Version 2026-09-23

Privacy Notice

This notice explains how CarDiligence Limited uses personal information to operate CarDiligence, take payment and prepare your report, and the choices you have about that information.

1. What we collect and where it comes from

• From you: your email address and postcode, plus the used-car advert link you send us. If an eBay advert omits the vehicle registration, we ask for that registration alone and do not retain an invalid or mismatched attempt in the order record. Manual entry includes the registration, optional advertised mileage, advert description and optional advert link.
• From the advert and data providers: information from the public advert and vehicle-data sources, including advert details, seller or dealer information shown in the advert, vehicle data, MOT/tax, service, market and recorded-history information used to build the report.
• When an advert is outside or cannot be confirmed within current UK coverage, the advert website’s address, the country we identified (or that it was unknown), how and when we reached that result, and whether you asked us to support that country.
• Any optional request note sent through a connected app or service. Do not submit personal or sensitive information.
• Through a compatible assistant, when you choose that route: the advert link, email and postcode supplied for your purchase quote, the quoted price and Terms version, and the approval details supplied by the assistant. We retain the recorded consent time and protected references to the approval record and payment credential. We do not retain the raw payment token in the database.
• Order and payment details, including the price, payment status and Stripe reference numbers for checkout, payments, updates and refunds. Stripe handles card details; we do not receive or store full card numbers.
• The report, the original information received from data services, the secure code in your private report link and whether the report email was sent.
• Records used to run and protect the website. Depending on how hosting is set up, these may include the time of a visit or request, the device’s internet (IP) address, browser details, errors and security events. Sensitive order details are removed from the application’s logs.

Your email address, postcode and enough advert or vehicle information to identify the car are required to create and deliver the report. Payment information is required if you buy a report. If you do not provide the required information, we cannot accept the order or supply the report. Fields described as optional are not needed to enter into the contract.

2. Why we use your information and the legal reasons

• Contract: to create the order, take payment, generate and deliver the report, provide support and deal with service issues.
• Legitimate interests: to retrieve and analyse public advert and vehicle information so we can provide the requested report, including where that information relates to a seller or dealer; to secure the service, prevent abuse and fraud, find and fix problems, keep records of what happened, understand overall website use and performance, and keep the service reliable. We balance these interests against the rights of the people concerned.
• Legal obligation: where records must be kept for tax, accounting, consumer-law or regulatory purposes.

The automated assessment concerns the vehicle and does not make a legal or similarly significant decision about you.

3. Who receives data

We share only the data each provider needs for its role:

If you purchase through an assistant, the assistant and its approval provider receive the quote, purchase requirements and the private purchase status or report link needed to complete your request. Their own privacy notices also apply. Keep purchase and report links private. Stripe supplies and processes the scoped payment credential; a bank authentication check may open Stripe's payment interface.

• Cloudflare for website delivery, overall website usage statistics and security, including content delivery, traffic filtering, protection against attempts to overwhelm the site, automated abuse detection, and Turnstile on the public order form.
• Stripe for secure payment processing.
• Resend for the report-ready email when production email delivery is enabled. We send it the delivery email address, the private report link and the email content.
• eBay and other advert website operators when we retrieve the public advert you ask us to check. The request identifies the advert, but we do not send your email address or payment details to the advert website.
• One Auto API and its underlying data sources for advert, vehicle, MOT/tax, service, market and history checks. Advert or vehicle inputs, and postcode or mileage where needed, are sent for the selected checks.
• OpenAI to help explain checked report facts when enabled. For manual entry, the advert description may also be sent after phone numbers and email addresses have been automatically removed. This is only to suggest things to check, questions for the seller and checks at the viewing. Payment-card details are not sent.
• Hosting: Linode .
• Database hosting: Linode .

We may also disclose information where required by law or to protect legal rights. We do not sell personal data.

Cloudflare website delivery and security

Cloudflare sits between your browser and our service as a network and security provider. It therefore processes the traffic needed to deliver and protect the site. Depending on the request and enabled security feature, this may include your IP address, request time, the page requested, details sent by your browser, information about the encrypted connection and network, Cloudflare security reference numbers and security events. It may also process request content only as needed to transmit the request to our service or apply the security and delivery features we configure. We use Cloudflare for our legitimate interests in keeping the service available, secure and resistant to fraud and abuse.

Cloudflare Web Analytics

We use Cloudflare Web Analytics to understand how our public pages are used and how well they work. A small script in your browser sends information about page visits, loading speed and responsiveness. The summaries can include country, browser, operating system, device type, how a page was opened, website and page address, and the referring website. Cloudflare Web Analytics does not record the extra details after a question mark in a web address (the query string). Cloudflare states that this product does not collect or use visitors' personal data, does not use cookies or local storage for analytics, does not track people across websites, and does not try to recognise individuals by combining their IP address, browser details or other information. Cloudflare still receives ordinary network information such as IP address and browser details when it handles a request, as described above, but Web Analytics does not give us those details to identify individual visitors.

We use these overall statistics only to understand and improve this website, not for advertising, profiling, identifying visitors or making decisions about them. Under UK rules we rely on the statistical-purposes exception, which covers this limited use of website statistics. You may object at any time using the control below. This stores only a necessary preference cookie in your browser for one year.

Cloudflare Turnstile

We use Cloudflare Turnstile on the public order form to help protect our forms and service from automated abuse. When Turnstile runs, including in invisible mode, Cloudflare may process limited technical signals such as your IP address, encrypted-connection details, browser information and the details that identify our website to Turnstile to distinguish human users from bots and improve its bot detection. Turnstile does not access, store or transmit the form entries you provide to CarDiligence. For more information, see Cloudflare's Turnstile Privacy Addendum and Cloudflare's privacy and data-protection information .

How people reach the order form

As you follow links towards the order form, we carry a short note of how you arrived, such as Google or a partner link, and which public page you visited first. If you send a valid order request, we may save these notes with an internal request or order reference. This helps us understand which pages lead to orders and completed reports.

For this purpose, we do not add tracking cookies, save tracking information in your browser, create a number to identify you across visits, or record full referring web addresses or search terms. The notes may be incomplete or inaccurate and cannot tell us how many different people visited. Choosing the Web Analytics opt-out above also stops us recording these notes. We keep them for the operational log period listed below.

4. How long we keep information

• Incomplete or unpaid orders and assistant purchase quotes: 30 days.
• Completed orders, report snapshots and associated customer contact details: 365 days, unless longer retention is needed for a legal claim, chargeback, tax/accounting rule or unresolved complaint.
• Routine records used to run and protect the service: 90 days, with longer retention only for a documented security incident.
• Cloudflare states that Web Analytics keeps the full analytics measurements for seven days before reducing them to summaries based on a sample, and makes analytics available to us for the previous six months.
• Other Cloudflare website-delivery and security data is retained according to the enabled Cloudflare product, our account and plan settings, and Cloudflare's contractual obligations. We keep this data only for as long as needed to deliver and secure the service.
• Stripe and other processors keep their own records under their notices and legal duties.

These are the configured service defaults and retention criteria. A tested deletion and export process must be operational so they are applied in practice.

5. International transfers

Some companies that process information for us may store or access it outside the UK. Where UK adequacy regulations apply, including the UK Extension to the EU–US Data Privacy Framework where relevant, we may rely on them. Otherwise we use an appropriate safeguard such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, and carry out the required data-protection assessment and apply additional protections where needed. Cloudflare's Customer Data Processing Addendum incorporates the UK Addendum for relevant transfers. Contact us if you would like more information about, or a copy of, the safeguards relevant to your data.

6. Your rights

Depending on the circumstances, you can ask to see your information, have mistakes corrected, have it deleted, limit its use or receive a copy you can move to another service. You may also object to how it is used or make a complaint. You have a specific right to object when we rely on legitimate interests. Some rights have legal limits, such as when we must keep records. Contact [email protected] to make a request.

7. Cookies and similar technologies

Cloudflare Web Analytics uses a small browser script, but no analytics cookies or browser storage. The cardiligence_web_analytics_opt_out cookie is set only when you use the opt-out button above and is strictly necessary to remember that choice for one year. Cloudflare’s security tools may also set necessary cookies such as __cf_bm or cf_clearance when the relevant automated-abuse check is active. These help manage visits to the site, prevent fraud and protect the service; they are not used by us for advertising. We do not use advertising or profiling technologies. Stripe may use cookies on its hosted checkout under Stripe’s own notice. We will update this notice and obtain any consent required before enabling technology outside the statistical, security or other applicable UK exceptions.

8. Complaints

Please contact us first so we can investigate. You also have the right to complain to the UK Information Commissioner’s Office (ICO). You can complain through the ICO’s online complaint service or call 0303 123 1113. You can also write to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

9. Changes to this notice

We review this notice when the service or the law changes. The version date at the top shows when it was last updated. If a change would materially affect how we use information already collected, we will take reasonable steps to bring it to the attention of the people affected before the new use begins.