Privacy Policy

This privacy notice explains what personal data Expert Car Check (“we”, “us”) collects when you use expertcarcheck.com and the wider network of landing domains we operate, how we use that data, and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Expert Car Check is operated from the United Kingdom and acts as a data controller for the personal data described below. You can reach us at info@sparecarpart.com for any privacy enquiry, including subject access requests.

2. What we collect

• Vehicle registration marks (VRMs) you enter to run a check. Registrations can be personal data when linked to an identifiable person or your account.
• Account details and payment metadata include your email, account identifier and sign-in provider when you register using email or an enabled social provider. Card details are processed by our payment provider; we never see or store full PAN data.
• Optional usage analytics are enabled only with your consent. We send allowlisted public page paths and basic interaction categories, not registrations, payment-session links, authentication codes, chat text or raw referrers. Analytics may also process device and approximate location information. You can withdraw consent using the cookie controls.
• Sam / AI Mechanic conversations can be stored in your browser and, when you are signed in, saved server-side in your Supabase account with the associated vehicle registration so you can reopen them. Online chat sends conversation context to our model provider to generate replies. The separate on-device scanner Talk mode processes its speech and answers locally; it is not the same as online Sam chat.
• Vehicle scan images and findings are stored privately against your account and, for online analysis, sent to our damage-detection provider. On-device results are initially unverified local findings. Pending scan images and findings may be kept in this browser for recovery; they are not a completed cloud report. Syncing does not automatically remove that local copy. Clear this site's browser data to remove local evidence; this does not delete evidence already saved to your account.

3. Why we use it (lawful bases)

• Contract — to deliver the report you ordered, send a receipt and provide customer support.
• Legitimate interests — to keep the service secure, prevent fraud, and maintain the service.
• Consent — for optional analytics. Declining does not prevent you from using the report or scanner.
• Legal obligation — to meet our accounting, tax and consumer-law obligations.

4. Third parties we share with

We share the minimum data necessary with our vehicle-data, damage-detection, AI, 3D-model, payment, hosting and analytics providers. This currently includes DVLA and DVSA for vehicle records, Roboflow for damage detection, OpenRouter for chat responses, Tripo for vehicle models, Supabase for private data storage and authentication, Vercel for hosting, and Stripe when payments are enabled. We do not sell this data for advertising.

5. International transfers

Some processors are based outside the UK. Where we transfer data internationally we rely on UK adequacy decisions or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

6. How long we keep it

Report orders are retained for six years to meet HMRC requirements. Analytics data is retained for 14 months in aggregated form. Saved Sam conversations remain linked to your account until deleted, subject to applicable retention requirements. Clearing browser storage does not delete server-side conversations, and archiving a chat does not delete it. Use the chat deletion control or contact us to request deletion of your account data. Vehicle scan images and findings remain in your private account record so the report can be reopened; you can request their deletion using the contact details above, subject to any legal retention requirement.

7. Your rights

You have the right to access, rectify, erase, restrict, port and object to processing of your personal data, and to lodge a complaint with the Information Commissioner’s Office (ico.org.uk). To exercise any right, email us using the contact above — we respond within one month.

8. Cookies

See our cookie notice for the cookies and similar technologies we use.