Privacy Policy

Last updated: 29 April 2026

GarageBooks is a sole trader business registered in England and Wales. This policy explains what personal data we collect, how we use it, and your rights under the UK General Data Protection Regulation (UK GDPR).

1. Who we are

Data controller: GarageBooks
Address: 167-169 Great Portland Street, 5th Floor, London, W1W 5PF
Email: support@garagebooks.co.uk
ICO Registration: ZC106985

2. What data we collect

When you use GarageBooks we may collect:

• Account information — your name, email address, and password (stored securely via Supabase Auth)
• Business information — garage name, address, phone number, VAT registration number
• Customer and vehicle records you enter into the system
• Invoice and financial data you create within the application
• HMRC OAuth tokens, used solely to submit VAT returns on your behalf via Making Tax Digital
• Vehicle and MOT data — vehicle registration, make, model, MOT history and expiry, retrieved from the DVSA Vehicle Enquiry and MOT History APIs when you add a vehicle or customer record
• Usage data — pages visited, actions taken, for the purpose of improving the service (via Google Analytics, where enabled)
• Device and browser information collected for HMRC fraud prevention header requirements (connection method, screen size, timezone, IP address)

3. How we use your data

• To provide and operate the GarageBooks service
• To submit VAT returns to HMRC on your behalf under Making Tax Digital
• To send transactional communications (e.g. invoices, reminders) where you have enabled them
• To power MOT reminder and customer relationship management (CRM) features for your garage's customers
• To comply with our legal obligations, including HMRC fraud prevention requirements
• To improve and develop the service using anonymised usage analytics

4. Legal basis for processing

• Contract — processing necessary to deliver the service you have subscribed to
• Legal obligation — HMRC requires specific data to be submitted with MTD VAT API calls
• Legitimate interests — service improvement, security monitoring, fraud prevention
• Consent — analytics tracking, where you have accepted cookies

5. Where your data is stored

Your data is stored in the European Union using Supabase (database and authentication), which complies with UK GDPR data transfer requirements. Payment processing is handled by Stripe, which is certified to relevant security standards. We do not sell your data to third parties.

6. Data shared with or received from third parties

• HMRC — VAT return data and fraud prevention headers, as required by law
• DVSA (Driver and Vehicle Standards Agency) — vehicle registration numbers are sent to DVSA's public Vehicle Enquiry and MOT History APIs to retrieve vehicle and MOT data displayed in your CRM and used for reminder workflows
• Supabase — database and authentication infrastructure (EU-hosted)
• Stripe — payment processing for subscriptions
• Resend — transactional email delivery
• Google Analytics — anonymised usage analytics (where you have consented)
• Vercel — application hosting and serverless functions (processes request data in transit)

We do not share your data with any other third parties without your explicit consent.

7. How long we keep your data

We retain your account and business data for as long as your account is active, plus 6 years after account closure to comply with HMRC record-keeping requirements. You may request deletion of your account at any time (see section 9).

8. Cookies

GarageBooks uses essential cookies required for authentication and session management. Where Google Analytics is enabled, additional cookies may be set for usage tracking. You will be asked for consent before any non-essential cookies are placed.

9. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data (subject to legal retention requirements)
• Restrict or object to processing
• Data portability
• Withdraw consent where processing is based on consent

To exercise any of these rights, contact us at support@garagebooks.co.uk. We will respond within 30 days.

10. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

11. Changes to this policy

We may update this policy from time to time. The date at the top of this page will always reflect the latest version. Significant changes will be communicated to registered users by email.

---