What we hold, and who else sees it.

A car's registration, its service history and where it has been repaired are personal data, and some of it identifies a valuable object sitting on a driveway. We treat it that way.

The short version

• Your garage is private unless you deliberately publish it.
• There is no analytics, no advertising, and no third-party tracking on this site.
• Data is stored in the United Kingdom (London region).
• We never sell your data, and there is nobody to sell it to.

Who is responsible

PeachStamp is the data controller for the information described here. Contact: hello@peachstamp.com. If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk, though we would rather you told us first.

If you are signed out, we hold nothing

You can use most of the product without an account. When you do, your garage, records and uploaded files are stored in your own browser and are never sent to us. Clearing your browser data deletes them, and we cannot recover them because we never had them.

What we store when you have an account

• Account — your email address, and a display name and handle if you choose one. Sign-in is by emailed link; we never store a password.
• Vehicles — registration, nickname, the dates you owned it, visibility settings.
• Service records — date, mileage, cost, supplier, and your description of the work.
• Documents — the invoices and photographs you upload, their fingerprints, and any timestamp obtained for them.
• Reviews — anything you write about a car you have driven.
• Custody and handovers — which periods of a vehicle's life belong to which account, so records can pass to a buyer without exposing anything outside the relevant period.

Our lawful basis is performance of the contract between us for everything needed to run your garage, and legitimate interests for keeping the service secure and preventing fraudulent records. Where you publish a garage or hand a vehicle over, that is your instruction.

Who else sees it

We use a small number of processors, and no advertising or analytics companies.

• Supabase — database, file storage and authentication, hosted in the UK (London, eu-west-2).
• Vercel — application hosting, served from London.
• Anthropic — when you ask us to read an invoice, or generate a buyer's report, the relevant document contents and vehicle details are sent to Anthropic's API to be processed and returned. This happens only when you trigger it. Anthropic does not use API data to train its models.
• Timestamp authorities (freetsa.org, DigiCert) — see below.
• DVSA — we request MOT history by registration. We send them a registration; we send them nothing about you.

Timestamping sends a number, not a document

What becomes public, and only if you choose

Garages are private by default. If you publish one, the page shows the vehicles, their history summary and any reviews you wrote — and you can mask the registration so only part of it is shown. Masking is applied before the data leaves our database, not hidden in the page. We never publish your email address, your documents, or the costs you recorded.

A published garage can be indexed by search engines. Making it private again removes the page, but a search engine may hold a cached copy for a while.

Handing a vehicle to a buyer

A handover gives the buyer the records covering your ownership period only. They do not see your other vehicles, your account, your email address, or anything recorded after the handover date. The link that grants this is unguessable and single-purpose.

Cookies

One cookie, used to keep you signed in. There are no analytics, advertising or tracking cookies, which is why this site does not ask you to accept anything.

How long we keep it

Your records stay until you delete them or close your account. When you close it, we delete your account data and files. Two things may persist: records that have been handed to a buyer, which are theirs now and cover their vehicle; and a minimal record of a seal — a fingerprint and a date, with no document — where deleting it would destroy a buyer's ability to verify what they were given.

Your rights

You can ask for a copy of your data, correct it, delete it, take it elsewhere, or object to how we use it.

Export and deletion are both self-service, under Account. The export is a single file containing everything above, including each document's fingerprint, so a copy stays verifiable long after you have stopped using us. Deleting removes your data and your files outright — we cannot recover any of it afterwards, which is the point.

The one exception is described above: a vehicle you have handed to a buyer keeps its history, with your name removed from it. Everything else goes. For anything the app doesn't cover, email hello@peachstamp.com and we will respond within one month.

Children

The service is not intended for anyone under 18.

Changes

If we change what we collect or who processes it, we will update this page and say so in the app. We will not quietly broaden what we do with data you have already given us.