Privacy policy

Who this policy covers

PlateScout helps people search DVLA auction catalogues for registrations that are relevant to their search terms. This policy covers visitors, account holders, newsletter subscribers and paying members.

Data we use

• Account details: email address, name, account dates and authentication identifiers.
• Product choices: saved search terms, search-term locking cycles, manual search activity, followed registrations, private shortlist notes and budgets, match feedback and notification preferences.
• Service communications: the subject, content, delivery status and read state of emails sent through the service.
• Membership records: tier, subscription status, billing periods, Stripe customer/subscription references, invoice/payment references and payment outcomes. Card details are handled by Stripe and are not stored by PlateScout.
• Operational data: task results, security/audit events, IP address where collected for abuse prevention, technical request logs, and privacy-restricted error diagnostics.

Why we use it

We process account, search, notification and membership data to provide the service and perform our contract with you. We use operational and security data for our legitimate interests in protecting, maintaining and improving the service. Optional product analytics operates only after your choice in the analytics banner or Data choices page. We use optional email preferences as your direction about product notifications. We retain required financial records to meet legal and accounting obligations.

Who processes it

Supabase provides authentication and database services. Stripe processes subscriptions and payments. Resend delivers customer email and returns delivery events such as bounces and complaints. Slack receives restricted operational alerts that do not include customer email content. PostHog receives restricted application-error diagnostics when configured. If you opt in to optional analytics, PostHog also receives sanitised route views and allowlisted product events; PlateScout does not send customer identity, request bodies, headers, query strings, search terms, registrations, message content, session replay or broad click/form autocapture. UptimeRobot may receive public service and worker-heartbeat availability signals. Hosting and network providers process the minimum technical data needed to run the application. DVLA auction and official historic-sale data describes registrations and auction outcomes rather than PlateScout users.

Retention and deletion

Active account data is kept while the account is in use. An account deletion request has a seven-day cancellation period. When processed, saved search terms, follows, preferences and other product data are erased, message content is redacted and the authentication account is removed. Payment records required for accounting, tax, disputes and fraud prevention may be retained for up to seven years and are detached from the deleted application profile. Backups expire under the documented backup-retention schedule.

Your choices and rights

You can change optional auction email preferences, choose or withdraw optional analytics from the Data choices page, download a portable JSON copy of your account data, and request account deletion from the Profile page. Depending on applicable law, you may also ask for access, correction, restriction, objection or portability, and complain to the UK Information Commissioner’s Office.

Security and international processing

We use access controls, row-level database policies, audit records and encrypted HTTPS connections in production. Some processors may handle data outside the UK; their contractual and legal transfer safeguards apply.

Contact

Questions and privacy requests can be sent to privacy@platescout.co.uk. Please do not email passwords or payment card information.

Also read the Terms of Service and Cookie information.