Privacy

TyresGone Ltd, Company No. 17458749, registered office 1 Coldharbour Court, Micheldever Road, Andover, Hampshire, SP10 2BL is the controller of the personal data described here. Contact: privacy@tyresgone.co.uk.

Registered with the Information Commissioner's Office (ICO), registration number ZC261102.

Where the data comes from. We copy the Environment Agency's public register of waste carriers, brokers and dealers for England, from its Public Registers Online service. Contains Environment Agency information © Environment Agency and/or database right. We did not collect this information from you. We also match registrations by business name and postcode to other Environment Agency registers (scrap metal dealer site licences, end-of-life vehicle treatment facilities, waste exemptions T8 and T9, and waste operations permits); only the fact of a match is kept, never a holder name, address or postcode from those registers.

What we hold. What the register publishes: business name, registration number, tier, registration type, registered address and postcode, expiry date, and a Companies House number if the register gives one. We add the date we last copied the entry, the town and county worked out from the postcode, and whether the entry has left the register. For a registration with no company number, we show the town and postcode district, not the street address.

Why. So that garages and other businesses can check a carrier is registered before handing over waste, and keep a record of that check. The law makes the business that produces waste responsible for where it goes, and checking registration is part of meeting that duty. It also helps keep waste away from unregistered carriers.

Lawful basis. Legitimate interests, Article 6(1)(f) UK GDPR: the interests of waste producers in meeting their duty of care, the public interest in reducing illegal waste carrying, and our interest in running this service. We have weighed these against your interests. Our assessment is available on request.

Where the data goes. The pages are public and search engines index them. Our service providers process the data for us: Cloudflare runs our database and API and stores Marketplace photos and signatures privately (Cloudflare R2), and our hosting provider hosts the site. Our hosting provider also counts visits to the site for us, with a 30-minute session-id cookie, recording the page address, the browser's language and the referring link; we use these counts to see how many people visit and which pages they open. Where a provider handles data outside the UK, we rely on UK adequacy regulations or the provider's contractual safeguards.

How long. For as long as the entry is on the register. When an entry leaves the register we hide it from browsing, and delete it two years later, the period a business may need to show it checked a carrier.

What we never do. We do not change the register's content. We do not say a business is off the register unless a later copy has confirmed it. We do not approve, endorse, accredit or recommend any carrier. Paying for a TyresGone plan does not change how an entry's register details are shown or ordered.

Your right to object. You can object to us showing your entry at any time. Email privacy@tyresgone.co.uk with the registration number. We will stop showing the entry unless we have compelling legitimate grounds that override your interests, rights and freedoms. We will tell you our decision and the reasons within one month. If you tell us you have a safety concern, we hide the page within one working day while we consider it.

Getting something corrected. If our copy differs from the register, we fix it. If the register itself is wrong, the correction has to be made with the Environment Agency; it reaches this site the next time we copy the entry.

Server logs. Requests are logged with the IP address and basic request details, to keep the service running and to spot abuse. Kept for 30 days. Lawful basis: legitimate interests.

Counting visits. We count visits to each page, as a number per day for each kind of page and for the advert or link that brought people here, to see which pages help and what to fix. It uses no cookies and nothing that identifies you. Lawful basis: our legitimate interest in improving the service. You can object at any time with “Don’t count me” on the cookies page, and we do not count visits from a browser that sends Global Privacy Control.

Live lookups. To cap lookups against the Environment Agency, we keep a keyed, one-way hash of your IP address, never the address itself. Deleted daily.

Preferences in your browser. Your audience and route choices, viewed checks, watch requests, sign-in token, the plan you were choosing and optional measurement choice can be stored in this browser. Details are on the cookies and storage page.

Collection Records made through the Marketplace. We keep each record: its number and date, the load's waste, quantities and prices, the garage's and the collector's business names and the garage's site postcode, the collector's vehicle plate, both signatures (stored privately), and a copy of the collector's entry in our copy of the public register when the load was taken and when it was collected. Both parties can see and download the record. Lawful basis: the contract between each party and TyresGone, and our legitimate interest in keeping a reliable record both parties can rely on. We keep it for 3 years after the collection, then delete it.

Collection Records made outside the Marketplace. When a collector creates a Collection Record, the details they enter (the garage's business name and postcode, the date, the quantity, the destination and any note) are used only to lay out the PDF they download, and are not kept. We keep the record's number, its date and a keyed hash of its content, used only to stop a repeated submission creating a second number. We also keep one running count of how often each collector's QR code is opened; the QR link sets no cookie and keeps nothing about the person who opens it.

You give us an email address only for something that has to reach you: an expiry watch, a record of your checks, a sign-in code or link, or claiming a business profile. We use it for that and nothing else. When you claim a business, we compare your claim with the public registers, Companies House included. Emails are sent through Resend. We keep your address until you remove the watch, close the record or ask us to delete it. Lawful basis: providing the service you asked for, Article 6(1)(b). For a sign-in code we keep a keyed hash of your address and of the code, never either one itself, until the code is used or, at the latest, an hour after it expires. If you choose Continue with Google, Google tells us your email address and that Google has confirmed it. We ask Google for nothing else and keep nothing from Google. We count sign-ins, by day and by method (Google or code), and count failed attempts the same way. To know how many people sign in for the first time, we keep a keyed, one-way hash of the email address with the date and method of its first sign-in, never the address itself. Failed attempts are counted with no hash at all. None of this is sent to PostHog. The hash is kept until you ask us to delete your details. Lawful basis: legitimate interests, so we can tell whether sign-in works.

One email each time the registration's entry on the register changes. For an upper-tier registration, one 90 days and one 30 days before it expires; lower-tier registrations do not expire, so they get no expiry reminder. Nothing else, ever. Stop it in one click. We do not share the address, and we do not use it for anything you did not tick.

What we keep. Your email address, whether you are a garage or a collector, your postcode district if you gave one, whose link you came through if any, your docket number and the date you confirmed.

Why. To email you once when the Marketplace opened (13 October 2026), and to show you your own docket. The list takes no new names.

Lawful basis. Your consent, given by confirming the address (UK GDPR Article 6(1)(a)).

How long. A request that is not confirmed is deleted within seven days. A confirmed entry is deleted when you leave, or 90 days after the opening email.

Nothing on the list is shown publicly or sold. The emails are sent by Resend for us, as with our other emails. You can leave at any time through the link in every email. Questions to privacy@tyresgone.co.uk.

If you hold a collector account, you can add the registration marks (number plates) of your vehicles. Where the keeper is a sole trader, a registration mark is personal data. You provide it. We use it to hold your plan to its vehicles and to print it on the Collection Records your account creates. It is never on a public page. It is shown to the garage whose load the vehicle takes, and printed on that Collection Record. You can remove it at any time from the Vehicles screen of your account. Lawful basis: the contract.

Garage site photos are stored privately and shown publicly only when the garage marks them public. A garage's street, postcode, phone and access notes go only to the collector who took its load. Vehicle plates and bases are never public.

Payments are handled by Stripe. You enter your card details on a payment page run by Stripe at billing.tyresgone.co.uk, and we never see or store them. Stripe processes your payment on our behalf. It also uses some of your details as a separate controller, for example to prevent fraud and to meet its own legal and regulatory duties; its privacy policy is at stripe.com/privacy. In the UK, Stripe's regulated payment services are provided by Stripe Payments UK Ltd, authorised by the Financial Conduct Authority. Stripe stores data in the United States and relies on the UK Extension to the EU–US Data Privacy Framework and the UK International Data Transfer Addendum for transfers from the UK. For a paid plan, we keep your email address, your Stripe customer reference, your plan, its status and billing dates, and records of invoices and payments. Apart from invoices and payment records, these details follow the retention stated above for your email address. We keep invoices and payment records for six years, because tax law requires it. Lawful basis: the contract, and our legal obligation to keep accounts.

You can ask for a copy of what we hold about you, and ask us to correct it, delete it or restrict how we use it. You can object as described above. No decision with legal or similarly significant effects is made about you by automated means. Email privacy@tyresgone.co.uk; you will get an answer within one month. If you are not satisfied, you can complain to the Information Commissioner's Office at ico.org.uk.

A banner at the bottom of the screen asks whether PostHog may see how you use the site, with two equal answers, Yes and No. PostHog is never loaded unless you say yes. Your answer is kept in your own browser; we do not ask again after a no, and “Cookie choices” at the foot of every page lets you change it. Some cookies are needed to keep the site working and secure and are set without asking; the cookies and storage page lists every one.

Product analytics and session replay. If you say yes, TyresGone also uses PostHog Inc. as a data processor to understand how pages are used and to replay sessions. The data is hosted in the EU (Frankfurt) and is used solely to improve the TyresGone service, never for advertising. Nothing is sent to PostHog before you answer, or at all if you say no. Everything you type into a form, and personal details such as names, email addresses, phone numbers, street addresses and vehicle registration plates, are masked in recordings. When you are signed in we send PostHog only an internal account number and whether you use TyresGone as a garage or a collector, never your email, name, phone or company name. Recordings are kept for 30 days. Lawful basis: your consent, Article 6(1)(a), which you can withdraw at any time through the “Cookie choices” link in the footer; withdrawing stops recording and clears PostHog's cookie and storage in this browser.

Posting by photo or by words. When a garage chooses to post by photo, the photo is sent to Anthropic (the Claude API) to estimate how many tyres it shows. When a garage chooses to post by words, the text is sent to Cloudflare Workers AI to turn it into a draft. Neither is stored by TyresGone and the photo is not logged. Speech is turned into text by the garage's own phone keyboard.

Photo of the pile. A garage can add one photo of the pile to a load. Only collectors who can see that load, and the collector who takes it, are shown it. It is removed when the load is cancelled or expires, and 30 days after collection.

Last updated 24 October 2026. If we start using personal data in a new way, this page changes before we do.