How long we keep things
IN EFFECT FROM 12 SEPTEMBER 2026
We keep a record for as long as there is a reason to, and then we remove it. This page lists every kind of record the site holds, the period it is kept for, and the reason. A nightly job enforces these periods — the dates below are not aspirations, they are what runs.
The schedule
Booking and journey records — 6 years and 1 month
Kept for six years after the journey to meet HMRC record-keeping rules and to answer a billing or insurance query. After that the personal details on the booking — the names, the contact details, the pick-up and drop-off addresses — are erased and only the anonymous commercial figures remain.
Payment records — 6 years and 1 month
The card itself is held by Stripe, not by us. Our own ledger — the amount, the last four digits, the Stripe reference — is kept for six years alongside the booking it settled, for tax and chargeback purposes, then erased with it.
Saved addresses and recent quotes — 1 year and 6 months
Conveniences the account offers back to you when you book. Any that has not been used for eighteen months is dropped automatically, and you can remove one at any time from your account page.
Abandoned quotes — one month
A quote you started and did not pay for leaves a row with your email on it so a controller can follow it up. It is deleted within a month if nothing comes of it.
Sign-in sessions — one month
A session lasts thirty days and then you are signed out. Expired sessions and used sign-in links are cleared within a month of lapsing.
Notes from your chauffeur, and where the car was when they sent one — 3 months
A chauffeur can send the office a note about a journey — bags left at a door, or an address where nobody answered — and, if they tap to do so, where their phone was at that moment. It settles a question about what happened. These are kept for ninety days after the journey and then deleted, note and location together. They are never used for anything except answering a query about that journey.
Where the car is during your journey — only while the journey is happening
While a chauffeur has your job open on their phone, the control room can see roughly where the car is, so that it can answer you if you ring. Only the last position is held, never a trail, and it is erased the moment the chauffeur marks the journey finished. The one exception is a journey you change while it is under way: the fare for it is worked out from where the car had got to, so that single position is copied onto the record of the change as the evidence behind the amount charged, and is kept with the booking under the six-year period above rather than erased at the end of the journey. One position for one change, never a trail.
Control-room audit trail — 6 years and 1 month
Every change a controller makes to a booking is logged with their name. Kept for six years to answer a dispute, and it deliberately survives the deletion of the staff account that made the change.
Reviews you leave us — until you close your account
A review is saved against your account and a copy is emailed to our reviews inbox so a person reads it. It is kept for as long as your account is open and deleted with it.
Your account — until you close your account
Your name, email address and telephone number are kept for as long as your account is open. Close it and they are removed within thirty days — see below.
What “erased” means for a booking
A booking is not deleted outright at six years, because the business has to keep a commercial and tax record of work it did. What is removed is everything that ties that record to a person: the passenger name, the contact email and telephone number, and the pick-up and drop-off addresses. What remains is the shape of the job — the date, the class of car, the fare, the mileage — with nobody’s name on it.
Closing your account
You do not have to wait for any of these periods. Closing your account removes your name, email and telephone number, your saved addresses and your saved quotes within thirty days. Bookings you have already taken stay on the system as above — a journey the control room ran is a record we are required to keep — but they are detached from your account and fall under the six-year booking period, at the end of which they are stripped of personal detail like any other. Close your account from the account page.
The audit trail
Every change a controller makes to a booking is logged against their name, and that log is kept for six years. It deliberately outlives the staff member’s own account: an audit trail that forgets who did something the moment they leave the firm is not one. It records staff actions, not customer behaviour.
Backups
The database is backed up for disaster recovery. A record removed from the live system may persist in an encrypted backup for a short period until that backup rotates out of retention, after which it is gone from there too. Backups are never used to repopulate deleted data.
This sits alongside the privacy policy, which explains what each record contains and the lawful basis for holding it.