Straight answers from official DVLA & MOT data — no upsells, no sign-up, no charge.

Legal

Privacy Policy

Last updated 6 October 2026

This policy explains how CarOkay Ltd (“CarOkay”, “we”, “us”) collects and uses personal data when you use carokay.co.uk. We are the data controller for that data. CarOkay is not affiliated with the DVSA, DVLA or the Motor Insurers’ Bureau.

What we collect

  • Vehicle lookups. When you enter a registration we query official sources — the DVSA MOT history API, the DVLA Vehicle Enquiry Service, and the Motor Insurance Database (MID) — to show MOT, tax and insurance status. A registration is vehicle data, not personal data, unless combined with information that identifies you. It becomes personal data once you link it to your email by saving a car (see below).
  • AI diagnosis. Symptoms you describe and any photos you upload are sent to our AI provider (Anthropic’s Claude) to generate a diagnosis. Results may be cached for up to 30 days so a shareable link works, then deleted. Please avoid including faces, number plates or other people’s details in photos — only upload images of the fault.
  • Bookings & quote requests. When you contact a garage or request quotes we collect your name, email, phone (if given), postcode, vehicle details and your message so the garage can respond.
  • How you reached us (quote requests only). When you submit a quote request we attach a short record of that visit — the page you arrived on, the site that referred you (for example a search engine), any campaign tags in the link you clicked, and the pages you viewed before submitting. This is built in your browser’s memory during the visit and is never stored on your device; it is only sent to us if you choose to submit the form, and it is kept with that quote request and deleted with it. It helps us tell garages where an enquiry came from and understand which of our guides genuinely help drivers.
  • Your car account. If you save a car, we store your email address, the registrations you save, and facts about those cars from the DVSA MOT History API and the DVLA Vehicle Enquiry Service — MOT and tax dates, make, model, colour, mileage and MOT results — plus the insurance renewal date if you type one in. We also keep a record of each consent you give: when, on which page, and the exact wording you saw.
  • MOT reminders (older sign-ups). If you signed up for MOT reminders before car accounts existed, we store your registration and email to send reminders before your MOT is due.
  • Garage accounts. For garages, we store business details, login credentials (passwords are stored only as a salted hash) and subscription/billing information (payments are handled by Stripe).
  • Garage listings & contact details. To build our directory and introduce the service, we collect business contact details for garages from Google’s Places API and from garages’ own publicly available websites. See “Garages: directory & introductory emails” below.
  • Technical data. Standard server logs, your IP address (used transiently to rate-limit and protect the service), and essential cookies/session tokens needed to keep you signed in.
  • Anonymous usage analytics. We measure how the site is used (pages viewed, features tried, where people give up) with PostHog, configured in cookieless mode: nothing is stored on your device, and we cannot recognise you across visits. Usage may include anonymised session replays in which everything you type is masked before it leaves your browser. For signed-in garage accounts only, product usage is linked to the garage account so we can support and improve the portal.

How we use it & our legal basis

  • To provide the checks, diagnosis, search and booking features you ask for — performance of a contract / steps taken at your request.
  • To give you a car page for the cars you save — performance of a contract / steps taken at your request.
  • To send MOT and tax alerts for a saved car — consent, confirmed by clicking the link we email you, and withdrawable per alert type in one click from any alert email or on your car page. Older MOT reminders also rely on consent, with a one-click unsubscribe in every reminder.
  • Partner offers — a separate consent, unticked by default and never a condition of saving a car. We don’t currently send offers. If we ever do, each offer will name the partner, and nothing about you is shared with a partner unless you click through to them.
  • To send transactional emails (booking confirmations, quotes) and to operate, secure and improve the service and prevent abuse — legitimate interests.
  • To understand how the site is used via cookieless, anonymous analytics (and account-linked product usage for signed-in garages) — legitimate interests.
  • To introduce CarOkay to garages by email and maintain our directory — legitimate interests (see below), with a one-click unsubscribe in every message.

Sharing

We share booking and quote details with the garage(s) you choose or request quotes from, so they can respond. We use trusted processors who act only on our instructions — including Cloudflare (hosting), Anthropic (AI diagnosis), Resend (email delivery), Stripe (garage payments), PostHog(anonymous usage analytics) and Google (garage listings via the Places API). We do not sell your personal data or use it for third-party advertising, and we do not share your car or your email address with partners.

International transfers

Some of our processors are based in the United States — in particular Anthropic (which processes the symptoms and photos you submit for AI diagnosis), Stripe (garage payments) and PostHog(anonymous usage analytics, hosted on PostHog’s US cloud). Where personal data is transferred outside the UK, we rely on the UK’s adequacy regulations or on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, together with the processor’s own safeguards, so your data receives an equivalent level of protection. Our hosting and database (Cloudflare) are configured to keep data in UK/EU regions.

Garages: directory & introductory emails

If you run a garage, we may list your business in our directory using information from Google’s Places API and from your own public website, and we may send you a small number of introductory emails offering free customer leads. We rely on legitimate interests to do this (introducing a relevant B2B service to a business). Every such email includes a one-click unsubscribe; once you unsubscribe or ask us to stop, we suppress your address and won’t email you again. You can ask us to remove your listing or contact details at any time by emailing hello@carokay.co.uk.

Retention

We keep personal data only as long as we need it for the purpose it was collected:

  • Vehicle lookups — not stored against you; results are cached transiently (up to ~1 hour).
  • AI diagnoses — up to 30 days, then automatically deleted.
  • Quote requests / leads — up to 12 months after submission, then automatically deleted.
  • Booking enquiries & quotes — up to 24 months after your last interaction, then automatically deleted.
  • Car accounts — accounts you never confirm by email are deleted after 7 days; confirmed accounts are deleted 24 months after you last sign in. You can delete your account and everything linked to it at any time from your car page.
  • MOT reminders (older sign-ups) — until you unsubscribe (which deletes your reg and email); stale records are cleared after the MOT date has long passed.
  • Garage accounts — for the life of the account and, after closure, up to 6 years where needed for tax and legal records.
  • Server logs / IP addresses — short-lived, for security and abuse-prevention only.

Cookies

We only use essential, first-party cookies — the session tokens that keep you (or your garage account) signed in, the sign-in cookie for your car page, and cookies that protect the service. We do not use advertising or tracking cookies. Our usage analytics (PostHog) runs in a strictly cookieless mode: it stores nothing on your device — no cookies, no localStorage — and cannot recognise you when you come back, so no cookie-consent banner is needed. Our fonts are self-hosted, so loading the site doesn’t share your data with third parties.

Your rights

Under UK GDPR you have the right to access, correct, delete or port your data, to object to or restrict processing, and to withdraw consent (for example, the one-click unsubscribe in every alert, reminder and introductory email). If you have a car account, “Delete my data” on your car page erases it straight away. To exercise any right, email hello@carokay.co.uk and we’ll respond within one month. You may also complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.

Children

CarOkay is intended for drivers and motor-trade businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18.

Contact

CarOkay Ltd, United Kingdom — hello@carokay.co.uk. For data-protection queries, use the same address.