Skip to main content

Privacy Policy

Last updated: October 2026

This privacy policy explains how v55-5 ("we", "us", "our") collects, uses, stores, and protects your personal data when you use our website at v55-5.com (the "Service"). We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller

The data controller responsible for your personal data is V55/5. If you have any questions about how we handle your data, you can contact us at help.v55.5@gmail.com.

2. What Data We Collect

We collect and process the following categories of personal data:

  • Form inputs: Vehicle details, component or replacement-part details, and keeper or applicant details that you provide when completing a supported V55/4, V55/5 or V627/1 form.
  • Email address: Used to deliver your access link, payment receipts, and service communications.
  • Payment metadata: Transaction identifiers, amounts, payment status, purchased form type, an opaque case identifier and, when available, an approximate IP-derived country code processed through Stripe. The country code is used in internal payment alerts. We do not store your full card details.
  • Usage analytics: Pseudonymous product milestones such as entering the site, opening individual form pages, creating a registration case, completing readiness, starting the form, using an assistant application review, beginning checkout, paying, and generating the PDF. An opaque browser-session identifier is linked to the anonymous case identifier when a new case is created so we can measure which entry pages lead to completed journeys. With optional analytics consent, we also record the referring website host and allowlisted campaign labels; we do not record referring search queries, full referral URLs or private access-link tokens. Assistant milestones may include plan tier, ready/not-ready verdict, confidence level and blocker count. Readiness milestones include the four anonymous intake answers — registration history, vehicle type, import status and keeper region (Great Britain or Northern Ireland) — and, when known, whether the vehicle was previously UK-registered and a coarse import origin (EU, non-EU or Isle of Man). These records do not contain your form answers, VIN, keeper details, email address, conversation text or uploaded documents.
  • IP addresses: Collected for security, fraud prevention, and analytics purposes. Our hosting provider also supplies an approximate country derived from your IP address for internal operational alerts; this describes your browsing location rather than your nationality or residence.
  • Device and browser information: Browser type, operating system, screen resolution, and consented interaction/session-replay data collected through analytics. The V55 form workspace is explicitly masked from Microsoft Clarity recordings.
  • Vehicle documents you choose to upload (optional): If you use the optional “auto-fill from your documents” feature, the vehicle document you upload (such as a Certificate of Conformity, foreign registration document, IVA/MSVA certificate or purchase invoice) is processed transiently to read vehicle data from it. See section 5b below. We do not accept identity documents (passports, driving licences, utility bills) through this feature.
  • Assistant conversations and action plans (optional): If you use the Import Assistant, we process the messages and vehicle documents you choose to send, a limited set of non-personal form fields, tool results, saved ready/not-ready action plans, and pseudonymous usage records. Keeper details, VIN, engine number and payment credentials are not added to the assistant's form context.

Vehicle checks and MOT reminders

When you request a vehicle check, we send the registration to DVLA and/or DVSA to retrieve the available government record. Lookup results are not stored in a vehicle-history database by this service. We use short-lived IP rate limits to protect the service.

If you request an MOT reminder, we store your email address, registration, recorded expiry date, request and confirmation times, and delivery state in Supabase. We use Resend to send a confirmation email and the single reminder you requested. Reminders activate only after you confirm your email; this consent does not subscribe you to marketing. Cancellation deletes the reminder details. Unconfirmed requests are deleted by the daily cleanup after 48 hours; other reminder records are deleted seven days after the recorded expiry, on the next successful daily cleanup. The email provider may retain delivery records under its own retention policy.

We measure tool usage through consent-controlled analytics using tool names, outcomes and timings. Operational monitoring records provider health, aggregate counts and email delivery status. Alerts contain no registrations, email addresses or signed links. Operational alert and webhook replay records are kept for seven days; delivery records are deleted with the reminder.

Import estimate emails

If you choose “Email me this estimate”, we store your email address, calculator inputs, request time and delivery state in Supabase for up to 30 days, then delete them on the next successful daily cleanup. Resend sends your requested estimate. Its return link contains the calculator inputs, so share it only if you want to share those figures. Reopening the link recalculates the inputs using the rates available at that time.

The optional registration follow-up requires a separate opt-in and confirmation from your estimate email within 48 hours. We record the consent wording, version, request and confirmation times, and send one follow-up about three days after the request, on the next successful daily run. This is not a newsletter subscription. Use the cancellation link in your email at any time. A reply, purchase, cancellation or delivery failure stops pending follow-ups. Replies are forwarded to our support inbox so we can answer your question.

After removing the estimate, we retain an email-address digest to honour cancellations and delivery suppressions; it is not used to send marketing. Purchase and reply suppressions expire after 30 days. The email provider may retain messages and delivery records under its own retention policy. We do not add estimate, backup, payment or MOT reminder addresses to our newsletter list automatically.

3. Lawful Basis for Processing

We process your personal data on the following lawful bases under the UK GDPR:

  • Contract performance (Article 6(1)(b)): Processing your form data and email address is necessary to provide the form completion service you requested, including paid V55 completion where applicable.
  • Legitimate interests (Article 6(1)(f)): We use analytics data, IP addresses, and usage patterns for fraud prevention, service improvement, and ensuring the security and stability of our Service. We have assessed that these interests do not override your rights and freedoms.
  • Consent (Article 6(1)(a)): Where we send marketing emails or use non-essential cookies, we do so only with your explicit consent. You may withdraw consent at any time.
  • Legal obligation (Article 6(1)(c)): We retain certain payment records as required by UK tax and accounting regulations.

4. How We Use Your Data

  • To generate your selected completed PDF form based on the information you provide.
  • To process your payment and provide transaction receipts.
  • To send you access links and service-related communications via email.
  • To detect and prevent fraud or misuse of the Service.
  • To analyse usage patterns and improve the Service.
  • To answer optional Import Assistant questions, find official guidance, and propose form changes for your approval.
  • To comply with legal and regulatory obligations.

5. Third-Party Data Processors

We share your data with the following third-party processors, each of whom is contractually bound to protect your data:

  • Stripe (payment processing): Handles all payment transactions. Stripe is PCI-DSS Level 1 compliant, the highest level of certification in the payments industry. Your card details are processed directly by Stripe and are never stored on our servers. Stripe Privacy Policy.
  • Supabase (data storage and authentication): Stores your form data and manages session authentication. Data is hosted on EU-based servers. Supabase Privacy Policy.
  • Resend (email delivery): Delivers transactional emails including access links and payment receipts. Resend Privacy Policy.
  • Google Analytics (anonymised analytics): Collects anonymised usage data to help us understand how the Service is used and to improve it. IP addresses are anonymised before processing. Google Privacy Policy.
  • Microsoft Clarity (consented session analytics): Provides heatmaps and session recordings so we can identify usability problems. Clarity loads only after you accept optional analytics; the main V55 form workspace is explicitly masked and form input content is not sent in recordings. Microsoft Privacy Statement.
  • OpenRouter, Inc. (AI document reading and Import Assistant — optional features only): If you choose to use an AI feature, the relevant document or conversation is sent to OpenRouter, which routes it to an AI model. We send these requests with provider data retention and model training disabled. Auto-fill documents are handled in memory only; assistant conversations are retained by us as described below. OpenRouter Privacy Policy.
  • Exa (official web search): When the Import Assistant needs current guidance, it may send a search query to Exa. Searches are restricted to GOV.UK and do not include your form values or uploaded document. Exa Privacy Policy.
  • Langfuse (AI observability): Records AI traces for the Import Assistant so we can monitor quality and cost. Traces include your messages to the assistant, the assistant's replies, the model used, latency, tool use, errors and token counts, linked to a pseudonymous visitor identifier and the assistant thread identifier — not your name or email. Attached documents are never included in these traces. Langfuse Privacy Policy.
  • Telegram (operational alerts): We receive internal notifications for selected service events, including the first time a visitor uses the Import Assistant and when a vehicle document is successfully processed by document auto-fill. Notifications may include an approximate IP-derived country displayed as a flag. Document-specific details are limited to the general document category, file format and size, number of proposed values, and processing duration — never the filename, document contents, extracted values or form values. Assistant-use notifications contain a short prefix of a pseudonymous visitor identifier, the assistant thread identifier, page path, browser user-agent string and time, but never message content or uploaded documents. These notifications are deleted from our Telegram workspace within 90 days. Telegram Privacy Policy.

5a. Import Assistant (Optional)

  • The assistant only runs when you open it and send a message. Its answers may be incorrect, so important guidance should be checked against the official sources it provides.
  • It receives your message plus a limited, non-personal snapshot of relevant vehicle and tax fields. Keeper details, VIN and engine number are excluded from that automatic snapshot.
  • Form changes are suggestions. The assistant cannot silently change the form: you must select “Apply to form” for each proposed value and can undo it.
  • You may attach one PDF or image of a vehicle document. Do not upload passports, driving licences, bank statements, utility bills or documents containing information the assistant does not need.
  • An assistant attachment is processed for that request and is not copied into stored conversation history. The conversation records only that a named attachment was sent.
  • Assistant conversations, saved application-review plans and pseudonymous usage records are retained for up to 30 days for continuity, security, product-quality measurement and allowance enforcement.

5b. AI Document Processing (Optional)

The form offers an optional feature that reads vehicle data from documents you already have — for example a Certificate of Conformity or a foreign registration document — so you don't have to type it all in. In plain English, here is exactly what happens if you use it:

  • It only runs when you actively upload a document. Nothing is uploaded automatically, and every field can be filled in manually instead.
  • The document is sent once, over an encrypted connection, to an AI model via OpenRouter to read the vehicle values printed on it. We instruct the provider not to retain the document or use it for model training.
  • The document itself is processed in memory and discarded when the request completes. We never store your document on our servers, in our database, or in your browser.
  • Only the vehicle values you choose to apply are kept, as part of your form data, under the normal 30-day retention rule described in section 6.
  • We do not accept identity documents (passports, driving licences, national ID cards, utility bills or bank statements) through this feature, and the extraction deliberately requests no personal data — any names or addresses printed on a vehicle document (for example the previous keeper on a foreign registration certificate) are ignored.
  • The lawful basis for this processing is your consent (Article 6(1)(a)), given by the act of uploading; you can simply not use the feature.

6. Data Retention

We retain your data for the following periods:

  • Form data: Retained for 30 days after generation to allow you to access and download your completed PDF, after which it is permanently deleted.
  • Payment records: Retained for 7 years as required by UK tax and accounting legislation (including HMRC requirements).
  • Analytics data: Google Analytics data and first-party product milestones are retained for up to 26 months for service improvement, after which they are deleted.
  • Email address: Retained for the duration of the service period (30 days) unless you have consented to marketing communications, in which case it is retained until you unsubscribe.
  • Assistant conversations and usage: Retained for up to 30 days, then deleted or anonymised.
  • Uploaded vehicle documents: Processed transiently and discarded when the reading request completes — never stored. Only the extracted values you choose to apply are kept, within the 30-day form data retention above.

7. Your Rights Under UK GDPR

Under the UK GDPR, you have the following rights regarding your personal data:

  • Right of access: You can request a copy of the personal data we hold about you.
  • Right to rectification: You can request that we correct any inaccurate or incomplete personal data.
  • Right to erasure: You can request that we delete your personal data, subject to any legal obligations we may have to retain it.
  • Right to restrict processing: You can request that we limit how we use your data in certain circumstances.
  • Right to data portability: You can request a copy of your data in a structured, commonly used, machine-readable format.
  • Right to object: You can object to processing based on legitimate interests, including profiling.
  • Right to withdraw consent: Where processing is based on consent, you can withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at help.v55.5@gmail.com. We will respond to your request within one month. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. International Data Transfers

Your data may be transferred to and processed in countries outside the UK:

  • Supabase: Data is stored on EU-based servers, which benefit from a UK adequacy decision.
  • Stripe: May process data in the United States. Transfers are protected by Standard Contractual Clauses (SCCs) approved by the UK Government.
  • Resend: May process data in the United States. Transfers are protected by Standard Contractual Clauses (SCCs).
  • Google Analytics: May process data in the United States. Transfers are covered by Google's data processing terms and Standard Contractual Clauses.
  • OpenRouter: Used only for optional AI features. Requests may be processed in the United States under the provider's data processing terms, with provider retention and training disabled.
  • Exa: Official-site search queries may be processed in the United States under the provider's data processing terms.
  • Langfuse: AI traces — including your assistant messages and the assistant's replies — are sent to the configured EU cloud region.
  • Telegram: Used only for internal operational alerts, such as the first use of the Import Assistant and successful document auto-fill processing. Notifications may include an approximate IP-derived country. Document-specific details are limited to the general category, file format and size, proposed-value count and processing duration; filenames, document contents, extracted values and form values are not sent. Notifications may be processed outside the UK under Telegram's terms.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption of data in transit (TLS/SSL), secure storage with access controls, and regular security reviews. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

10. Children's Privacy

Our Service is not intended for individuals under the age of 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at help.v55.5@gmail.com and we will take steps to delete such data.

11. Cookies and Local Storage

We use cookies and local storage technologies to operate the Service and analyse usage. For full details on the cookies we use and how to manage them, please see our Cookie Policy.

12. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post the updated policy on this page with a revised "Last updated" date. We encourage you to review this policy periodically. Your continued use of the Service after any changes constitutes your acceptance of the updated policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this privacy policy or our data practices, please contact us: