Privacy

Turfrig is run by Little Jam Jar Ltd, which is the data controller for this site (company details). That covers everything described here: browsing, seller sign-up and listings, and Rigbook accounts. ICO registration: ZC283636. Contact: [email protected].

Browsing

Nothing. There are no analytics scripts, no advertising trackers and no cookies set by Turfrig for browsing. The shortlist, compare and parts-list features keep their lists in your own browser's storage and never send them to us unless you bring a list into your Rigbook. Our web server keeps standard access logs (IP address, page, time, browser string) for 14 days for security and capacity, then deletes them.

Rigbook

What we keep: your email address; for each van you add, its registration, the name you give it, the MOT history we fetch from the DVSA (refreshed weekly) and our reading of it; the reminders you set; your build log (titles, notes, costs, photos); and the parts you save. Photos are resized and every piece of embedded data (camera, date, GPS location) is stripped before they are stored.

Why: to run the service you asked for: show your van's history and what it would cost to put right, and email the reminders you set (legal basis: performing the service you asked for). Rigbook sends no other email.

Who sees what: only you, unless you switch on a public build page for a van. That page shows the van's name, make, model and year with your log entries and photos; never the registration, the MOT history, your reminders or your email.

Retention: everything stays until you remove it. Removing a van deletes its log, photos, reminders and parts list at once. Deleting your account removes every van and your email address at once.

Your rights: from your Rigbook you can download everything we hold (JSON) or delete it all. You can also email us. You have the right to complain to the Information Commissioner's Office.

Selling a van (private seller listings)

What we collect: your email address; the van's registration, asking price, postcode district (the first part only, e.g. SW1A), mileage, your description and up to 8 photos. Photos are resized and every piece of embedded data (camera, date, GPS location) is stripped before they are stored.

Why: email to send you one-time links to edit, renew or mark the van sold, to tell you when it goes live or expires, and to pass on buyers' messages (legal basis: performing the service you asked for). The registration is checked against the public MOT history to confirm the van exists and to show a verified badge (legitimate interests: keeping the listings straight).

Who sees what: buyers see the title, price, district, mileage, description, photos and scores. They never see your email address: messages reach you through a relay, and their reply-to is the buyer's address. A moderator at Little Jam Jar sees the full listing including your email before it goes live.

Retention: a listing runs 30 days (renewable). 30 days after a listing ends, sells or is withdrawn, we delete the registration, description, photos and any buyer messages, and your email once you have no listings or Rigbook vans left. Buyers' messages are kept 30 days.

Your rights: from your listings page you can download everything we hold (JSON) or delete your account and all listings immediately. You can also email us. You have the right to complain to the Information Commissioner's Office.

Contacting a seller

Your email and message are sent to the seller and kept by us for 30 days so we can deal with abuse, then deleted. We rate-limit the form by IP address in memory only; nothing about who contacted whom is written to disk beyond that 30-day copy.

Reporting a listing or build page

Anyone can report a private listing or a public build page. We keep the reason, what you write and, only if you give it, your email address so we can tell you what we did. We never store your IP address with a report. A person reads every report; if we take something down, we tell its owner why and they can ask us to look again. Reports are deleted six months after we've dealt with them (legal basis: legitimate interests in keeping the site safe and lawful).

Registration checks

The registration you enter is sent to the DVSA MOT history service to fetch that vehicle's public MOT record. We cache the answer for 24 hours keyed by the registration alone, and we never store which IP address looked up which registration. Results contain public sector information licensed under the Open Government Licence v3.0.

Signing in and security

There are no passwords. Sign-in links are single-use, expire in an hour, and are stored only as hashes; the session is a signed cookie that lasts 30 days. Forms are protected by Cloudflare Turnstile, which may process your IP address and browser details under Cloudflare's privacy policy.

Backups

Every night we copy the database, the photos and our settings, check that the copy is sound, and encrypt it before it leaves the server. Encrypted copies go to a second server we run, so a failed disk can't lose your data. We keep them for up to six weeks: something you delete leaves the site at once and the backups within six weeks, after which it is gone for good. Nobody can read a backup without our private key.

Cookies and storage

We don't use analytics, advertising or tracking cookies, so there's nothing to accept. What we store is only there for something you asked for:

• turf_s (cookie, 30 days): keeps you signed in to your Rigbook or your listings. Set only when you sign in.
• turf_plate (cookie, 1 hour): carries the registration you checked into Rigbook while you sign in.
• Your shortlist, compare list and parts list (your browser's storage): stay on your device until you clear them, and reach us only if you bring a list into your Rigbook.
• Your language and region (your browser's storage): only if you choose one, or dismiss the suggestion banner.
• Cloudflare, which protects the site, may set a short-lived security cookie to tell people from bots, and forms load its Turnstile spam check. Neither is used for tracking.

Where your data goes

Turfrig runs on servers we operate ourselves, and its backups are encrypted. Some of our servers and backups are outside the UK, in countries the UK government recognises as providing an adequate level of data protection. A few of the services we use are also based outside the UK:

• Cloudflare carries every visit to the site, runs the spam check on forms and sends our emails (sign-in links, listing updates, reminders and replies to sellers) through Cloudflare Email Sending. For all of this it acts as our processor, under its data processing addendum, and may not use your data for its own purposes. It is based outside the UK; transfers to it are covered by the UK's adequacy regulations for companies certified to the UK Extension to the Data Privacy Framework, as Cloudflare is, and by its standard contractual clauses with the UK Addendum.
• eBay: van photos load straight from eBay's servers, so your browser asks eBay for them and eBay sees your IP address, as with any image on the web. Following a link to a listing takes you to eBay, under its own privacy policy.
• SimpleLogin, part of Proton AG, forwards email sent to [email protected] to us. It is based outside the UK, in a country the UK government recognises as providing an adequate level of data protection.
• DVSA (UK) receives the registration you check, and nothing else.

Links to eBay

Links to eBay listings and parts are eBay Partner Network affiliate links. When you follow one, you leave Turfrig and eBay sets its own cookies to record the visit and any purchase, under eBay's privacy policy. The link tells eBay only which part of Turfrig it came from (for example "van page, brakes" or "reg check"), never anything about you. If you buy, eBay pays Little Jam Jar Ltd a commission; you pay the same either way. More on our legal page.

Links to Amazon

"Check price on Amazon" links in the Rig builder's parts list are Amazon Associates affiliate links. When you follow one, you leave Turfrig and Amazon sets its own cookies to record the visit and any purchase, under Amazon's own privacy notice. The link carries only our affiliate tag, never anything about you. As an Amazon Associate Turfrig earns from qualifying purchases. You pay the same either way. More on our legal page.

Third parties

eBay (listing data and images, served from eBay's servers), DVSA (MOT history), Cloudflare (network protection, Turnstile, and sending our emails), and the data sources credited in the page footers.