Privacy Policy

1. Introduction

Service Stamp Ltd (Company No. 17159900), trading as ServiceStamp ("we", "our", or "us"), with its registered office at Unit 5 Grahamstown Rd, Sedbury, Chepstow, NP16 7AD, is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our vehicle service history checking service at servicestamp.co.uk.

We are based in the United Kingdom and comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Service Stamp Ltd is registered with the UK Information Commissioner's Office (ICO) under registration number ZC148476.

2. Information We Collect

2.1 Information You Provide

When you use our service, we collect:

Email Address: For sending service history reports and order confirmations
Vehicle Identification Number (VIN): To retrieve service history data from manufacturer databases
Vehicle Registration Mark (VRM): Where you purchase a Vehicle History Check or Full Vehicle Check, to retrieve provenance data from Experian and government data sources (DVLA, DVSA), or where you run a free check or create a Digital Service Book
Payment Information: Processed securely by Stripe (we do not store your full card details)
Account and sign-in data: Your email address and the secure magic-link tokens we use instead of passwords
Digital Service Book content: The documents you upload (photos and scans of service books, invoices and receipts) and the service records you confirm or add manually
Reviews: The rating, comment and display name you submit when reviewing a report
Support and contact messages: Your name, email address and the content of messages you send us
Trade applications: Business name and address, company number, contact name, email, phone number and expected volume
Waitlist entries: Your email address and optional name when you join a product waitlist
Free check submissions: The registration you look up and, if you ask for an emailed copy, your email address and marketing choice

2.2 Automatically Collected Information

In our server request logs (used for security, abuse prevention and basic operation):

Browser and device information: IP address, browser type, device type, operating system
Free check abuse-prevention data: For free checks we store a hashed (pseudonymised) version of your IP address and your browser user agent to enforce fair-use limits, together with a snapshot of the result shown to you

Only if you give analytics consent (see Section 9):

Usage data: Pages visited, time spent on site, referring websites, UTM parameters
Analytics cookies: Google Analytics and Ahrefs Analytics cookies (see Section 9)

3. How We Use Your Information

3.1 Primary Purposes (Lawful Basis: Contract Performance)

To retrieve and generate your vehicle service history report
To deliver your purchased report via email
To process your payment securely
To provide customer support for your order
To operate your account, dashboard and sign-in links
To provide the Digital Service Book: storing your uploads, reading them with AI so you can review the proposed records, and displaying your confirmed records

3.2 Legal Obligations (Lawful Basis: Legal Compliance)

To comply with tax and accounting requirements
To respond to lawful requests from authorities
To prevent fraud and protect our service

3.3 Legitimate Interests (Lawful Basis: Legitimate Interest)

To improve our service and user experience using non-tracking signals (e.g. server logs, support enquiries)
To detect and prevent technical issues, abuse and fraud, including enforcing fair-use limits on free checks using hashed IP addresses
To include service records you have confirmed in your Digital Service Book, without your name or contact details, in vehicle history products about the same vehicle purchased by other customers, clearly labelled as owner-provided, and in anonymised, aggregated statistics that help us improve our products. The documents you upload are never shared or shown to anyone else

3.4 Consent (Lawful Basis: Consent)

To set analytics cookies (Google Analytics, Ahrefs) and analyse aggregated usage patterns, only if you accept analytics in the cookie banner
To send optional marketing emails, only if you opt in: by ticking the box at checkout, ticking the box when you email yourself a free check result, or enabling marketing consent in your account settings

You can withdraw consent at any time via the “Cookie preferences” link in the footer, or by toggling marketing consent in your account settings. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

4. Data Sharing and Third Parties

We work with trusted third-party service providers who process data on our behalf:

4.1 Essential Service Providers

Stripe (Payment Processing): Stripe Inc. processes all payments and stores card details securely. Stripe is PCI DSS Level 1 certified. See Stripe's Privacy Policy.
Authorized Manufacturer Data Providers: We work with authorized third-party data providers to retrieve official manufacturer service history data using your VIN. These providers have secure access to manufacturer databases and process VINs to access authorized dealership service records.
Experian (Vehicle History Check data): When you purchase a Vehicle History Check or Full Vehicle Check, we send the vehicle registration mark (VRM) to Experian in order to retrieve finance, write-off, stolen, mileage and other provenance data. We do not send your name, email or payment details to Experian. See Experian's Privacy Policy.
DVLA & DVSA (UK government data): Vehicle registration, tax, MOT and recall data is retrieved from DVLA and DVSA via authorised providers using the registration mark you supply.
Neon (Database Hosting): Your email, VIN/registration and report data are stored in a Neon Postgres database with encryption in transit and at rest, hosted on cloud infrastructure within the UK/EEA.
Cloudflare (Document Storage): If you use the Digital Service Book, the documents you upload (photos and scans of service books, invoices and receipts) are stored in Cloudflare R2 object storage, in a bucket restricted to the European Union, encrypted in transit and at rest. See Cloudflare's Privacy Policy.
Anthropic (AI Document Reading): If you use the Digital Service Book, the content of the documents you upload is sent to Anthropic PBC (USA) so its Claude AI can read them and propose service records for your review. This transfer takes place under UK GDPR safeguards (standard contractual clauses). Anthropic does not use this data to train its AI models, and retains API inputs only briefly for abuse monitoring before deletion. See Anthropic's Privacy Policy.
Resend (Email Delivery): Our transactional and marketing emails (report links, sign-in links, receipts, review requests) are sent through Resend, which processes your email address and the message content in order to deliver them. See Resend's Privacy Policy.
Vercel (Hosting): Our website runs on Vercel, which processes requests to serve pages and keeps short-lived server logs (including IP addresses) for security and operation. Vercel also sets the infrastructure cookies described in Section 9.1. See Vercel's Privacy Policy.
Upstash (Rate Limiting): We use Upstash Redis to enforce fair-use rate limits. It briefly holds hashed (pseudonymised) identifiers only, never your email address or vehicle details in readable form. See Upstash's Privacy Policy.

4.2 We Never Sell Your Data

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

5. Data Storage and Security

5.1 Where We Store Your Data

Our databases are hosted in secure data centers within the European Economic Area (EEA)
Documents you upload to the Digital Service Book are stored in an EU-restricted storage bucket. During AI reading, the content of those documents is processed by Anthropic in the United States under standard contractual clauses (see Section 4.1)
All data is encrypted both in transit (TLS/SSL) and at rest
Access to personal data is restricted to authorized personnel only

5.2 Security Measures

We implement industry-standard security measures including:

Encrypted data transmission (HTTPS/TLS 1.3)
Encrypted database storage
Regular security audits and monitoring
Secure authentication systems
Access controls and logging

6. Data Retention

We keep personal data only for as long as we need it for the purpose it was collected for:

Your account, email, vehicle identifiers and purchased reports: Kept for as long as we operate the service, so that the lifetime report access you purchased is honoured (see our Terms, Section 3), or until you delete individual items or your account. Deleting your account removes your reports immediately and permanently
Payment and order records: Retained for 7 years to comply with UK tax and accounting requirements. If you delete your account, these records are kept with personal details removed
Digital Service Book uploads and records: Kept for as long as you keep them. Deleting a document, a vehicle, or your account removes the stored files and their records from our systems, including from future inclusion in the vehicle history products and aggregated statistics described in Section 3.3
Free check records: Anonymised after 24 months: the email address and device information are removed, leaving only non-identifying lookup statistics
Waitlist entries: Kept until the product launches or you ask us to remove you
Support and contact messages: Kept for up to 24 months after the conversation ends
Trade application details: Kept for the life of the trade account, or up to 24 months if the account is not activated
Reviews: Kept while the related report exists
Website usage data: Retained for up to 24 months for analytics purposes

You can request deletion of your personal data at any time (see Section 7 - Your Rights).

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

7.1 Right of Access

You can request a copy of all personal data we hold about you. Contact us via our contact form to make a Subject Access Request.

7.2 Right to Rectification

You can request correction of inaccurate or incomplete data.

7.3 Right to Erasure ("Right to Be Forgotten")

You can request deletion of your personal data. Note: We may be required to retain certain data for legal compliance (e.g., tax records for 7 years).

7.4 Right to Data Portability

You can request your data in a machine-readable format (e.g., JSON or CSV).

7.5 Right to Object

You can object to processing based on legitimate interests. Objecting to the inclusion of your confirmed service records in other customers' reports (Section 3.3), or to analytics, does not stop us providing your service: deleting a record, a vehicle or your account removes your records from future inclusion. Some processing, such as fraud and abuse prevention, is necessary to run the service and may continue where we have compelling legitimate grounds.

7.6 Right to Restrict Processing

You can request temporary suspension of data processing in certain circumstances.

7.7 Right to Withdraw Consent

Where processing is based on consent (analytics cookies, marketing emails), you can withdraw it at any time as described in Section 3.4, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us via our contact form.

We will respond to your request within one month as required by UK GDPR. We do not carry out automated decision-making that produces legal or similarly significant effects about you.

8. Children's Privacy

Our service is not intended for children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

9. Cookies and Tracking

We use cookies and similar technologies (including localStorage and sessionStorage) to operate the site and, with your consent, to understand how it is used. On your first visit you'll see a cookie banner — non-essential cookies are not set until you accept them. You can change your choice at any time via the link in the footer.

9.1 Strictly necessary (no consent required)

These are required for the service you've requested and cannot be switched off:

Session and authentication cookies — to keep you logged in and maintain your browsing session
Security cookies — CSRF protection and abuse prevention
Consent storage — ss_consent_v1 in localStorage, records your cookie choices so we don't re-prompt
Stripe (checkout only) — __stripe_mid, __stripe_sid set by Stripe on the checkout page for fraud prevention
Vercel infrastructure cookies — bot-challenge and routing cookies set by our hosting provider

9.2 Analytics (consent required)

Only set if you accept analytics in the cookie banner. Help us understand how the site is used so we can improve it:

Google Analytics 4 — _ga, _ga_*, _gid, _gat_*. Retained up to 2 years (default 14 months for event data). Provided by Google LLC; data may be transferred outside the UK/EEA under appropriate safeguards. See Google's Privacy Policy and the GA opt-out browser add-on.
Ahrefs Analytics — first-party cookies set by analytics.ahrefs.com for aggregate traffic measurement. See Ahrefs' Privacy Policy.
UTM parameter tracking — utm_params in sessionStorage, used to attribute traffic sources to GA events. Cleared automatically when the browser tab closes.

9.3 Marketing

We do not currently set marketing or advertising cookies. The category is reserved in the cookie preferences modal so we can offer it transparently if we add any in future.

9.4 Withdrawing or changing consent

Open at any time to change or withdraw consent. Withdrawing analytics consent stops new cookies being set; existing analytics cookies are cleared on your next page load.

10. International Data Transfers

We primarily store data within the UK/EEA. If data is transferred outside the UK/EEA (e.g., to Stripe's US servers), we ensure:

Transfers are made to countries with adequate data protection (as determined by the UK government)
Or appropriate safeguards are in place (e.g., Standard Contractual Clauses)

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes by:

Updating the "Last updated" date at the top of this page
Sending an email notification if the changes materially affect your rights

12. Complaints and Regulatory Authority

If you have concerns about how we handle your personal data, you can:

Contact us directly via our contact form
Lodge a complaint with the UK Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Helpline: 0303 123 1113
- Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

13. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

Email: hello@servicestamp.co.uk
Post: Service Stamp Ltd, Unit 5 Grahamstown Rd, Sedbury, Chepstow, NP16 7AD
Website: servicestamp.co.uk