Consent (Art. 6(1)(a)) — Google Analytics, loaded only after you accept analytics cookies, and never for advertising. You can withdraw at any time via “Cookie Settings” in the footer |
| Comply with legal obligations | Legal obligation (Art. 6(1)(c)) |
We share your data with the following third-party processors who act on our behalf:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database and authentication | EU (Frankfurt) |
| Cloudflare | Website hosting, CDN, Workers (API gateway) and privacy-first website analytics (Cloudflare Web Analytics). This is cookieless and does not track visitors across sites; it processes IP address and the page URL visited to measure page performance and traffic. | Global edge network |
| Cloudflare R2 | Generated report file storage | EU jurisdiction |
| Stripe | Payment processing | UK/EU |
| Resend | Transactional email delivery | Ireland (EU) |
| Google (Google Analytics 4) | Website analytics — which pages are visited and how people move through the site. Loaded only if you accept analytics cookies. Advertising features, Google Signals and ad personalisation are switched off, and we do not send Google your registration searches, report contents or account details | USA |
| DVLA | Vehicle data (VES API) | UK |
| DVSA | MOT history data | UK |
| Specialist data suppliers reached through OneAutoAPI — including Experian, Solifi, Brego, UK Vehicle Data, Marketcheck, EV Database, CarGuide, Percayso, Salvage Guide, EzyVIN, Evox, Clearwatt, Cartell and AutoPredict | Individual report sections: provenance and finance, valuations and market pricing, demand and advert data, EV and running costs, salvage, specification and recalls | Accessed through OneAutoAPI (UK) |
We also expect to use Marketcheck and Percayso for dealer stock, pricing and advert data in our Trader Reports service.
Where data is transferred outside the UK, we ensure appropriate safeguards are in place. Transfers to the EU are covered by the UK adequacy decision. Cloudflare operates a global edge network, so a request may be served by infrastructure outside the UK and EU; those transfers rely on UK adequacy regulations where they apply, and otherwise on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
If you accept analytics cookies, Google Analytics data is processed by Google LLC in the United States. That transfer relies on the UK Extension to the EU-US Data Privacy Framework, to which Google LLC is certified, backed by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. If you do not accept analytics cookies, no such transfer happens.
We keep data only for as long as we have a documented need, then delete it automatically on a nightly schedule — deletion is never manual.
| Data Type | Retention Period |
|---|---|
| Account data (name, email) | Until you delete your account |
| Paid reports that carry the Experian Data Guarantee (full provenance reports) | 24 months — the guarantee runs for 12 months from the check and we must still hold the report to investigate a claim |
| Other paid vehicle reports (valuations, specification, EV, running costs, single checks) | 12 months — re-openable on screen for 30 days after purchase; after that the report is kept but no longer viewable, and is opened by us only to investigate a card dispute, complaint or claim |
| Free car check emailed to you | We email a link to the vehicle's page on our website, not a copy of the report. The email record is kept for 12 months; the page itself stays available |
| Short-term lookup cache (DVLA/MOT answers, per registration) | 24 hours (stale copies removed within 48 hours) |
| Payment and transaction records (order reference, registration, price, date — no report content) | Up to 7 years (UK tax and accounting requirements) |
| Support messages | 24 months after the conversation closes |
| Error and activity logs | 12 months |
| Free check activity (page arrivals, checks run, IP address, approximate location) | 12 months |
| Abuse-prevention counters (daily check counts per IP address) | 7 days |
| Marketing email consent | Until you unsubscribe — we then keep only your email address, on our do-not-contact list |
Three things worth knowing. First, the PDF report we email you is your own copy and is unaffected by these clocks. Second, on-screen viewing of a purchased report is free and unlimited for 30 days from purchase via Your Reports; after that we hold the report file only as evidence for guarantee claims and payment disputes, for the periods above. Third, stored reports are never reused to answer a new enquiry — every check is a fresh call to the data provider.
Under the UK GDPR, you have the following rights:
To exercise any of these rights, please use our Contact Us form. We will respond within one month.
We do not carry out automated decision-making that produces legal or similarly significant effects concerning you. Vehicle check results are compiled from third-party data sources (DVLA, DVSA and Experian) and presented to you for your own consideration.
We use the minimum cookies and similar browser-storage technologies (local storage, session storage) needed to operate the Website. The cookies below are strictly necessary, and under Regulation 6 of the Privacy and Electronic Communications Regulations 2003 may be set without consent — without them you could not sign in, run a paid check, or be protected against automated abuse:
| Cookie / storage | Purpose | Duration |
|---|---|---|
| Supabase auth token | Keeps you signed in to your SortedCars account | Session / up to 1 year (rolling) |
| Cloudflare bot mitigation | Protects the site against automated abuse and DDoS | Up to 30 days |
| Stripe Checkout / Stripe.js | Processes payments securely; set only when you initiate a paid check | Set by Stripe per their cookie policy |
We also use Google Analytics to understand which pages people use, so we can improve the site. These cookies are not strictly necessary, so we set them only if you choose “Accept” on the cookie banner. Until you do, nothing is loaded from Google and no analytics cookie is set. If you choose “Reject”, we load nothing at all.
| Cookie | Purpose | Duration |
|---|---|---|
_ga | Google Analytics — tells returning visits apart, so a person browsing five pages is counted once, not five times | 2 years |
_ga_XT9ZCRV7YS | Google Analytics — keeps track of the current visit | 2 years |
You can change your mind at any time using Cookie Settings at the bottom of any page — withdrawing is as easy as giving. We do not set advertising or social-media cookies, we have switched off Google’s advertising features and ad personalisation, and we do not sell, share or trade cookie data with any third party.
You can clear cookies and browser storage at any time through your browser's privacy settings. Blocking strictly necessary cookies will break sign-in, paid checks and bot protection. For general guidance, see the ICO's cookie guidance at ico.org.uk.
We take appropriate technical and organisational measures to protect your personal data, including:
Our services are not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 18, we will delete it promptly.
We may update this Privacy Policy from time to time. The updated version will be posted on this page with a new "Last updated" date.
If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
For any privacy-related questions or to exercise your data rights: