Privacy Policy

1. Who is the data controller

The data controller is Worthify, operated by Worthify Ltd (Company No. SC892241), registered address: Unit 08, Flexspace / Glasgow Business Park, Springhill Parkway, Baillieston, Glasgow, G69 6GA. ICO registration number: C1956536.

For data-protection enquiries: support@worthify.co.uk.

2. What data we collect

a) Information you give us

• UK vehicle registration — required to fetch the MOT history from DVSA
• VIN (optional) — used to verify it matches the registration (cloned-car detection)
• Asking price (optional) — used to evaluate whether the price is fair
• Email address — only if you contact us for support or a refund

b) Information we collect automatically

• IP address — used for abuse prevention (rate limiting) and security
• Language preference — stored in your browser's localStorage
• Stripe session ID — passed via URL after checkout return

c) Information from Stripe

• Payment status, amount, currency, transaction date — we do NOT store your card details

3. Why we process your data (legal basis)

• Performance of contract (Art. 6(1)(b) UK GDPR) — to deliver the report you ordered
• Legitimate interests (Art. 6(1)(f)) — abuse prevention, service security, improving AI model quality
• Legal obligation (Art. 6(1)(c)) — retaining transaction records for UK accounting purposes (6 years)

4. Who we share data with

• DVSA (UK government agency) — we send the registration to retrieve the MOT history
• NHTSA vPIC (US public government database) — we send the VIN for decoding (only if you provide one)
• Stripe Payments Europe Ltd — payment processing (separate data controller)
• AI providers (OpenAI, Anthropic, Google) via Emergent — vehicle technical analysis; we do not send personally identifiable information about you, only anonymous vehicle technical data
• MongoDB Atlas (UK / EU region) — database where we cache analysis results
• Pexels — stock vehicle imagery (they only receive search parameters, e.g. "audi q7")

We do not sell or rent your data to third parties for marketing.

5. International transfers

Some of our processors (OpenAI, Anthropic — USA; Pexels) process data outside the UK/EEA. Transfers rely on the Standard Contractual Clauses approved by the UK ICO and European Commission.

6. How long we keep data

• Vehicle analysis results — cached indefinitely keyed by (registration + language + asking price) for fast re-display. You may request deletion (see point 7).
• Payment records — 6 years (UK accounting obligation)
• Server logs (IP, response times) — 90 days
• VIN decode cache — indefinitely (VIN identifies the vehicle, not you)

7. Your rights (UK GDPR)

You have the right to:

• Access — request a copy of the data we hold about you
• Rectification — correct inaccurate data
• Erasure ("right to be forgotten") — we will delete your data except where we are legally required to keep it (e.g. invoices)
• Restriction of processing
• Data portability — receive your data in JSON format
• Object to processing based on legitimate interests
• Lodge a complaint with the supervisory authority — in the UK that's the Information Commissioner's Office (ICO)

Send requests to: support@worthify.co.uk. We respond within 30 days.

8. Security

We use HTTPS encryption, environment-variable secret management, database isolation, and error monitoring. Payments are processed by Stripe — PCI-DSS Level 1 certified.

9. Cookies

Worthify uses only essential cookies / localStorage for site functionality (saving the current analysis, language, unlock status). Details in our Cookie Policy.

10. Children

Worthify is not directed at users under 18. We do not knowingly collect data from children.

11. Changes to this policy

Updates are published at worthify.co.uk/privacy. Last updated: 8 February 2026.