Privacy policy
Last updated 1 September 2026. Applies to this site and to the DRIVE LOOKUP application on it.
Not legal advice
This was written by reading what the site’s code actually does rather than from a template, so it describes the system accurately as of the date above. It has not been reviewed by anyone qualified, and it should be before it is relied on.
1. Who is responsible
Poor Man Super Car Ltd, registered in England & Wales, company number 16197667. Registered office: 47 Diligent Drive, Sittingbourne, England, ME10 2LQ. Contact: contact@poormansupercar.com.
The company is the data controller for everything described here, and is registered with the Information Commissioner’s Office under registration number ZB975079. Use the address above for anything on this page — questions, corrections, or a request to delete what we hold.
A small number of submissions were collected before 19 August 2026, when this site was operated by Rafal Kowalski personally. Responsibility for them has passed to the company and they are handled under exactly these terms.
2. What this site is
DRIVE LOOKUP gives a vehicle a permanent public page, reached by scanning a QR sticker. You can create an account, build pages for your cars, upload photographs and order stickers. An earlier version of this site was a concept-validation exercise with no accounts; data collected then is still held and is covered by section 7.
3. What we collect when you have an account
| Email address | To sign you in and to contact you about your account. It is the only way we can reach you. |
|---|---|
| Password | Stored only as a scrypt hash with a random salt. We cannot read it, and a copy of our database does not reveal it. |
| Display name, and anything you type into your profile | It appears on your public pages. Put in as little as you like. |
| Sessions | A random token in a cookie; the database holds only its SHA-256. Sessions last 30 days, and you can end all of them from your account page. |
| Your vehicles, specifications, links and story | This is the product. Everything here is intended to be public once you publish it. |
| Photographs | Shown on your pages. See section 4. |
| Sticker orders | So we can make and post the right stickers, and because a sale is a record we are required to keep. |
| Messages you send or receive | See section 5. Kept so the recipient can read and answer them. |
| An audit log of significant actions | Password and email changes, and moderation decisions, so account takeovers and mistakes can be traced. |
4. Photographs, and your number plate
Every image you upload is re-encoded on our server before it is stored. That process strips the embedded metadata, including camera details and any GPS coordinates your phone recorded. The location where a photograph was taken is not kept and is not published.
Your registration will be readable in most photographs, and we publish it as it appears. That is normal — it is the same as any photograph of a car anywhere else — but it is also enough for a stranger to look up the vehicle’s MOT, tax and SORN status on free public services, and to link this car to every other photograph of it. We tell you this at the moment you upload rather than burying it here, and if you would rather it were not readable, crop it before uploading.
Your home address is never on a page. Nothing asks for it.
5. Messages
Anyone can write to an account holder through their pages, without having an account themselves. If you send a message we store the name you type, the message itself, and your email address if you choose to give one, along with the time and which car you were looking at.
The email address you give is shown to the person you wrote to, so they can reply — that is the only reason we ask for it, and you can leave it blank. Their address is never shown to you. That asymmetry is the whole reason messages go through us rather than by a link to their inbox.
Messages are kept until the recipient deletes them or closes their account. Account holders can switch messages off entirely, and can report one to us; a reported message is retained while we look at it, and the report is written to the audit log described above.
Write to us at contact@poormansupercar.com if you want a message you sent removed. You do not need an account to ask.
6. Scans
When someone scans a sticker we record that it happened: the code, the vehicle it resolved to, the time, and a coarse indication of the source. Obvious bots and link previews are filtered out and not counted. We do not store the scanner’s IP address against the event, and there is no identifier that would let us follow a person between scans.
7. Cookies
One cookie, set only when you sign in. It holds a random session token, is HttpOnly so scripts cannot read it, and is SameSite=Lax. It is strictly necessary to keep you signed in, which is why there is no consent banner — there is nothing optional to consent to. We use no analytics cookies and no advertising cookies.
8. Data from the earlier validation site
Before accounts existed, this site collected waitlist sign-ups and sticker “reservations”: an email address, optionally a description of your car, whether you volunteered for an interview, which version of the page you saw, the hostname you arrived from, and for a reservation the configuration and the price shown. No payment details were ever collected. Those records are deleted automatically twelve months after they were received.
9. Who else sees it
Nobody buys this data and we do not sell it. It is processed by:
- Hostinger, who host the server this runs on, in the course of hosting it.
- Stripe, if and when card payment is enabled — they receive what is needed to take a payment and handle card details themselves. We never see or store a card number.
- Resend, if and when email is switched on — they receive the address a message is sent to and the message itself, in order to deliver it. Resend is in the United States, so this involves a transfer of your email address outside the UK. We never put a registration or a VIN in an email.
Anything you publish on a vehicle page is public to anyone with the link or the sticker. That is the point of it, so publish deliberately.
10. How long we keep it
- Account and vehicle data: until you delete it or close your account.
- Sessions: 30 days, or until you sign out.
- Messages: until the recipient deletes them or closes their account.
- Validation-site submissions: twelve months, deleted automatically.
- Sticker orders: kept after account closure, because a sale is a record we are legally required to retain for tax purposes. They are stripped of everything identifying beyond what that obligation requires.
11. Closing your account
You can close your account yourself, from your account page. When you do, your pages, photographs, specifications and links are deleted, the image files are removed from storage, and your email address and profile are overwritten. Any sticker code you held is released rather than deleted, so a sticker already on a car keeps resolving — to a “not set up” page rather than to somebody else’s car.
12. Your rights
Under UK GDPR you can ask for a copy of what we hold, ask us to correct it, ask us to delete it, or object to how we use it. Write to contact@poormansupercar.com. If you are not satisfied with the response you can complain to the Information Commissioner’s Office at ico.org.uk.