How we handle your data

Sign-in is handled by our managed authentication provider. We support email and password sign-in, and Google sign-in where enabled. Passwords are never stored by Vehicle Scouter directly — they are managed by the auth provider using industry standard hashing.

Sessions are stored in your browser and can be ended at any time by signing out.

Vehicle Scouter stores the minimum data needed to deliver the service:

• Account identifier and email address from your sign-in.
• Shortlists you save and the brief that produced them.
• MOT and listing lookups you run, so we can show recent activity.
• Cached vehicle fault and repair-cost data shared across users (no personal data).

Saved data is scoped to your account through row-level security rules so that other users cannot read it.

• All traffic is served over HTTPS.
• Database access is protected by row-level security policies scoped to the signed-in user.
• Server-only secrets (API keys, service credentials) are stored in our managed secrets store and are never exposed to the browser.
• Privileged operations run only inside server functions, not in client code.

• Managed hosting and database (Lovable Cloud) for the app, auth, and storage.
• The DVSA MOT history API for vehicle MOT lookups.
• A web-content extraction provider used when you ask us to analyse a listing URL.
• AI model providers used to generate recommendations and listing analyses.

These providers process only the data needed to fulfil the request you made (for example, a listing URL or a vehicle registration).

We use first-party browser storage to keep you signed in and to remember small preferences. We do not run third-party advertising trackers.

You can delete saved shortlists from your account at any time. If you would like your account and associated data removed entirely, contact us at the address below and we will action the request.

For privacy questions, data deletion requests, or to report a suspected security issue, please get in touch via the contact details on our home page. We aim to respond to security reports promptly and appreciate responsible disclosure.