Privacy

Service Book is operated by Road & Race Ltd (the “controller” under UK GDPR). All production data is stored in AWS eu-west-2 (London). Questions: privacy@service-book.co.uk.

• Account data — email address, and optionally your name and phone number. We use one-time email codes, so we never hold a password.
• Vehicle data — registration, VIN, DVLA/DVSA records and the service stamps recorded against your vehicles.
• Usage data — hashed IP addresses on share-link views and plate lookups, used solely for abuse prevention and view counts.

Public plate lookups show a privacy-safe summary only: make, model, MOT status and stamp count — never keeper identity. Shared links show what the owner chose to share (full history or summary), described as “Keeper 2 of 3”, never by name. Share links are revocable at any time and can carry expiry dates and view limits.

• Share-link view records — 13 months.
• Plate-lookup records — 24 months.
• Audit events — 6 years (legal and dispute obligations).
• Documents — until you delete them, or 12 months after a vehicle transfer for detached personal documents.

You can access, export and correct your data from your account settings, and request erasure at any time. Erasure anonymises your account and deletes personal documents; service stamps and keeper positions persist pseudonymously, because vehicle history is about the vehicle — this is our documented legitimate-interest basis, and it is exactly what makes the history trustworthy for the next keeper.

You also have the right to complain to the ICO (ico.org.uk).

DVLA/DVSA (vehicle record lookups), Stripe (workshop billing — we never see card numbers), Resend (transactional email), and AWS (hosting, London region). We do not sell personal data. Ever.