Privacy Policy

2.1 Account Information

• Full name
• Email address
• Phone number (for Plus and Pro tier subscribers)
• Password (stored in hashed format)
• Date of birth
• Postcode

2.2 Driving Test Information

• Current test centre location
• Current test date and time
• Desired test centre locations (1-5 depending on subscription tier)
• Desired test date ranges and time preferences
• DVSA booking reference number
• Driver licence number
• Test type (Car, Motorcycle, etc.)
• Transmission preference (Manual/Automatic)
• Test attempt number

2.3 Subscription and Payment Information

• Subscription tier (Starter, Plus, Pro)
• Payment method details (processed by Stripe/GoCardless, we do not store full card numbers)
• Billing address
• Transaction history
• Refund requests and outcomes

2.4 Match and Communication Data

• Match history and compatibility scores
• Match acceptance status and timestamps
• Digital signatures (for match agreements)
• Communication preferences (email, SMS)
• Messages exchanged through our platform

2.5 Technical and Usage Data

• IP address
• Browser type and version
• Device information
• Pages visited and time spent on pages
• Referral source
• Cookies and similar tracking technologies

2.6 Reactivation and Test Outcome Data

• Test pass/fail status (if provided)
• Reactivation status and preferences
• Number of test attempts
• Previous listing history

3.1 Service Provision (Contractual Necessity)

• Creating and managing your account
• Running our matching algorithm to find compatible swap partners
• Facilitating communication between matched users
• Processing subscription payments and managing billing
• Providing customer support

3.2 Communications (Contractual Necessity / Legitimate Interest)

• Sending match notifications via email and SMS (Plus/Pro tiers)
• Sending test follow-up emails to determine pass/fail status
• Sending reactivation reminders for pending rebookings
• Providing DVSA swap instructions after match acceptance
• Sending service updates and important announcements

3.3 Service Improvement (Legitimate Interest)

• Analyzing usage patterns to improve matching accuracy
• Monitoring system performance and reliability
• Developing new features based on user behavior
• Conducting internal research and analytics

3.4 Legal and Security (Legal Obligation / Legitimate Interest)

• Preventing fraud and abuse of the service
• Complying with legal obligations and court orders
• Enforcing our Terms and Conditions
• Protecting the rights and safety of our users
• Resolving disputes between users

3.5 Marketing (Consent / Legitimate Interest)

• Sending promotional emails about service updates (you can opt out)
• Requesting testimonials and reviews from satisfied customers
• Running referral programs and community growth initiatives

4.1 With Your Match Partner

When both parties accept a match, we share limited contact information (name, email, phone number if provided) to enable you to coordinate the DVSA swap. This is essential to the service you have contracted for.

4.2 With Payment Processors

We use Stripe and GoCardless to process payments. These third parties have access to your payment information solely to process transactions on our behalf. They are bound by strict data protection obligations and cannot use your data for other purposes.

4.3 With Communication Service Providers

• Email: SMTP service (primary) and Resend (fallback) for sending transactional and marketing emails
• SMS: Voodoo SMS (UK provider) for sending match notifications to Plus and Pro tier subscribers

4.4 With Infrastructure and Hosting Providers

• Railway: Cloud hosting platform (UK-EU region)
• Backblaze B2: File storage
• Cloudflare: CDN and security services

4.5 With Error Monitoring Services

We use Sentry for error tracking and monitoring. They may receive technical data and error logs that could contain personal information.

4.6 Legal and Safety Purposes

We may disclose your information if required by law, court order, or to protect the rights, property, or safety of TestSwap, our users, or the public.

4.7 Business Transfers

If TestSwap is involved in a merger, acquisition, or sale of assets, your personal data may be transferred. We will notify you before your data is transferred and becomes subject to a different privacy policy.

6.1 Active Accounts

While your account is active, we retain all account and listing data to provide the service.

6.2 Inactive Accounts

If you cancel your subscription or do not use the service for 12 months, we may anonymize or delete non-essential data. Account credentials and basic profile information are retained for 2 years after last activity.

6.3 Match History

Completed match records are retained for 7 years for legal and dispute resolution purposes. After this period, they are anonymized.

6.4 Financial Records

Transaction records and invoices are retained for 7 years to comply with UK tax and accounting regulations.

6.5 Deleted Accounts

When you request account deletion, we delete or anonymize your personal data within 30 days, except where we are legally required to retain it (e.g., financial records).

6.6 Marketing Data

If you opt out of marketing communications, we retain a suppression record of your email address to ensure we don't contact you again.

7.1 Right of Access

You can request a copy of all personal data we hold about you. We will provide this within one month of your request.

7.2 Right to Rectification

You can update inaccurate or incomplete data through your account settings or by contacting us.

7.3 Right to Erasure ("Right to be Forgotten")

You can request deletion of your personal data, subject to certain exceptions (e.g., legal obligations to retain financial records).

7.4 Right to Restrict Processing

You can request that we limit how we use your data in certain circumstances (e.g., while we verify accuracy of disputed data).

7.5 Right to Data Portability

You can request a copy of your data in a structured, machine-readable format (e.g., JSON, CSV) to transfer to another service.

7.6 Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we have compelling legitimate grounds.

7.7 Rights Related to Automated Decision-Making

Our matching algorithm uses automated processing. You have the right to request human intervention, express your point of view, and contest decisions made solely by automated means.

7.8 Right to Withdraw Consent

Where processing is based on consent (e.g., marketing emails), you can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

9.1 Essential Cookies

Required for authentication, security, and basic service functionality. These cannot be disabled.

• next-auth.session-token - Session authentication (NextAuth)
• next-auth.csrf-token - CSRF protection

9.2 Analytics Cookies (Optional)

Help us understand how users interact with the service. You can opt out in your browser settings.

9.3 Third-Party Cookies

• Stripe: Payment processing and fraud prevention
• Cloudflare: Security and CDN services