Privacy Policy

1. Introduction

Welcome to Fuel Finder UK ("we", "our", or "us"). We are committed to protecting your privacy and personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This Privacy Policy explains how we collect, use, store, and protect your information when you use our website and services at fuel-finder.uk.

Fuel Finder UK is operated by Scott Benson, trading as Fuel Finder UK, as an independent sole-trader project based in the United Kingdom. For the purposes of UK data protection law, Scott Benson acts as the data controller for the personal data described in this Privacy Policy.

Fuel Finder UK is a registered data controller with the Information Commissioner's Office (ICO). ICO registration reference: 00013620617. We process all user data in strict accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

2.1 Account Information

If you choose to create an account, we collect:

• Email address (required for registration)
• Password (stored in encrypted/hashed form)
• Display name (optional)
• Account creation date

2.2 User-Generated Content

When you contribute to our community features, we collect:

• Price Reports: Fuel prices you submit, associated fuel station, fuel type, and optional photo evidence
• Issue Reports: Reports of station issues (incorrect opening times, price corrections) and descriptions
• Station Suggestions: New station submissions including address, postcode, brand, and optional details
• Station Ratings: Your ratings (1-5 stars) across categories (overall, speed, reliability, safety, cleanliness) and optional comments

2.3 Favourites and Alerts

• Favourite Stations: Stations you save to your favourites list
• Price Alerts: Alert preferences including target prices, fuel types, and notification settings

2.4 Technical and Usage Data

We automatically collect certain technical information:

• IP Address: Collected with submissions (price reports, issue reports, station suggestions, ratings) for abuse prevention and fraud detection
• Device Information: Browser type, operating system, and device type (for push notification subscriptions)
• Session Data: Session identifiers for maintaining your logged-in state and tracking anonymous favourites
• Search Logs: When you run a nearby-stations search, we may log the search coordinates, selected fuel type, radius, sort mode, results count, pricing summary, IP address, and user agent for aggregate service statistics, abuse prevention, troubleshooting, and service improvement
• Analytics Data: Basic usage data such as page views, referrers, and device/browser information to understand how the service is used and improve it, where analytics cookies have been accepted

2.5 Location Data

We may collect or process location data in the following ways:

• GPS/Device Location: Only when you explicitly grant browser permission to use your location for finding nearby stations or planning a route
• Search Coordinates: Coordinates used for a search or route request may be processed on our servers and may be logged with associated technical metadata for service operation, abuse prevention, troubleshooting, and aggregate statistics
• Postcode/Address Searches: Search terms you enter may be sent to third-party geocoding services such as postcodes.io or Nominatim/OpenStreetMap to convert them into coordinates. We do not routinely store the free-text search term in our search-log records

Fuel Finder UK does not perform background location tracking. Location permission can be revoked at any time through your browser settings.

2.6 Push Notification Data

If you enable push notifications, we store:

• Push subscription endpoint (browser-specific URL)
• Encryption keys for secure message delivery
• Device/browser information
• Notification preferences and quiet hours settings

2.7 Payments (Pro Subscription)

If you subscribe to Pro, payment processing is handled by Stripe. Fuel Finder UK does not store, process, or have access to your full payment card number or CVV. We store limited billing metadata such as your Stripe customer ID, subscription ID, plan interval, and subscription status so that we can activate, manage, and support your subscription.

2.8 Vehicle Garage

If you save vehicles to your account's garage for fuel cost calculations, we store each vehicle's type, fuel type, consumption figures, and any optional name you give it, linked to your account. Garage vehicles are retained until you delete them or delete your account.

2.9 Station Manager and Forecourt Data

If you use the forecourt price submission service as a station owner, manager, or operator, we additionally collect and process:

• Access Requests: Your business name, your role, a contact phone number, verification notes you provide, and the station you are requesting access to. Access requests are sent to our monitored inbox for review and a record of the decision is kept.
• GOV.UK Credentials: If you connect your trader organisation's GOV.UK Fuel Finder credentials so that price changes reach the official service, those credentials are encrypted before they are stored in our database and are used solely to submit prices to GOV.UK on your behalf. They are never displayed back in full or shared with anyone else.
• Submission Records: An audit log of each price submission (station, prices, timestamps, and outcome) is kept as a permanent record for accountability, troubleshooting, and compliance purposes.
• Service Notifications: We email station managers about the outcome of their submissions, including failures that need action and confirmations of scheduled price changes.

3. Lawful Basis for Processing

Under UK GDPR, we process your personal data on the following lawful bases:

• Contract: Processing necessary to provide our services when you create an account, use account features, or subscribe to Pro
• Consent: Where you have given explicit consent, such as for analytics cookies and push notifications
• Legitimate Interests: For abuse prevention, fraud detection, limited search logging, service improvement, aggregate reporting, and maintaining platform integrity

4. How We Use Your Information

We use the collected information to:

• Provide our fuel price comparison and route planning services
• Create and manage your user account
• Send account verification and password reset emails
• Process Pro subscriptions and keep billing status in sync with Stripe
• Process and display your community contributions (price reports, ratings, etc.)
• Send price alert notifications when fuel prices meet your criteria
• Deliver push notifications you have opted into
• Calculate and display your community points, achievements, and leaderboard position
• Prevent abuse, spam, and fraudulent submissions
• Determine trusted reporter status based on submission accuracy
• Operate the forecourt price submission service for station managers, including verifying access requests, submitting prices to GOV.UK on their behalf, and notifying them about submission outcomes
• Generate aggregate, non-user-facing service statistics such as search volumes, average savings, and feature usage
• Improve our services through aggregated, anonymised usage analysis

5. Data Storage and Retention

5.1 Local Storage (Your Device)

Some preferences are stored locally on your device using browser localStorage, including your analytics cookie choice, fuel type preference, and display preferences. This data can be cleared through your browser settings. Note that vehicles saved to an account's garage are stored on our servers (see Section 2.8), not only on your device.

5.2 Server Storage

Data stored on our servers includes:

• Account data: Retained until you delete your account, unless we need to retain limited records for legal, security, or fraud-prevention reasons
• User contributions: Price reports, ratings, and suggestions may be retained indefinitely to maintain historical fuel-price records, moderation history, and community integrity
• Favourites and alerts: Retained until you remove them or delete your account
• Email verification/reset tokens: Automatically expire after 24 hours
• Push subscriptions: Retained until you unsubscribe, revoke permission, the subscription fails, or we determine the subscription is stale
• Search logs and associated technical metadata: Retained for as long as reasonably necessary for aggregate reporting, abuse prevention, troubleshooting, and service improvement, and then deleted or anonymised when no longer required for those purposes
• Stripe billing identifiers and subscription records: Retained for as long as needed to manage your subscription, deal with disputes, comply with tax/accounting obligations, and maintain an audit trail
• Station manager access requests: Retained while the request is open and afterwards as a record of the access decision
• GOV.UK credentials (station managers): Retained in encrypted form while your account remains connected to the GOV.UK service; removed when you disconnect them or on request
• Price submission audit logs (station managers): Retained as a permanent record of submissions for accountability and compliance
• Garage vehicles: Retained until you delete the vehicle or your account

5.3 Image Storage

If you provide photo evidence for reports, we store the image URL alongside the report. The image itself remains hosted by the service you used to upload it.

6. Cookies and Similar Technologies

We use the following cookies:

• Session Cookie (sessionid): Essential cookie that maintains your logged-in state. Duration: 30 days. This cookie is secure (HTTPS only) and HttpOnly (not accessible to JavaScript).
• CSRF Token (csrftoken): Essential security cookie that protects against cross-site request forgery attacks.
• Analytics Cookies (e.g., _ga, _gid): Used by Google Analytics to measure usage and improve the service.
• Advertising and consent technologies: On ad-supported pages, Publift Fuse and related consent tools may store or read cookies and similar identifiers to deliver and measure ads, limit repeat impressions, and remember your privacy choices where required by law.
• ClickTripz partner offers: On the anonymous homepage, ClickTripz may use cookies or similar identifiers to support and measure hotel offers. If you choose a location-matched offer, ClickTripz and the selected travel provider may also use them to deliver and measure that offer.

We use Google Analytics to understand basic usage patterns and improve the service only where you have accepted analytics cookies. Essential cookies remain active because they are necessary for core site functionality. You can review browser cookie settings at any time and use the controls on this page to update both your analytics and advertising choices.

7. Third-Party Services

Our service integrates with the following third-party services:

• postcodes.io: For UK postcode lookups. Your postcode search may be sent to their servers to retrieve coordinates.
• OpenStreetMap/Nominatim: For geocoding place names and addresses into coordinates. Your search location may be sent to their servers. Privacy Policy
• CARTO: For map tiles (basemaps). Your device requests tiles from their servers.
• OSRM (Open Source Routing Machine): For route planning functionality. Start and end coordinates are sent to calculate routes.
• Open Charge Map: For EV charging point locations.
• Google Analytics (Google Tag): For basic usage analytics, where analytics cookies have been accepted. Privacy Policy
• Publift Fuse: For ad delivery, monetisation, and ad-performance measurement on supported pages. Privacy Policy
• InMobi Choice CMP: For storing and managing advertising consent choices in regions where this is required. Privacy Policy
• ClickTripz: For optional, location-matched hotel comparison offers shown after a place search. The ClickTripz native tag may load on the anonymous homepage to support and measure travel offers. A request to the ClickTripz offer API is made only after you click the clearly labelled partner offer. That request includes the searched place, which may be a postcode, the device category, and the site page without its query string. The raw page query string, coordinates, and account tokens are not included in the traffic source sent to ClickTripz. Standard browser request information may also be processed so an available offer can open in a new tab. Privacy and opt-out choices
• Stripe: For hosted checkout, subscription billing, and payment processing for Pro subscriptions. Privacy Policy
• IONOS: For sending transactional emails (verification, password reset, price alerts). Your email address is processed by their servers. Privacy Policy
• Render: Our hosting provider. The application and its database run on Render's infrastructure, so all data described in this policy is processed on their servers under a data processing agreement. Privacy Policy
• Cloudflare: Provides our content delivery network and security layer. All requests to the site pass through Cloudflare, which processes IP addresses and request metadata to protect against attacks and speed up delivery. Privacy Policy
• GOV.UK Fuel Finder (Department for Energy Security & Net Zero): For station managers only. Prices submitted through the forecourt service, together with the manager's connected trader credentials, are sent to the official GOV.UK Fuel Finder service to meet the reporting mandate.
• carVertical: Partner offering discounted vehicle history checks in the member savings area. Their banner content loads from carVertical's servers only on member savings pages. If you click a carVertical offer link, standard affiliate tracking parameters are included; no personal data or vehicle details from your account are sent. Privacy Policy

Each of these services has their own privacy policies governing their data handling practices.

8. Email Communications

We send the following types of emails:

• Account Verification: One-time email to verify your email address when you register
• Password Reset: Sent when you request to reset your password
• Price Alerts: Notifications when fuel prices drop below your set threshold (you can unsubscribe from each alert individually)
• Price Pulse Digest: A weekly fuel-price intelligence email sent only after you submit the Price Pulse form and confirm the subscription through a double opt-in email. You can subscribe without creating an account and unsubscribe at any time.
• Station Offers: Occasional offer notifications from a specific forecourt's manager (for example a weekend price promotion), sent only to users whose alert or favourite settings make them eligible for that station's area. Every offer email includes an unsubscribe link.
• Station Manager Service Emails: If you use the forecourt price submission service, emails about your access request, submission outcomes, and scheduled price changes

Price alerts, station offers, and Price Pulse emails include an unsubscribe route appropriate to that service. Price Pulse consent is stored separately from registered-account marketing preferences, and unsubscribing from it does not alter your account alerts. Fuel Finder UK never shares your email address with third parties for their own marketing purposes.

9. Data Sharing

We do not sell, rent, or trade your personal data to third parties for their own direct marketing. Where the site displays advertising, advertising and consent providers may process limited browser, device, page-view, cookie, and identifier data to serve and measure ads and store your privacy choices, subject to applicable law and your consent selections. We share data only in the following circumstances:

• Service Providers: With third-party services listed in Section 7, solely for providing our services
• Advertising and Partner Offer Providers: With Publift Fuse, InMobi Choice CMP, ClickTripz, and related providers where advertising or an optional partner offer is shown and consent choices need to be recorded or applied
• Public Display: Your display name (if set), community contributions, and leaderboard position may be publicly visible to other users
• Legal Requirements: If required by law, court order, or to protect our legal rights

10. International Data Transfers

Some of our third-party service providers may process data outside the United Kingdom. In particular, our hosting provider (Render) is a United States company, and Cloudflare operates a global network, so data may be processed outside the UK by those providers. Where this occurs, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement, Standard Contractual Clauses, or adequacy decisions, to protect your data in accordance with UK GDPR requirements.

11. Your Rights

Under UK GDPR, you have the following rights:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data (subject to legal retention requirements)
• Right to Restrict Processing: Request limitation of how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us using the details in Section 15. We will respond to your request within one month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been violated: ico.org.uk/make-a-complaint

12. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• HTTPS encryption for all data transmission
• Password hashing using industry-standard algorithms (PBKDF2)
• Secure, HttpOnly session cookies
• CSRF protection on all forms
• Content Security Policy headers
• Rate limiting to prevent abuse
• Secure token generation for email verification and password reset

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

13. Children's Privacy

Our Service is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will delete such information.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the updated policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.

15. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or have concerns about how we handle your data, please contact us at:

Email: [email protected]

Data controller: Scott Benson trading as Fuel Finder UK. ICO registration reference: 00013620617. If you need to exercise your data protection rights or send a legal notice, please contact us by email first. While I endeavour to respond to all enquiries, there may be some delay in response times.