Privacy policy

Last updated 17 July 2026.

CarKept (https://www.carkept.co.uk) is an independent UK service that publishes free MOT history for every UK car and lets owners build a verified maintenance record for their own vehicle. This policy explains what personal data we collect, why, how long we keep it, who we share it with, and the rights you have over it under UK data protection law (the UK GDPR and the Data Protection Act 2018).

We are the data controller for the personal data described in this policy. You can contact us about anything in it at hello@carkept.co.uk.

The short version

Most of what CarKept shows is not personal data at all — it is MOT test data about vehicles, published by the DVSA under an open licence. We only hold personal data about you if you do one of a small number of specific things: create an account and claim a car, add a maintenance record, buy a report, or subscribe to a free reminder email. We never sell or rent personal data to anyone, we never show what you paid for a repair to anyone but you, and every marketing-adjacent email (the free reminders) requires you to opt in twice — once by submitting the form, once by clicking a confirmation link — and can be cancelled with one click, no login required.

What data we collect, and why

Vehicle and MOT data.Registration, make, model, colour, fuel type, and MOT test history come from the DVSA’s public MOT History API and anonymised open dataset, licensed under the Open Government Licence v3.0. This is public information about a vehicle, not personal data about a named individual, unless and until an owner claims that vehicle and links their account to it.

Account data.If you create an account to claim a car or add records, authentication (email address, password or social sign-in, session tokens) is handled entirely by our authentication provider, Clerk — we never see or store your password. We store your Clerk user ID as the key that links your account to the cars you’ve claimed and the records you’ve added.

Claim evidence. To claim a car, you provide evidence that you own or possess it — a photo of your V5C logbook, or a photo of the car with its number plate and a one-time code. These photos are stored privately and are only ever used to verify the claim.

Maintenance records and documents. When you add a record, you can attach the original invoice or receipt as evidence. What was done and which garage did it is only ever shown to you and to a paid report buyer for that vehicle — never to a free visitor. What you paid is a separate, stricter category again: the cost on an invoice is never shown to anyone except the person who uploaded it — not in reports, not in summaries, not to other owners of the same car, not to us for any purpose beyond storing it securely. This is a product-defining rule, not a setting.

Payment data.Paid reports are processed by Stripe. We never see or store your card details — Stripe handles payment entirely on its own secure infrastructure. We keep a record of the transaction (email address, amount, and Stripe’s reference for it) so we can grant access to what you paid for and provide receipts or refunds if needed.

MOT and service reminder subscriptions. If you subscribe to a free MOT or service reminder, we store the vehicle registration, the email address you provide, and whether you have confirmed the subscription (via a one-click link we email you) — nothing else, and no account is required. If you unsubscribe, using the one-click link in any reminder email, the subscription record is deleted, not just marked as inactive.

Garage waitlist. If your garage joins the waitlist for self-serve garage accounts, we store the business name, email address and postal address you provide. We use it to email you when accounts open, and to post a sticker pack if your garage is approved — nothing else, and it is never shown publicly.

Technical data. Like most websites, our servers log IP addresses briefly to prevent abuse of the free vehicle lookup (a simple rate limit — no more than a fixed number of lookups per connection per hour). This is not linked to any account and is not retained as a running log of your activity.

Cookies and analytics

If you sign in, our authentication provider (Clerk) sets a strictly necessary session cookie so you stay signed in — this cookie does not track you across other websites. We use Vercel Web Analytics for aggregate traffic statistics (which pages are visited, roughly how often); it is a cookieless, first-party analytics product that does not build an individual profile of you or track you across sites. We do not use advertising cookies, retargeting pixels, or any third-party marketing trackers.

Our legal basis for processing

We rely on different legal bases depending on what we’re doing with your data: showing you a Kept Report you’ve paid for, or letting you claim and manage a car, is processing necessary to perform our contract with you. Preventing abuse of the free lookup tool (the rate limit) is a legitimate interest, one that’s proportionate and doesn’t override your own rights. Sending you a free MOT or service reminder is based on your explicit, double-confirmed consent, which you can withdraw at any time with one click.

Who we share data with

We use a small number of specialist providers to run the service, each acting as a data processor on our instructions — none of them are permitted to use your data for their own purposes:

Amazon Web Services (AWS), in the UK region (eu-west-2, London) — our database, file storage, email sending, and AI-assisted invoice reading all run within our own AWS account in this region. Clerk — authentication and account management. Stripe — payment processing for paid reports. Vercel — application hosting and cookieless analytics.

We do not sell, rent, or otherwise trade personal data to anyone, for any purpose. We are not affiliated with, and do not share data with, the DVSA or DVLA beyond reading their public MOT data — CarKept is an independent service and is not affiliated with, endorsed by, or operated by the DVSA, DVLA, or any government body.

International transfers

Our own infrastructure (database, file storage, email) runs entirely in the UK (AWS eu-west-2, London). Some of our processors (for example, aspects of Clerk’s or Stripe’s own infrastructure) may process data outside the UK. Where that happens, we rely on the provider’s standard contractual clauses or equivalent safeguards recognised under UK data protection law.

How long we keep data

Vehicle MOT data is kept for as long as we display it, refreshed periodically from the DVSA. Maintenance records you add are kept permanently as part of the vehicle’s history — this is the point of the service — but records are never edited away; a correction is logged alongside the original, not a silent overwrite. Claim evidence photos are kept for as long as needed to support the claim and resolve any dispute about it. MOT and service reminder subscriptions are kept only until you unsubscribe, at which point the record is deleted, or until the reminder has served its purpose (a service reminder is a single, one-off email). Garage waitlist entries are kept until self-serve accounts open and your garage’s status is resolved, or until you ask us to remove them. Payment records are kept as long as required for accounting and tax purposes.

Your rights

Under UK data protection law, you have the right to: access the personal data we hold about you; have inaccurate data corrected; have data deleted where there’s no good reason for us to keep it; restrict or object to certain processing; receive your data in a portable format; and withdraw consent at any time (for reminders, with one click). To exercise any of these, email hello@carkept.co.uk. If you’re not satisfied with our response, you have the right to complain to the UK’s independent regulator, the Information Commissioner’s Office (ICO).

Security

Data is stored on Amazon Web Services infrastructure with encryption in transit and at rest. Access to systems that hold personal data is limited to what each part of the service actually needs — for example, the automated job that reads DVSA data has no access to payment records, and the part of the system that stores what an invoice cost is never read by anything that renders a public page. No method of transmission or storage is 100% secure, but we take reasonable technical and organisational steps to protect your data.

Children’s privacy

CarKept is not directed at children and we do not knowingly collect personal data from anyone under 13.

Changes to this policy

We’ll update this page if what we do with personal data changes, and update the “last updated” date at the top. For significant changes, we’ll take reasonable steps to let account holders know.

Contact us

Questions about this policy or how we handle your data: hello@carkept.co.uk.

See also our terms of use and data methodology.