Privacy notice
Last updated 14 October 2026
The short version
We collect what we need to run checks, take payment and send the emails you ask for, and we count visits to the site ourselves, without cookies. We do not sell your personal data, and we do not receive the names or addresses of vehicle keepers. We use strictly necessary cookies, and Google Analytics only if you agree to it. We use no advertising cookies.
Who we are
AI Programs Holdings Ltd, trading as Vettly, is the controller of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are registered in England and Wales with company number 17516543, and our registered office is 128 City Road, London, EC1V 2NX.
For anything about your personal data, including requests to use your rights, email hello@vettly.co.uk or use our contact form.
What we collect
| Information | What it includes |
|---|---|
| Account details | Your email address, your name if you give it, your password (stored only as a salted scrypt hash, never the password itself), when you created your account and last signed in, and whether you have asked for marketing emails. |
| Sign-in sessions | A hash of your session token (never the token itself), your IP address and your browser user agent. One-use sign-in and password reset links are also stored only as hashes. |
| Vehicle lookups | The registrations you look up, when, which page you searched from, whether you used the plate scanner, whether a record was found, and a one-way hash of your IP address, which we use to prevent abuse. If you are signed in, the lookup is linked to your account. |
| Orders and payments | The product, amount and payment status, your email address, the registration you asked us to check, Stripe payment references, and a record of events such as payments and refunds. We never see or store your full card details. |
| Checks | The checks you have bought or added with a code, how many are left and when they expire. |
| Reports | The contents of the reports you buy, linked to your account and email address. |
| Reminders | The registration, the make and model, whether it is an MOT or tax reminder, the due date and when we last sent a reminder. |
| Messages to us | Your name, email address, the topic, any registration you mention and your message. |
| Emails we send | A copy of each email we send you, with the address, subject, content, type and delivery status, kept in an outbox log. |
| Plate scanner images | Sent to our server to read the registration, and not stored. An image may be processed by a plate recognition provider acting for us, only to read the plate. |
| Visit statistics (no cookies) | Our own visit counter records the pages you view (including the registration on a vehicle check page), the website that sent you here and the page on it that linked to us (without anything after a question mark in its address, such as search terms), any campaign tags in the link, your type of device, browser and operating system, how long each page was on screen, how far down it you scrolled, and how quickly pages loaded. If you look up a vehicle or buy something during the same visit, the statistics are linked to that lookup or order. To tell visits apart we use an anonymous code made from your IP address and browser details mixed with a random value that we replace every day, so the code changes every day and we do not keep your IP address for this. It uses no cookies and stores nothing on your device. Private links to reports, sign-in and password reset pages are removed before anything is saved. |
| Site analytics, only if you agree | If you accept analytics cookies, Google Analytics records how the site is used: the pages you view, roughly how long you stay, your device, browser and screen size, the town or region your connection comes from, and how you found us. Before a page address is sent, we remove registrations and private links to reports and sign-in pages. |
Registration numbers and vehicle data
A registration number or vehicle record is generally not personal data on its own. It can become personal data when it is linked to a person, for example when you look up a vehicle while signed in, set up a reminder or buy a report. We treat lookups and reports linked to your account as personal data.
We do not receive the names or addresses of keepers. A full history check shows how many keepers a vehicle has had and when it changed hands, not who they were.
How we use your data
| Why we use it | Lawful basis |
|---|---|
| To provide free checks, full history checks, reports and your account | Contract: we need it to provide the service you ask for |
| To take payment, send receipts and handle refunds | Contract |
| To keep order and payment records for accounting and tax | Legal obligation: we must keep these records, and we keep them for 6 years |
| To keep Vettly secure, prevent fraud and abuse, and limit how many lookups can be made | Legitimate interests: keeping the service safe, available and fair, and protecting the records we use from misuse |
| To send the MOT and tax reminders you set up | Contract: you can switch reminders off at any time in your account or with the link in each reminder |
| To send service emails, such as receipts, report links, sign-in links and password resets | Contract |
| To reply to your messages and complaints | Legitimate interests: answering you and putting things right |
| To send occasional car buying tips and offers | Consent: only if you tick the box when you register or in your account settings, and you can withdraw it at any time |
| To count visits and see how the site is used, so we can improve it (our own visit statistics, without cookies) | Legitimate interests: understanding and improving the site. The statistics use an anonymous code that changes every day, we do not use them to identify you or to contact you, and you can object at any time |
| To understand how the site is used and improve it (Google Analytics) | Consent: only if you accept analytics cookies. You can change your mind at any time with the Cookie settings link at the foot of every page |
Who we share it with
We share personal data only with the service providers who help us run Vettly, and only what each one needs:
- Stripe processes card payments and receives your email address and card details. It acts partly on our behalf and partly as an independent controller of some payment data, for example to prevent fraud and meet its own legal obligations. Stripe's privacy policy explains how it uses data.
- Our email delivery provider sends our emails, so it receives your email address and the content of each email.
- Our hosting provider runs the servers that hold our database. Our servers are located in the United Kingdom.
- Our licensed vehicle data supplier produces full history checks. It receives the registration number only, and nothing about you.
- A plate recognition provider may process plate scanner images for us, only to read the registration.
- Google provides Google Analytics, which we use only if you accept analytics cookies. It receives the details listed under site analytics above, never your name, email address, the registrations you look up or your report links. Google Analytics 4 does not log or store IP addresses. Google's privacy policy explains how Google uses data.
To run a free check, we send the registration number to the DVLA and the DVSA. We do not send them any information about you.
We may also disclose personal data where the law requires it, or where it is needed to establish, exercise or defend legal claims. If our business is ever sold or reorganised, personal data may pass to the new owner, who would have to keep using it in line with data protection law.
Transfers outside the UK
Our servers are in the United Kingdom. Stripe, and Google if you accept analytics cookies, may process data outside the UK, including in the United States. When they do, the transfer is protected by appropriate safeguards, such as UK adequacy regulations or the UK International Data Transfer Agreement or Addendum. Contact us if you would like more information about these safeguards.
How long we keep it
| Information | How long we keep it |
|---|---|
| Your account, including reports, checks, reminders and lookups made while signed in | Until you delete your account or ask us to, or after 3 years without any activity on it |
| Order and payment records | 6 years, even if you delete your account |
| Lookups not linked to an account | 12 months |
| Sign-in sessions | Up to 60 days, or until you sign out |
| Emails we send (outbox log) | 12 months |
| Messages to us | 2 years |
| Plate scanner images | Not stored |
| Visit statistics (our own, without cookies) | 25 months |
| Google Analytics data (only if you accept analytics cookies) | 14 months, then deleted by Google |
Your rights
Under UK data protection law, you have these rights:
- Access: ask for a copy of the personal data we hold about you.
- Rectification: ask us to correct data that is wrong or incomplete.
- Erasure: ask us to delete your data.
- Restriction: ask us to limit how we use your data.
- Objection: object to how we use your data where we rely on legitimate interests, and to marketing at any time.
- Portability: receive the data you gave us in a format you can take to another service.
- Withdrawing consent: where we rely on your consent, such as for marketing emails, you can withdraw it at any time.
You can update your name and marketing choice, set a password or delete your account yourself in your account settings. To change your email address, contact us.
To use any of your rights, email hello@vettly.co.uk. We may ask you to confirm your identity. We will respond within one month, and there is normally no charge. Some rights have limits: for example, we must keep order and payment records for 6 years even if you ask us to delete your account.
If you are unhappy with how we have handled your data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk, telephone 0303 123 1113.
Automated decisions and the Vettly Score
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you. The Vettly Score is worked out automatically, but it is a summary of the records about a vehicle, not a decision about a person.
How we keep your data safe
We protect your data with measures suited to what we hold, including encrypted (HTTPS) connections, passwords stored only as salted scrypt hashes, session tokens and sign-in links stored only as hashes, and access to personal data limited to the people who need it to run Vettly. No system is completely secure, but if a personal data breach is likely to put your rights at high risk, we will tell you.
Cookies
We use strictly necessary cookies to keep you signed in and to complete your checkout. We use Google Analytics cookies only if you accept them, and no advertising cookies. Our cookie policy has the details.
Changes to this notice
We may update this notice from time to time. The date of the latest version is shown on this page. If we make a significant change, we will tell you, for example by email or with a notice on the site.