Privacy Policy
Last updated: 21 September 2026RoadVerdict is a small, independently run UK site. This page explains, in plain terms, what we collect, why, how long we keep it, who we share it with, and how to see or remove it - not just because the law requires it, but because you should be able to actually understand it without a solicitor.
At a glance
- The Quote Checker, Cost Calculator, and Buying Guide need no account and collect nothing that identifies you.
- The free tracker needs an email address (for magic-link sign-in) and stores whatever you choose to log against your bike or car.
- Receipts you scan are read by an AI provider to fill in the details automatically - you always review before anything saves.
- We look up your registration plate against DVLA/DVSA-sourced records to show MOT history and vehicle specs.
- Payments (Pro subscriptions, one-time reports) are handled entirely by Stripe - we never see or store your card details.
- We never sell data, and we don't use it for advertising - RoadVerdict doesn't carry ad networks at all.
- You can export everything in your tracker as a CSV any time, or ask us to delete your account entirely.
Who we are
RoadVerdict is operated independently, as a small personal project rather than a large company. For data protection purposes, that means whoever runs the site is the "data controller" for anything RoadVerdict collects.
RoadVerdict is registered with the UK Information Commissioner's Office (ICO) under the Data Protection (Charges and Information) Regulations 2018.
The quickest way to reach us about anything in this policy, or about your own data, is hello@roadverdict.co.uk.
What this policy covers
This policy covers the RoadVerdict website, the free tools (Quote Checker, Cost Calculator, Buying Guide), the bike and car tracker and account area, and the buyer-facing report pages generated by Shareable Links - including for people who view or interact with a report without ever creating a RoadVerdict account themselves. It doesn't cover third-party sites we link to, including affiliate retailers and any DVLA/DVSA/GOV.UK pages referenced elsewhere on the site - those have their own privacy policies.
Tools you can use without an account
The Quote Checker, Cost Calculator, and Buying Guide don't require signing in and don't ask for your name, email, or registration number. When you use them, we store only the vehicle size/type, the job type, and the price you were quoted - never anything that identifies you, and never your IP address linked to your answers. These anonymised answers help keep the underlying price benchmarks accurate over time. This runs on a legitimate-interest legal basis rather than consent, because there's nothing personal collected to consent to in the first place.
Your account and the tracker
Tracking your bike or car's service history, mileage, fuel, and running costs requires a free account. We use passwordless ("magic link") sign-in - you enter your email, we send a one-time link, and clicking it signs you in. We never ask you to create or remember a password. This processing is carried out on the basis that it's necessary to perform our contract with you to provide the tracker (UK GDPR Article 6(1)(b)).
Tied to your email address, we store:
- Your email itself, used only to sign you in and send reminders you've asked for
- Your vehicle's details (make, model, year, mileage, region)
- Whatever you log against it - services, modifications, fuel fill-ups, insurance/tax/MOT payments, and any reminders you've set
- Any receipts or documents you attach, including anything you store in the Vault (see "Receipt scanning" and "Keeping your data secure" below)
- A session token in a secure cookie, so you stay signed in between visits
You can export everything you've logged as a CSV file directly from your dashboard at any time, and you can ask us to delete your account and everything tied to it whenever you like - see "Your rights" below.
Payments
If you subscribe to Pro, or buy a one-time Independent Vehicle Check or Buying Guide report, your payment is handled entirely by Stripe, our payment processor - your card details are entered directly into Stripe's own checkout and never reach our servers. We keep only what we need to know what you're entitled to: Stripe's own customer, subscription, and session identifiers, and a record of what was purchased, when, and for how much. This is carried out on the basis that it's necessary to perform our contract with you (Article 6(1)(b)).
If you have a Pro subscription, you can view invoices, change plan, update your payment method, or cancel at any time through Stripe's own billing portal, linked from the Pro page in your account.
Receipt scanning (AI-assisted)
When you scan a receipt, the photo is sent to Google's Gemini AI to automatically read the date, cost, item description, and mileage, so you don't have to type it in by hand. You review and can edit everything it extracts before anything is saved - the AI drafts the entry, it doesn't create it unattended. This is carried out on the basis that it's necessary to provide the tracker feature you've asked to use (Article 6(1)(b)), the same basis as the rest of the account.
We use Google's paid Gemini API tier for this, not the free consumer tier - under Google's terms, content submitted through the paid tier isn't used to train or improve its models.
The receipt photo itself is kept as an attachment on the record it creates, so you can view the original again later - it isn't discarded once the AI has read it. It's deleted when you delete that record, remove the bike or car it belongs to, or delete your account.
Vehicle and registration data
When you add a bike or car, or ask us to refresh its data, we look up its registration plate through Vehicle Data Global (VDG), a commercial vehicle-data provider, to show technical specifications and MOT history, and - for the paid Independent Vehicle Check and Buying Guide reports - stolen-marker, write-off, and outstanding-finance status and keeper/plate-change history. VDG's own data draws on DVLA and DVSA (MOT history) records, the Police National Computer, insurance write-off databases (MIAFTR), and finance houses, each of which is an independent data controller for its own underlying records. This is carried out on the basis that it's necessary to provide the feature you've asked for (Article 6(1)(b)).
How we work out if a price is fair
When you log a service in the tracker, or use the Quote Checker directly, we compare the price against typical UK ranges for that job and vehicle, and show a Fair, High, or Second Opinion result. This is a straightforward rules-based comparison against a fixed price table - not an AI model, and not a decision that has any legal or similarly significant effect on you. It's guidance, not a verdict on you personally, and it's always fine to disregard it.
The Story So Far
If you generate a "Story So Far" for your bike or car, we first calculate a set of plain facts from your logged history ourselves - things like how long you've owned it, your total spend by category, and your service rhythm. Only those pre-computed facts, never your raw records, receipts, or account details, are then sent to the same paid-tier Gemini API used for receipt scanning, to be turned into readable prose. This is a deliberate design choice to limit what leaves our systems for this feature, not an incidental detail. The Buying Guide's AI-written vehicle briefing and buyer-opinion summaries work the same way.
Reminder emails
If you set a reminder (for a service, insurance renewal, MOT, or similar), we email you when it's due, using our email provider, Resend. We only ever email you about reminders you've explicitly set - no marketing email, and we never share your address with anyone else.
Visitor and account analytics
Like most websites, our hosting platform automatically collects basic technical data about visits - pages requested, response times, and an approximate location derived from IP address via a free public geolocation lookup (ip-api.com) - to help us keep the site running reliably and understand overall usage. This is aggregate technical data, not linked to your name or email.
Separately, we record browser/device information and sign-in timestamps against specific accounts, mainly to help you and us spot suspicious access - for example, the Vault's own access log shows you your last few sign-ins. Unlike the paragraph above, this is linked to your account.
We also use Microsoft Application Insights (part of Azure) for error and performance monitoring. This is primarily response-time and error/stack-trace data, not personal data by design - but we haven't yet added a dedicated step to actively scrub personal data from error logs, so it's possible a bug could occasionally cause something identifying to appear in a log line. We treat that as a gap worth closing, not a caveat to hide behind.
Affiliate links
Some pages, including the tracker when you log tyres or a chain-and-sprockets job, include links to retailers we have an affiliate relationship with, such as moto-tyres.co.uk and GhostBikes.com. If you buy something after clicking through, we may earn a small commission - this never changes the price you pay, and we receive no information about what you actually purchase.
Internal access and support
A small number of people involved in running RoadVerdict can, where necessary, access account data to investigate a support request or fix a technical problem - including, in limited circumstances, viewing the site as you would see it (an "impersonation" session) to diagnose an issue you've reported. This access is limited to what's needed to resolve the specific issue, and every impersonation session is logged - who was accessed, when, and the reason given - so it can be reviewed after the fact.
Who processes your data, and where
We use a small number of trusted providers to run RoadVerdict, each acting as a data processor under our instructions:
- Microsoft Azure - UK-hosted (UK West region). Stores account and tracker data, receipt and Vault document attachments, and application logs, and hosts the site itself.
- Google (Gemini API, paid tier) - reads receipt photos and drafts AI-generated summaries (Story So Far, Buying Guide briefings). Paid-tier terms mean this content isn't used to train Google's models.
- Vehicle Data Global (VDG) - vehicle registration, MOT history, and (for paid checks) write-off/finance/stolen and keeper-change lookups.
- Stripe - payment processing for Pro subscriptions and one-time report purchases. Card details are handled entirely by Stripe and never reach our own servers.
- Resend - sends magic-link and reminder emails, built on infrastructure that may process data outside the UK; where that happens, it's covered by standard contractual clauses or an equivalent safeguard recognised under UK GDPR.
- ip-api.com - free public geolocation lookup, aggregate visitor analytics only.
Fonts on this site are bundled and served from our own domain at build time (via Next.js's font optimisation), not loaded from Google's servers at request time - so simply viewing pages doesn't send your IP address to Google for this.
None of these providers use your data for their own purposes - only to help us provide RoadVerdict to you.
International data transfers
Most of our processing happens in the UK (Azure's UK West region). Some processors - Google (Gemini API) and Resend - may process data outside the UK as part of their own infrastructure. Where that happens, we rely on standard contractual clauses or another transfer mechanism recognised under UK GDPR to keep your data protected to a UK standard regardless of where it's processed. Stripe, as a global payment processor, maintains its own UK/EU-recognised safeguards for the payment data it handles on our behalf.
Keeping your data secure
A few concrete things this site actually does, not just a general promise:
- Every page is served over HTTPS
- Sign-in tokens are never stored in plain text - only a one-way cryptographic hash, so even in the unlikely event of a breach, the tokens themselves couldn't be reused to sign in as you
- Magic links expire after 15 minutes and work exactly once
- Session cookies are httpOnly - inaccessible to any JavaScript running on the page, which helps protect against cross-site scripting attacks
- Data at rest in Azure Cosmos DB is encrypted by default
- Documents you store in the Vault are encrypted, and viewing them requires a fresh re-authentication, not just an already-open sign-in session
- You can turn on two-factor authentication for your own account
We rely on Azure's standard backup and disaster-recovery mechanisms; backups are protected the same way as our live data and are retained only long enough to support recovery from a technical failure, not kept as a separate long-term archive.
How long we keep data
| Data | Retention |
|---|---|
| Account and tracker data (while active) | For as long as your account remains active |
| Account and tracker data (after you ask us to delete it) | Deleted within 30 days of your request |
| Receipt images sent for AI scanning | Kept as an attachment on the record until that record, vehicle, or your account is deleted - see "Receipt scanning" |
| Share link tokens and buyer receipt requests | Deleted automatically once the link's chosen duration expires, or immediately if you revoke it |
| Anonymised Quote Checker data | Indefinitely - no personal identifiers exist to delete |
| Server/application logs | Age out under our monitoring platform's standard retention settings - we don't keep a separate, longer-lived copy |
Children's privacy
RoadVerdict isn't directed at children, and we don't knowingly collect data from anyone under 13. If you believe a child has provided us with personal data, contact us and we'll delete it.
Automated decision-making
RoadVerdict uses some automated processing - the Fair/High/Second Opinion price comparison, and AI assistance for reading receipts and drafting narrative summaries (the Story So Far, and the Buying Guide's AI briefing). None of this results in a decision that produces legal effects or similarly significantly affects you: every AI-drafted entry can be reviewed and edited before it's saved, and the price comparison is guidance you're always free to disregard. You won't be automatically refused service, charged differently, or have anything decided about you without a person being able to review it.
Your rights
Under UK GDPR, you can ask us at any time to:
- Access a copy of the data we hold about you
- Correct (rectify) anything inaccurate or incomplete
- Erase your account and everything associated with it
- Restrict how we process your data in certain circumstances
- Port your tracker data to another service in a structured, machine-readable format - or use the CSV export button in your dashboard directly
- Object to processing carried out on a legitimate-interest basis
- Withdraw consent at any time, for anything we process on that basis
To exercise any of these, email us - see Contact below. We'll respond within one month, as required by law. You can also complain to the UK Information Commissioner's Office if you're unhappy with how we've handled your data: ico.org.uk/make-a-complaint, or by phone on 0303 123 1113.
If something goes wrong
If a personal data breach occurs that's likely to result in a risk to your rights and freedoms, we'll notify the ICO within 72 hours of becoming aware of it, as required by UK GDPR. Where a breach is likely to result in a high risk to you specifically, we'll also notify you directly, without undue delay.
Changes to this policy
If this policy changes materially, we'll update the date at the top of this page. Continuing to use RoadVerdict after a change means you accept the updated version.
Governing law
This policy, and your use of RoadVerdict, is governed by the laws of England and Wales.
Contact
Questions about this policy, or want to exercise any of the rights above? Email us directly at hello@roadverdict.co.uk.