CarLlama Ltd ("we", "us") is the data controller for personal data you give us when using carllama.co.uk. We are registered in England & Wales (company number 12345678), at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. Contact: support@carllama.co.uk.

• Vehicle registration numbers you submit. Under UK GDPR, a registration plate is treated as personal data when it can identify a living individual (e.g. via DVLA records).
• Payment metadata from Stripe — your card details never touch our servers. We see the Stripe session id, the registration purchased, the amount and the timestamp.
• Email address if you contact support or receive a purchase confirmation.
• Standard server logs — request id, IP address, user agent and timestamps — kept for 30 days for abuse prevention and debugging.

• To deliver the vehicle check you requested.
• To process payment and prevent fraud (legitimate interest).
• To re-issue a Pro report if generation fails or you lose the link.
• To respond to support enquiries you initiate (legitimate interest).

We share the minimum necessary data with these processors so we can run the service:

• DVLA & DVSA — registration lookups for tax, MOT and history data.
• ukvehicledata.co.uk — finance, write-off, stolen, keeper and valuation packages.
• Stripe — card payment processing.
• OpenAI — the plain-English summary in a Pro report is generated by a large language model. We send the vehicle data the report is built from: the registration, make, model, year, colour, fuel type, MOT and tax status, MOT history, provenance markers (finance, write-off, stolen) and valuation. We do not send your name, email address or any payment details. OpenAI processes this under its API terms, does not use it to train its models, and retains it only briefly for abuse monitoring.
• Google Cloud — hosting and storage in the UK/EU: the service itself, the job queue that produces your report, the bucket your report PDF is kept in, and a short-lived cache of DVLA/DVSA lookups (see retention below).
• MongoDB Atlas — the database holding your check results (EU region).
• Twilio SendGrid — transactional email delivery, used to send your report link and PDF.

We host our own fonts and use no analytics, advertising or tag services, so loading this site does not disclose your IP address to anyone other than our hosting provider.

We do not sell your data and we do not use it for advertising profiling.

• Pro check results and Stripe session ids: 7 years (UK tax record retention).
• The rendered report PDF: 12 months, after which it is deleted from storage. The underlying check result stays for the period above, so we can still answer questions about a purchase.
• Cached DVLA/DVSA lookups: 30 minutes. When someone checks a registration we briefly keep the response so a repeat check — by you or anyone else — does not have to ask DVLA and DVSA again. It holds vehicle data only, never anything about who ran the check, and it is overwritten or deleted automatically.
• Server logs: 30 days.
• Support email threads: 2 years after the last reply.

We use a single first-party cookie to remember that you've dismissed the cookie banner. We do not use analytics or advertising cookies. Stripe sets its own cookies on the checkout page it hosts — those are governed by Stripe's privacy policy.

You can ask us to access, correct, delete or export your data, and you can object to or restrict our processing. Email support@carllama.co.uk and we'll respond within 30 days. If you're unhappy with our response, you can complain to the UK Information Commissioner's Office at ico.org.uk.

We may update this policy. Material changes will be flagged on this page with a new "Updated" date.