Privacy policy

Motor Menders Ltd, company number 15050770, is the data controller for information collected through this website and customer portal. Its registered office is 64 Castle Boulevard, Nottingham, England, NG7 1FN. Privacy requests can be sent through the contact page or by writing to the registered office.

Depending on how you use the service, this can include account and contact details, guest-booking contact details, vehicle registration and technical details, appointment requests, messages, consent records, authentication events and limited email-delivery metadata.

Passwords, reset tokens and refresh tokens are managed by Supabase Auth and are not stored in public application tables. Guests do not receive an account merely by requesting an appointment.

A guest booking requires a name, email address and telephone number so the garage can identify the request and contact the person about the vehicle. Guest details are available only to authorised garage administrators and service providers needed to store the request and send transactional emails.

Guests do not have a customer portal. They must contact the garage and quote their booking reference if they need to change or cancel a request.

Where the optional lookup is enabled, a vehicle registration is sent securely to the DVLA Vehicle Enquiry Service to retrieve public vehicle information and reduce manual entry. The API key remains on the server, registration numbers are sent in a request body rather than a URL, and customers must check the returned details before submitting them.

Motor Menders may store the confirmed vehicle details with the appointment, but does not use this feature to retrieve registered-keeper information. Contains public sector information licensed under the Open Government Licence v3.0.

If you choose social sign-in, Google or Apple authenticates you and supplies Supabase Auth with an account identifier, email address, email-verification status and any basic name information the provider makes available. Apple may supply a private relay address instead of your usual email. Motor Menders does not receive your Google or Apple password.

First-time social-sign-in customers must still provide a UK mobile number and separately accept the Terms and Privacy Policy before the portal is enabled. Using these options also tells the chosen provider that you signed in to this service.

Information is used to provide secure accounts, manage vehicles and appointments, respond to enquiries, send transactional updates, protect the service and meet garage record-keeping obligations. The final policy must identify the appropriate UK GDPR lawful basis for each purpose.

On public website pages, Vercel Web Analytics measures aggregated visits without analytics cookies and Vercel Speed Insights measures page-performance timings. The application excludes authentication, customer dashboard, administrator and API routes before events are sent, and removes query strings from reported public-page URLs. These tools are not used for advertising or behavioural profiles.

Vercel may process technical information associated with a public-page visit, such as the page path, referrer, approximate location, browser or device category, and performance measurements.

Vercel hosts the application and provides public-page analytics and performance measurement, Supabase provides database and authentication services, Resend delivers authentication and transactional emails, and Cloudflare Turnstile helps protect public guest booking from automated abuse. Google or Apple also processes authentication data when a customer chooses the corresponding sign-in option. DVLA processes a registration lookup only when that optional service is enabled and requested. The business must review each provider’s data-processing terms, locations and safeguards before production launch.

Role-based access, Row Level Security, encryption in transit, protected server credentials and minimal email logs reduce exposure. Guest contact and vehicle identifiers are retained for up to 24 months after an appointment is completed or cancelled, then replaced with non-identifying placeholders. Appointment history is retained for workshop and audit records.

Retention periods for registered customer accounts, contact requests and email events must be approved separately before final production launch.

Subject to applicable law, people may have rights to access, correct, erase, restrict or object to processing, and to data portability. A verified process for handling these requests and complaints to the ICO must be established before production use.