Straight answers from official DVLA & MOT data — no upsells, no sign-up, no charge.

Legal

Privacy Policy

Last updated 16 July 2026

This policy explains how CarOkay Ltd (“CarOkay”, “we”, “us”) collects and uses personal data when you use carokay.co.uk. We are the data controller for that data. CarOkay is not affiliated with the DVSA, DVLA or the Motor Insurers’ Bureau.

What we collect

  • Vehicle lookups. When you enter a registration we query official sources — the DVSA MOT history API, the DVLA Vehicle Enquiry Service, and the Motor Insurance Database (MID) — to show MOT, tax and insurance status. A registration is vehicle data, not personal data, unless combined with information that identifies you.
  • AI diagnosis. Symptoms you describe and any photos you upload are sent to our AI provider (Anthropic’s Claude) to generate a diagnosis. Results may be cached for up to 30 days so a shareable link works, then deleted. Please avoid including faces, number plates or other people’s details in photos — only upload images of the fault.
  • Bookings & quote requests. When you contact a garage or request quotes we collect your name, email, phone (if given), postcode, vehicle details and your message so the garage can respond.
  • MOT reminders. If you opt in, we store your registration and email to send reminders before your MOT is due.
  • Garage accounts. For garages, we store business details, login credentials (passwords are stored only as a salted hash) and subscription/billing information (payments are handled by Stripe).
  • Garage listings & contact details. To build our directory and introduce the service, we collect business contact details for garages from Google’s Places API and from garages’ own publicly available websites. See “Garages: directory & introductory emails” below.
  • Technical data. Standard server logs, your IP address (used transiently to rate-limit and protect the service), and essential cookies/session tokens needed to keep you signed in.
  • Anonymous usage analytics. We measure how the site is used (pages viewed, features tried, where people give up) with PostHog, configured in cookieless mode: nothing is stored on your device, and we cannot recognise you across visits. Usage may include anonymised session replays in which everything you type is masked before it leaves your browser. For signed-in garage accounts only, product usage is linked to the garage account so we can support and improve the portal.

How we use it & our legal basis

  • To provide the checks, diagnosis, search and booking features you ask for — performance of a contract / steps taken at your request.
  • To send MOT reminders — consent, which you can withdraw at any time via the one-click unsubscribe in every reminder.
  • To send transactional emails (booking confirmations, quotes) and to operate, secure and improve the service and prevent abuse — legitimate interests.
  • To understand how the site is used via cookieless, anonymous analytics (and account-linked product usage for signed-in garages) — legitimate interests.
  • To introduce CarOkay to garages by email and maintain our directory — legitimate interests (see below), with a one-click unsubscribe in every message.

Sharing

We share booking and quote details with the garage(s) you choose or request quotes from, so they can respond. We use trusted processors who act only on our instructions — including Cloudflare (hosting), Anthropic (AI diagnosis), Resend (email delivery), Stripe (garage payments), PostHog(anonymous usage analytics) and Google (garage listings via the Places API). We do not sell your personal data or use it for third-party advertising.

International transfers

Some of our processors are based in the United States — in particular Anthropic (which processes the symptoms and photos you submit for AI diagnosis), Stripe (garage payments) and PostHog(anonymous usage analytics, hosted on PostHog’s US cloud). Where personal data is transferred outside the UK, we rely on the UK’s adequacy regulations or on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, together with the processor’s own safeguards, so your data receives an equivalent level of protection. Our hosting and database (Cloudflare) are configured to keep data in UK/EU regions.

Garages: directory & introductory emails

If you run a garage, we may list your business in our directory using information from Google’s Places API and from your own public website, and we may send you a small number of introductory emails offering free customer leads. We rely on legitimate interests to do this (introducing a relevant B2B service to a business). Every such email includes a one-click unsubscribe; once you unsubscribe or ask us to stop, we suppress your address and won’t email you again. You can ask us to remove your listing or contact details at any time by emailing hello@carokay.co.uk.

Retention

We keep personal data only as long as we need it for the purpose it was collected:

  • Vehicle lookups — not stored against you; results are cached transiently (up to ~1 hour).
  • AI diagnoses — up to 30 days, then automatically deleted.
  • Quote requests / leads — up to 12 months after submission, then automatically deleted.
  • Booking enquiries & quotes — up to 24 months after your last interaction, then automatically deleted.
  • MOT reminders — until you unsubscribe (which deletes your reg and email); stale records are cleared after the MOT date has long passed.
  • Garage accounts — for the life of the account and, after closure, up to 6 years where needed for tax and legal records.
  • Server logs / IP addresses — short-lived, for security and abuse-prevention only.

Cookies

We only use essential, first-party cookies — the session tokens that keep you (or your garage account) signed in and protect the service. We do not use advertising or tracking cookies. Our usage analytics (PostHog) runs in a strictly cookieless mode: it stores nothing on your device — no cookies, no localStorage — and cannot recognise you when you come back, so no cookie-consent banner is needed. Our fonts are self-hosted, so loading the site doesn’t share your data with third parties.

Your rights

Under UK GDPR you have the right to access, correct, delete or port your data, to object to or restrict processing, and to withdraw consent (for example, the one-click unsubscribe in every MOT reminder and introductory email). To exercise any right, email hello@carokay.co.uk and we’ll respond within one month. You may also complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.

Children

CarOkay is intended for drivers and motor-trade businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18.

Contact

CarOkay Ltd, United Kingdom — hello@carokay.co.uk. For data-protection queries, use the same address.