1. Who we are
Before You Buy A Car ("BYBAC", "we", "us" or "our") is a UK vehicle-check web app operated by [LEGAL BUSINESS NAME], trading as Before You Buy A Car.
For UK data protection law, [LEGAL BUSINESS NAME] is the controller of the personal data described in this policy.
Business address: [BUSINESS ADDRESS]
Company number: [COMPANY NUMBER, IF APPLICABLE]
Contact email: support@beforeyoubuyacar.co.uk
2. What this policy covers
This policy applies when you visit BYBAC, create or access an account, generate a vehicle report, save a report in My Garage or send us feedback.
3. Personal data we collect
Information you provide
We may collect information you enter or select while using BYBAC, including an email address, vehicle registration number, mileage, transmission, drivetrain, completed service items, advisory checks, visible damage, amendments and negotiation choices.
Authentication data
If you sign in, we use email-based authentication provided through Supabase. We may process your email address, account identifier, login timestamps, authentication tokens, session information and security-related records. You should keep your email account secure because access to it may allow access to your BYBAC account.
Vehicle-report data
We may collect, generate, store or cache information connected with vehicles you search for or save. This can include registration numbers, official-source vehicle and MOT information, advisories, your selections and amendments, servicing estimates, visible damage selections, model-risk information and negotiation guidance.
A vehicle registration number usually identifies a vehicle rather than a person. It may become personal data where it can be linked to an identifiable individual, such as an account holder, vehicle owner or regular user. We treat linked vehicle-report data accordingly.
Feedback data
If you send feedback through our About Us page, we collect your email address, feedback message, the page URL, your browser user-agent information and the time of submission. Please do not include unnecessary personal information about yourself or anyone else.
Technical data
When you use BYBAC, we and our service providers may receive limited technical information needed to operate, secure and troubleshoot the app. This may include IP address, browser and device type, operating system, timestamps, requested pages, error logs and security or diagnostic information.
Cookies and browser storage
We use browser storage and may use cookies where needed for essential features, including account sessions and saved-report functions. See our Cookie Policy.
4. How and why we use personal data
| Purpose | Personal data | UK GDPR lawful basis |
|---|---|---|
| Provide vehicle reports and requested app features | Vehicle-report data and user selections | Performance of a contract or taking steps at your request before entering into a contract |
| Create and manage your account and My Garage | Email address, authentication data and saved reports | Performance of a contract |
| Keep reports available and recover recent amendments | Saved, cached and draft vehicle-report data | Performance of a contract and our legitimate interest in providing a reliable service |
| Respond to feedback and enquiries | Email address, message and submission details | Our legitimate interest in responding to users and improving BYBAC |
| Secure, maintain and troubleshoot BYBAC | Authentication and technical data | Our legitimate interest in operating a secure and reliable service |
| Meet legal obligations and handle claims | Relevant account, report, feedback or technical data | Legal obligation or our legitimate interest in establishing, exercising or defending legal claims |
We do not currently use optional analytics in the BYBAC app. If this changes, we will update this policy and obtain consent where required.
5. Where vehicle information comes from
Vehicle information may originate from official sources, including GOV.UK or DVSA-related sources, and from additional enrichment sources. Source information may be combined with your selections to generate guidance and estimates.
6. Who we share personal data with
We use service providers to operate BYBAC. They may process personal data only as needed to provide their services and subject to appropriate arrangements.
| Provider | Purpose |
|---|---|
| Supabase | Email-based authentication, database services and storage of account, feedback, saved-report and related app data. |
| Make.com | Processing webhook requests and passing vehicle-report data between systems. |
| jsDelivr and frontend asset providers | Delivering software assets required to display and operate parts of the website. |
| Google Fonts | Delivering the Manrope font used by parts of the website. Your browser may send technical information, such as your IP address, when requesting the font. |
| [WEBSITE HOSTING PROVIDER] | Hosting and delivery of the website. |
We may also disclose information where required by law, to protect our legal rights or in connection with a business sale or restructuring subject to appropriate safeguards. We do not sell personal data.
7. International transfers
Some providers or their subprocessors may process personal data outside the UK. Where a restricted international transfer takes place, we use an appropriate safeguard, such as UK adequacy regulations or approved contractual safeguards, and complete any assessment required by law.
8. How long we keep personal data
We keep personal data only for as long as reasonably necessary for the purposes described above, including legal, security and dispute-handling requirements.
| Data category | Retention period |
|---|---|
| Account and authentication data | While your account is active and for [RETENTION PERIOD] after closure or inactivity |
| Saved My Garage reports | Until deleted by you or for [RETENTION PERIOD] after account closure or inactivity |
| Unsaved or cached vehicle reports | [RETENTION PERIOD] |
| Feedback messages | [RETENTION PERIOD] |
| Technical and security logs | [RETENTION PERIOD] |
We may retain anonymised information that no longer identifies an individual.
9. Security
We use reasonable technical and organisational measures designed to protect personal data. These may include access controls, authentication safeguards, secure transmission and restricted access to production systems. No online service can be completely secure.
10. Your rights
Depending on the circumstances, you may have the right to ask us to:
- give you access to your personal data;
- correct inaccurate personal data;
- delete personal data;
- restrict how we use personal data;
- stop processing based on legitimate interests;
- provide certain personal data in a portable format; and
- honour a withdrawal of consent where processing relies on consent.
To exercise a right, email support@beforeyoubuyacar.co.uk. We may need to verify your identity.
11. Complaints
Please contact us first at support@beforeyoubuyacar.co.uk so we can try to resolve your concern.
You can also complain to the Information Commissioner's Office (ICO). Details are available at ico.org.uk/make-a-complaint/data-protection-complaints/.
12. Changes to this policy
We may update this policy when our service, providers or legal obligations change. We will publish the revised version on this page and update the date above.