Last updated 4 November 2026
Who we are
KerbProof Ltd (company number 00000000, Registered address to be confirmed, United Kingdom) is the controller of your personal data. Contact us at help@kerbproof.com.
What we collect, and why
If you check a vehicle
The registration you enter, and a random ID for your device so we can limit lookups per day. We store the device ID and your network address only as one-way fingerprints, never in the clear. Purpose: providing the report and preventing scraping (our legitimate interest).
If you create a KerbProof record
The photos and videos you take, the answers you give, the time each item reached us, a fingerprint (hash) of each file, basic device information, and a rough location only if you choose to share it (rounded to about a kilometre). Purpose: producing the record you asked us to publish (contract), and keeping evidence of what was filmed and when (legitimate interest).
Number plates. We treat registrations and footage as personal data. Plates are blurred in public photos unless you choose to show your registration. While your record is live, anyone who enters its registration or KerbProof ID on kerbproof.com can see it; once it is sold, withdrawn or expires, it can no longer be found that way. We never show a private seller’s name or contact details — buyers message you through us. Records are never listed by search engines, and are never searchable for a registration — so KerbProof cannot be used to track a vehicle.
Documents. We never ask for the logbook (V5C). Service history and certificate photos are shown on your record, so we ask you to cover any names and addresses before you take them.
If you have an account or a trader account
Your email address, and for traders the business details shown publicly (the law requires traders to give their name and address), plus billing details held by Stripe.
What we never do
- Look up or store the registered keeper’s name or address.
- Sell your data, or use it for advertising.
- Use cookies for tracking. Our analytics are cookieless.
Who we share it with
Processors that help us run KerbProof, under contract, in the UK or EU wherever possible: our hosting and storage providers, our email and text message providers, Stripe for trader billing, a plate-recognition service (which sees only the code-and-plate photo), Cloudflare for bot checks, and PostHog (EU) for cookieless analytics.
How long we keep it
- Photos and videos from an expired or withdrawn KerbProof record: deleted after 90 days, unless you ask us to keep them.
- Unfinished live checks: deleted the day after they lapse.
- Lookup counters: 30 days. Sign-in links: 7 days. Email logs: 90 days.
Your rights
You can ask for a copy of your data, to correct it, to delete it, or to object to how we use it. Signed-in users can delete their account from their account page; anyone can use the form on our help page. We act within 30 days. You can also complain to the Information Commissioner’s Office at ico.org.uk.