Last updated: 1 October 2026
Uncora Ltd (“Uncora”, “we”, “us”) operates the Uncora garage management platform. We are a data controller for account and billing data, and a data processor for customer data you enter into the platform. Contact: support@uncora.co.uk
Account data — name, email, phone number, job title, garage name, address, postcode, and garage phone number. If you invite team members, we also collect their name and email.
Billing data — processed by Stripe. We store a Stripe customer ID, subscription status, and a card fingerprint to prevent trial abuse. We do not store card numbers.
Customer and job data — names, phone numbers, email addresses (optional, e.g. when importing a customer list), vehicle registrations, and job records you enter. You are the data controller for this data; we process it on your behalf.
Vehicle data — DVLA/DVSA MOT results fetched using registration plates, cached for up to 7 days.
Usage data — standard server logs (IP addresses, request times) for security and debugging.
To provide the platform, process payments, send transactional emails, deliver SMS messages to your customers, generate AI vehicle recommendations, and detect fraudulent trial use. We do not sell your data or your customers' data to any third party.
Contract — to deliver the subscribed service. Legitimate interests — fraud prevention and security. Legal obligation — where required by law.
We share data only as necessary with: Supabase (database hosting, EU region), Stripe (payments), DVLA/DVSA (MOT lookups — registration only), OpenAI (AI recommendations — vehicle make/model/MOT data and job notes are sent; job notes are automatically filtered to remove names, phone numbers, email addresses, and vehicle registrations before sending), Resend (email), Vonage (SMS), Sentry (error monitoring, EU region — technical crash/error data; a small number of error reports include a vehicle registration plate for debugging, never customer names, phone numbers, or addresses). All are bound by data processing agreements.
International transfers — OpenAI processes data in the United States. This transfer is covered by the UK Information Commissioner's Addendum to the EU Standard Contractual Clauses, a safeguard recognised under UK GDPR. OpenAI does not use data sent via its API to train its models.
Data is held while your subscription is active. On cancellation, dashboard access ends at the end of your current billing period, and we automatically email you a full export of your data at that time. We do not currently run an automated deletion schedule — your data is retained until you request its deletion by contacting support@uncora.co.uk, at which point we'll action it. Export your records before cancelling — UK businesses must keep financial records for 6 years (HMRC requirement).
Under UK GDPR you have the right to access, rectify, erase, port, or object to processing of your data. Contact support@uncora.co.uk — we'll respond within 30 days. You may also complain to the ICO.
All data is transmitted over HTTPS. Our database uses row-level security so each garage only sees its own data. Passwords are hashed and never stored in plain text.
We use only essential cookies required for authentication. No advertising or tracking cookies.
We'll notify you by email before material changes take effect. The latest version is always at this URL.
Data protection queries: support@uncora.co.uk