Privacy policy
Last updated 9 October 2026. Applies to this site and to the DRIVE LOOKUP application on it.
Not legal advice
This was written by reading what the site’s code actually does rather than from a template, so it describes the system accurately as of the date above. It has not been reviewed by anyone qualified, and it should be before it is relied on.
1. Who is responsible
Poor Man Super Car Ltd, registered in England & Wales, company number 16197667. Registered office: 47 Diligent Drive, Sittingbourne, England, ME10 2LQ. Contact: contact@drivelookup.com.
The company is the data controller for everything described here, and is registered with the Information Commissioner’s Office under registration number ZB975079. Use the address above for anything on this page — questions, corrections, or a request to delete what we hold.
A small number of submissions were collected before 19 August 2026, when this site was operated by Rafal Kowalski personally. Responsibility for them has passed to the company and they are handled under exactly these terms.
2. What this site is
DRIVE LOOKUP gives a vehicle a permanent public page, reached by scanning a QR sticker. You can create an account, build pages for your cars, upload photographs and order stickers. An earlier version of this site was a concept-validation exercise with no accounts; data collected then is still held and is covered by section 9.
3. What we collect when you have an account
| Email address | To sign you in and to contact you about your account. Unless you switch them off, we also use it to tell you when somebody messages you, follows one of your cars, or needs you about a club, and when a reminder you set is coming up — those emails say where to look and nothing more. It is the only way we can reach you. |
|---|---|
| Password | Stored only as a scrypt hash with a random salt. We cannot read it, and a copy of our database does not reveal it. |
| Display name, and anything you type into your profile | It appears on your public pages. Put in as little as you like. |
| Sessions | A random token in a cookie; the database holds only its SHA-256. Sessions last 30 days, and you can end all of them from your account page. |
| Your vehicles, specifications, links and story | This is the product. Everything here is intended to be public once you publish it. |
| Service reminders | What is due on a car and when — set by you, or by a workshop as part of a job you added. Used only to email you about it; never shown on a public page. They stay with the car, so if it passes to a new keeper, the reminders go to them. |
| Photographs | Shown on your pages. See section 4. |
| Race times, and the screenshot or photo you add as evidence | A time you enter for one of your cars, with the picture that shows it, so a person can check one against the other. Once checked, the time (and the track, distance, date and group) appears on the leaderboard and on the car’s page. The picture is the proof beside the tick, so once your time has been checked <strong>anyone can see it</strong> by tapping the time. Until then only you and the person checking it can. It stops being public the moment the time is taken off the leaderboard, and is deleted when you remove the time. Like every image it is re-encoded on our server, which strips any location stored in the file — but not what is drawn in the picture itself, such as a map of where you started, which is why we tell you to crop out anything private before you upload it, and ask for a crop if we see something that should not be shown. |
| Sticker orders | So we can make and post the right stickers, and because a sale is a record we are required to keep. |
| Messages you send or receive | See section 5. Kept so the recipient can read and answer them. |
| An audit log of significant actions | Password and email changes, and moderation decisions, so account takeovers and mistakes can be traced. |
| Who introduced you, if you arrived through an affiliate link | One record saying which account’s link you followed, and which page it landed you on. It exists so we can pay them what they are owed, and it is kept for as long as your account is. See section 8. |
4. Photographs, and your number plate
Every image you upload is re-encoded on our server before it is stored. That process strips the embedded metadata, including camera details and any GPS coordinates your phone recorded. The location where a photograph was taken is not kept and is not published.
Your registration will be readable in most photographs, and we publish it as it appears. That is normal — it is the same as any photograph of a car anywhere else — but it is also enough for a stranger to look up the vehicle’s MOT, tax and SORN status on free public services, and to link this car to every other photograph of it. We tell you this at the moment you upload rather than burying it here, and if you would rather it were not readable, crop it before uploading.
Your home address is never on a page, and nothing asks a private owner for it. Business accounts can choose to publish their premises — see section 6.
5. Messages
Anyone can write to an account holder through their pages, without having an account themselves. If you send a message we store the name you type, the message itself, and your email address if you choose to give one, along with the time and which car you were looking at.
The email address you give is shown to the person you wrote to, so they can reply — that is the only reason we ask for it, and you can leave it blank. Their address is never shown to you. That asymmetry is the whole reason messages go through us rather than by a link to their inbox.
When a message arrives we email the recipient to say so. That email does not contain the message, the sender’s name or their address — only a link to the inbox. Messages are kept until the recipient deletes them or closes their account. Account holders can switch messages off entirely, and can report one to us; a reported message is retained while we look at it, and the report is written to the audit log described above.
Write to us at contact@drivelookup.com if you want a message you sent removed. You do not need an account to ask.
6. Business accounts, and jobs a business sends you
If you apply for a business account we store what the application asks for: the business name, your name, the business’s category, region, website and description, and your email address. If you apply without an account, we also store the password you chose, as a scrypt hash, only until the application is decided — it is deleted either way at that point. We email you a link to confirm the address is yours before anybody looks at the application; one that is never confirmed is deleted, password hash and all, after a week. We keep an approved application as the record of why the business was approved. A declined one is deleted a year after the decision, so a second application can be judged against the first.
A business chooses what it publishes. Its phone number, premises address, opening hours and website appear on its public page only if the business enters them, and it can remove them at any time. Nothing makes a business publish an address; one run from home can leave it out.
If a business sends you a record of work it did on your car, the business has given us your email address, together with what it says about the job and the car — including the registration, if it entered one, and when the next service is due. We use your address for one thing: to email you a link to that record, once. We do not add you to anything, and nothing about the job goes on any car unless you add it yourself, from an account with that address.
Only the business that sent it, and you, can see it. If you add it, it becomes an entry on your car’s history like any other, confirmed by that business. If you do not, the record — your address included — is deleted automatically 120 days after it was sent. You can ask us to delete it sooner at contact@drivelookup.com, and you do not need an account to ask. The business is responsible for having your address in the first place.
7. Scans
When someone scans a sticker we record that it happened: the code, the vehicle it resolved to, the time, and a coarse indication of the source. Obvious bots and link previews are filtered out and not counted. We do not store the scanner’s IP address against the event, and there is no identifier that would let us follow a person between scans.
8. Cookies
Three cookies, all first-party, and we use no analytics cookies and no advertising cookies. The first two are strictly necessary under UK PECR, which means we do not ask your permission for them — declining would simply break the thing you are using at the time.
The session cookie, set when you sign in. It holds a random session token, is HttpOnly so scripts cannot read it, and is SameSite=Lax. It keeps you signed in for 30 days, or until you sign out.
The claim cookie, set when you scan a sticker that is not yet on a car. It holds the sticker’s code and nothing else, so the site can carry it through signing up and confirming your address and still know which sticker you came to attach, rather than leaving you to find it again from an empty garage. HttpOnly, lasts 30 days, and is deleted the moment the code lands on a car.
The referral cookie is different, and is the one cookie on this site that is not strictly necessary — it exists to pay an affiliate, not to do anything you asked for, so we ask first. Set only if you arrive through an address of the form /r/…, which somebody on our affiliate programme shares to introduce people to us, and only if you choose “Accept all cookies” on the banner — choosing “Necessary cookies only”, or not yet having answered, means it is never set at all, even if you followed such a link. When it is set, it records the code from that link and the page it sent you to, nothing else. It is HttpOnly, lasts 90 days, and is deleted the moment you create an account, at which point the introduction is recorded against the account instead. It is never used for advertising, is never shared, and cannot follow you to another website.
A fourth cookie records your choice itself — which of the above you agreed to, for a year. Remembering a consent decision is treated as strictly necessary in its own right, the same way a “do not ask again” setting would be, so this one is not itself something we ask about. Unlike the other three it is not HttpOnly, because the banner that reads it runs in your browser rather than on our server.
Change your mind at any time from “Cookie settings” in the footer of any page, which brings the banner back. Nothing about your account changes either way, and reaching us by any address that is not an /r/ link never involves the referral cookie at all.
9. Data from the earlier validation site
Before accounts existed, this site collected waitlist sign-ups and sticker “reservations”: an email address, optionally a description of your car, whether you volunteered for an interview, which version of the page you saw, the hostname you arrived from, and for a reservation the configuration and the price shown. No payment details were ever collected. Those records are deleted automatically twelve months after they were received.
10. Who else sees it
Nobody buys this data and we do not sell it. It is processed by:
- Hostinger, who host the server this runs on and the mailbox our emails are sent from, in the course of providing both — including the address each email goes to and what it says. We never put a registration or a VIN in an email.
- Stripe, if and when card payment is enabled — they receive what is needed to take a payment and handle card details themselves. We never see or store a card number.
Anything you publish on a vehicle page is public to anyone with the link or the sticker. That is the point of it, so publish deliberately.
11. How long we keep it
- Account and vehicle data: until you delete it or close your account.
- Sessions: 30 days, or until you sign out.
- Messages: until the recipient deletes them or closes their account.
- Validation-site submissions: twelve months, deleted automatically.
- Records of work a business sent you that you did not add: 120 days from sending, deleted automatically.
- Declined business applications: one year from the decision, deleted automatically.
- Business applications never confirmed from the email: one week, deleted automatically.
- Service reminders: until they are marked done, or the car is deleted.
- Race times and their screenshots: until you remove them, delete the car, or close your account. Removing one takes the picture off our server with it.
- Sticker orders: kept after account closure, because a sale is a record we are legally required to retain for tax purposes. They are stripped of everything identifying beyond what that obligation requires.
12. Closing your account
You can close your account yourself, from your account page, or ask us to delete it for you — both remove the same things. Your pages, photographs, specifications, links, reminders and parts listings are deleted, as are the messages people sent you — and, for a business, its projects, contact details, applications and the records of work it sent; the image files are removed from storage; your email address and profile are overwritten; and your name and address are removed from any sticker orders we have to keep. Any sticker code you held is released rather than deleted, so a sticker already on a car keeps resolving — to a “not set up” page rather than to somebody else’s car.
13. Your rights
Under UK GDPR you can ask for a copy of what we hold, ask us to correct it, ask us to delete it, or object to how we use it. Write to contact@drivelookup.com. If you are not satisfied with the response you can complain to the Information Commissioner’s Office at ico.org.uk.