Privacy notice

The short version

When you ask for quotes, we send your name, contact details and postcode to local garages so they can quote you. That is the whole point of the service, and it only happens because you ticked the box to say we could. We don't sell your data to anyone else.

Who we are

This notice is not yet complete. Qostly's operating entity, ICO registration and contact address have not been configured, so they cannot be shown here. The quote form does not accept personal data in production while this is the case.

What we collect, and why

Your quote request

Your name, email address, phone number if you give one, your postcode, the service you need, and anything you tell us about your vehicle. We need this to pass your request to garages — without it there is nothing to send.

Quotes, agreements and approved changes

We store garages' itemised quote revisions, the quote you accept, the resulting agreement history, change-order decisions and completion or cancellation records. This gives both sides a reliable record of what was authorised. Submitted revisions are not edited in place.

Secure driver access and evidence photos

Driver links and request sessions are stored as one-way hashes. For a price increase, a garage may upload supporting photos. We validate them, remove embedded metadata and keep them in private storage visible only to the driver, that garage and authorised Qostly administrators.

Garage accounts and authentication

If you create a garage account, we collect your name and email address. Neon Auth stores the account, encrypted password, verification status and session records. Qostly never receives your plain-text password.

Garage claims

A claim records your account, name, role, phone number and any message you provide. We use it to verify that you represent the garage before granting access to its listing or leads.

Listing corrections

A correction records your name, email address, role if supplied, and the change you request so an administrator can check and apply it.

A hashed version of your IP address

We store a one-way hash, never the address itself. We use it only to stop automated abuse of the request form.

How you found us

If you arrived from a campaign link, we record which one, so we know which guides are useful.

Our lawful basis

We rely on your consent to share your details with garages. You give it by ticking the box on the request form, and we record when you did. You can withdraw it at any time by emailing us — though if a garage already has your details, you will need to contact them directly as well, because they hold their own copy.

When you ask us to create an account, review a claim or correct a listing, we use the information to provide that requested service, secure the directory and prevent fraudulent access. These forms stay closed until our legal identity and privacy review are complete.

Who we share it with

Local garages. We send your request to garages near you who cover the service you need. Once a garage has your details, it is responsible for them under its own privacy policy. We cannot delete a garage's copy on your behalf.

Our suppliers. We use Neon to host our database (in London), Vercel to run the website, Neon Auth to manage accounts and sessions, Vercel Private Blob to hold change-order evidence, Resend to send lead and authentication email, and Cloudflare to protect public forms from bots. They process data on our instructions.

We do not sell your data.

Where it is held, and for how long

Our database is hosted in London. We keep quote requests, access sessions, quote and agreement histories, notification records and private evidence for 24 months so we can help if something goes wrong with a job, then delete the database records and associated private files.

We keep account information while the account is active. Claims and corrections are kept while they are needed to verify access, maintain an audit trail and resolve disputes. You can ask us to close an account or erase information that no longer needs to be retained.

Your rights

You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to what we're doing with it. Email our contact address and we will respond within one month.

If you think we've handled your data badly, you can complain to the Information Commissioner's Office at ico.org.uk. We'd rather you told us first so we can put it right.