Privacy Policy
Last updated: 2 August 2026
1. Who controls your data
The data controller for personal data processed via CompareForecourt is IMAgentics ("we", "us", "our"), based in the United Kingdom. Contact for privacy queries: support@compareforecourt.com.
2. What we collect and why
| Data | Why we have it | Legal basis (UK GDPR) |
|---|---|---|
| Email, name, avatar (from Google) or just email (magic link) | Account creation; sign-in | Contract performance (Art. 6(1)(b)) |
| Saved listings, preferences, garage entries, notifications | Provide the comparison service | Contract performance |
| AI prompt text, responses, token counts | Run AI features; bill against your credit allowance; debug issues | Contract performance |
| Audit log (account actions, login times, listing edits) | Support, abuse investigation, dispute resolution | Legitimate interest (Art. 6(1)(f)) |
| Stripe customer ID, payment metadata (we do NOT see card numbers) | Process payments, deliver passes | Contract performance |
| Server logs (IP, request paths, errors) | Security, debugging, rate-limit enforcement | Legitimate interest |
| Anonymous page views of public pages (page path, referring website, a daily-rotating visitor code) | Understand which guides and pages are useful. No cookies, no IP address stored, not linked to your account | Legitimate interest |
| Where your account came from (the public page you pressed sign-in on, and the website that referred you to it) | See which guides actually help people. Recorded once, when the account is created, and never updated afterwards. Read at the moment you sign in; nothing is stored on your device and we do not track you around the site beforehand | Legitimate interest |
| DVSA MOT records (looked up on demand) | Show MOT history alongside saved listings | Legitimate interest |
3. How long we keep it
- Account data: for as long as your account is open, plus 30 days after deletion to allow recovery.
- Audit log: 90 days, then automatically purged.
- Listings: until you delete them or close your account.
- Payment records: 7 years (UK tax-record retention requirement).
- Anonymous page views: 90 days, then automatically purged.
- AI prompt content: stored only in audit log (truncated to first 500 characters), purged with the rest of the audit log at 90 days.
4. Who else sees your data (sub-processors)
- Anthropic (US): receives the listing text and your prompts to generate AI output. Anthropic is contractually prohibited from training on this data.
- Stripe (Ireland / US): payment processing. Card numbers go directly to Stripe and never touch our servers.
- Resend (US): transactional email (magic-link sign-in, support replies).
- Google (US): OAuth identity provider for sign-in.
- DVSA (UK): MOT history records by registration plate, fetched on demand.
- Sentry (Germany): error reporting. Configured to scrub session cookies and API keys before events leave our servers.
- Hostinger (Lithuania / EU): VPS hosting; data at rest is held in their EU data centres.
- Google AdSense (US): third-party advertising. Google may set cookies and use device identifiers to serve ads. See policies.google.com/technologies/ads. You can manage personalisation at google.com/settings/ads.
We do not sell your data. The only data shared with advertisers is the standard ad-request information your browser sends to Google AdSense (IP address, page URL, ad-cookie identifiers), and only after you have given consent through the cookie banner described in section 7.
5. International transfers
Some of our sub-processors (Anthropic, Stripe US entity, Resend, Google, Sentry) process data outside the UK. Where this happens we rely on UK-IDTA / EU SCCs or Adequacy Regulations. You can request copies of these by emailing us.
6. Your rights
Under UK GDPR you have the right to:
- access the data we hold about you;
- request correction of inaccurate data;
- request deletion of your data ("right to be forgotten");
- request a portable copy of your data;
- object to processing based on legitimate interest;
- withdraw consent at any time (where consent was the basis);
- complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.
To exercise any right, email support@compareforecourt.com. We respond within one calendar month.
7. Cookies and consent
We use a first-party session cookie (name: session) to keep you logged in. It is HttpOnly, Secure, and SameSite=Lax. This cookie is strictly necessary for the service to function and does not require consent.
Our analytics set no cookies at all. To see which public pages and guides are actually useful, we count page views ourselves rather than using Google Analytics or any other third-party tracker. Nothing is stored on or read from your device, so there is nothing to consent to under the Privacy and Electronic Communications Regulations. We record the page path, the referring website's domain (never the full link or any search terms), and a short code derived from your IP address and browser. That code is salted with a random value that changes every day and is never saved, so it cannot be reversed to identify you and cannot link your visits from one day to the next. Your IP address itself is never written to our database, and views of pages that reveal what you are shopping for (a saved listing, your garage, your account) are never recorded. If your browser sends a Global Privacy Control or Do Not Track signal, we skip the count entirely.
Separately from analytics, the app keeps a few things in your browser's own local storage so the site behaves the way you left it: your light/dark theme, your comparison priorities, which inspection items you have ticked off, whether you skipped the setup questions, and whether you dismissed the "add to home screen" prompt. One further item is temporary: if you paste a listing before signing in, the link and pasted text are held on your device just long enough to survive the sign-in redirect, then deleted as soon as the listing is saved.
All of this stays on your device. None of it is a tracking identifier, none of it is read by third parties, and none of it is sent to us except the pasted listing you were already submitting. Clearing your browser data removes all of it.
We also display ads served by Google AdSense, which sets third-party cookies and uses device identifiers. Before any AdSense cookies or personalised-ad signals are set, UK and EEA visitors are shown a Google-certified Funding Choices consent banner asking whether they want to allow personalised ads, non-personalised ads only, or to take a different option offered by Google. You can change your choice at any time by clicking "Privacy options" at the bottom of any page (where available) or by clearing site data in your browser.
If you decline personalised ads, AdSense serves contextual ads only (based on the page content, not your profile). Strictly necessary cookies remain regardless of your choice.
8. Children
CompareForecourt is intended for users aged 18 or over. We do not knowingly collect data from anyone under 18.
9. Changes to this policy
We may update this policy from time to time. Material changes will be emailed to you at least 14 days before taking effect.
Privacy questions? Email support@compareforecourt.com.