Cookie Policy
Last updated: 15 September 2026
This page explains the cookies and similar storage technologies used on the Car Control website at [carcontrol.co.uk] (the "Site"), and why we do not currently show a cookie consent banner.
1. What we use, in full
The Site does not use any advertising cookies, tracking cookies, or analytics cookies at launch. We do not use third party marketing or profiling technologies of any kind. The only storage the Site uses is strictly necessary storage needed to make the Service work securely, listed in full below.
| Name or purpose | Type | Why it is used | Duration |
|---|---|---|---|
| Security or session token (if used when you submit a search) | Strictly necessary cookie or local storage | To protect the Site against automated abuse, for example to confirm a request came from a real browser session, and to prevent cross-site request forgery | Session, or a short period, cleared automatically |
| cc_sess (if you sign in or have an account) | Strictly necessary cookie, HttpOnly | Keeps you signed in to your account, so you can see your credits, open reports and past orders without signing in again on every page | 30 days, or until you sign out, at which point it is deleted |
| cc_oauth (only while signing in with Google) | Strictly necessary cookie | Used only during the "Sign in with Google" process, to check that the sign-in response actually comes from the request we made and to prevent forged sign-ins | 10 minutes, or until Google sign-in completes, whichever is sooner |
| Administrator session cookie (staff only) | Strictly necessary cookie | Keeps a signed-in administrator authenticated while using staff-only tools to manage orders and accounts; not set for ordinary customers | Session, or a short period set by our admin tools |
| Report access token (if you buy a Basic report, a Premium report, or redeem a pack credit) | Strictly necessary local storage | Stored in your browser's local storage so that, on this device and browser, you can reopen the private link to a report you have paid for without having to find your confirmation email each time | Up to 30 days, matching the access period for that report |
| Pack token (if you buy the 3 Premium reports pack) | Strictly necessary local storage | Stored in your browser's local storage so that, on this device and browser, you can find your pack link or code, see how many credits remain, and redeem them without having to find your confirmation email each time | Up to 12 months, matching the credit expiry period for the pack |
| Load balancing or hosting infrastructure cookie (if set by our hosting provider) | Strictly necessary cookie | To route your request to the correct server so the Site works correctly | Session |
All of these are strictly necessary cookies or local storage: none of them are used for advertising, analytics or tracking, so none of them need your consent under PECR (see section 3). We do not currently set any cookie that remembers your preferences across visits, and we do not use any cookie or local storage for advertising, social media sharing, or behavioural tracking. If the exact list above changes, we will update this page.
2. Stripe Checkout
When you buy a report or the pack, we take you to Stripe Checkout to pay. This payment page runs on checkout.stripe.com, a domain operated by Stripe, not by us. We do not load Stripe's payment scripts on our own pages; instead, your browser is redirected to Stripe's own hosted page to complete payment, and then returned to our Site once payment is done. Any cookies or similar storage set while you are on checkout.stripe.com are set by Stripe, under Stripe's own cookie and privacy notices, not under this policy. You can read Stripe's cookie policy at [Stripe cookie policy link].
3. Why no consent banner is shown
Under the Privacy and Electronic Communications Regulations 2003 (PECR), you must generally ask for consent before storing cookies or similar technologies on a user's device, unless a cookie is "strictly necessary" to provide a service the user has specifically asked for. The strictly necessary exemption covers things like security tokens, load balancing, and storage needed to let you access a report or pack you have just paid for, which is all we currently use.
Because every piece of storage listed above is strictly necessary to deliver the Service you have requested, including reopening a report you have paid for, a pack you are redeeming, or keeping you signed in to an account you have chosen to create, and because we do not load Stripe's own scripts or cookies on our Site (you are redirected to Stripe's separate, Stripe-hosted Checkout page to pay), we do not need your consent for our own storage and we do not show a cookie banner. This is consistent with PECR and with ICO guidance on the strictly necessary exemption. If this changes, for example if we later embed Stripe's payment element directly on our own pages instead of redirecting to Stripe Checkout, we will review whether a consent banner is needed and update this page first.
4. If this changes
The Data (Use and Access) Act 2025 has introduced additional limited exemptions from cookie consent, including for certain low intrusion first party analytics used solely to gather aggregate statistics about a website, subject to conditions such as a clear opt-out and no use for advertising or profiling. If we introduce this kind of statistical analytics in future, or any other cookie or technology that is not strictly necessary, such as advertising or non-essential preference cookies, we will update this page and, where the law requires it, ask for your consent through a cookie banner or similar control before setting that storage. We will not rely on the statistical analytics exemption, or any other exemption, without first checking it applies and updating this page.
5. Managing storage yourself
You can control or delete cookies and similar storage through your browser settings at any time. Blocking strictly necessary storage may mean parts of the Site do not work correctly, for example if a security check cannot be completed, or if you cannot reopen a report or pack link that relies on local storage.