Legal
Cookie Policy & Preferences
Last updated: 10 September 2026
Cookies and similar browser storage help keep you signed in and remember your preferences. Optional analytics and marketing tools stay off unless you consent.
Your cookie preferences
These choices are stored on this device. You can change them whenever you like.
1. Categories of cookies we use
- Strictly necessary - sign-in, session, cart, security and fraud prevention. These cannot be switched off.
- Preferences - remember your region, recent searches and saved vehicles.
- Analytics - help us understand which parts of the Service are used so we can improve it. This includes first-party Core Web Vitals and Google Analytics when configured.
- Session replay - no session-recording or replay tool is configured.
- Marketing - reserved for future consented advertising or campaign measurement. No marketing tool is currently configured.
2. Managing your choices
Use the preference panel above to switch analytics and marketing tools on or off at any time. Your choice is stored on this device - if you sign in from another browser you'll be asked again. Withdrawing consent stops future Core Web Vitals events and Google Analytics collection; you can also clear cookies and local storage in your browser settings.
Most browsers let you block or delete cookies via Settings > Privacy. For more information visit aboutcookies.org.
3. Services and browser-side tools
The table below lists the services and optional browser-side tools integrated into SpareCarPart, what they do, and which consent category controls them.
| Vendor | Purpose | Cookies / storage | Category |
|---|---|---|---|
| Lovable Cloud (Supabase) | Database, sign-in, file storage | Auth session in localStorage | Strictly necessary |
| Vercel | Website hosting, delivery and platform security | Processes normal request connection information while delivering the site | Strictly necessary (security) |
| Stripe | Card payments at checkout | Set on Stripe's own domain during checkout only | Strictly necessary (when paying) |
| Core Web Vitals | First-party page performance measurements | Sends metric, rating, coarse page area, navigation type and browser user-agent to our Supabase database; no cookie | Analytics - consent required |
| Google Analytics (when configured) | Optional aggregate website usage measurement | Only loads after analytics consent and when a Measurement ID is configured; it is disabled while no ID is configured | Analytics - consent required |
| OpenRouter | Routes Part Finder, Health Check and image-generation requests to selected model providers | None in your browser - server-to-server only | Strictly necessary (when invoked) |
| Google Gemini | Processes Mech chat messages and any part photos attached in chat | None in your browser - server-to-server only | Strictly necessary (when invoked) |
| Groq | Transcribes a Mech microphone recording into editable text after you tap the mic | None in your browser - audio is sent server-to-server only after permission | Strictly necessary (when invoked) |
| DVLA & DVSA MOT | Vehicle & MOT lookups | None - server-to-server only | Strictly necessary (when invoked) |
| Parts catalogue partners | Reference part listings | None - server-to-server only | Strictly necessary |
Optional analytics tools are off by default and load only after consent. No session replay, advertising or retargeting vendor is currently configured.
4. Smart Finder, AI Chat & catalogue search
Our Smart Finder, AI Part Finder and AI Chat features work without analytics or marketing consent. Here's exactly what happens when you use them:
- Photo identification - Smart Finder images are sent to our server and routed through OpenRouter to a selected model provider for identification. We require routes marked by OpenRouter as no-data-collection and Zero Data Retention (ZDR). A photo attached directly to Mech chat is instead processed server-to-server by Google Gemini. The image is not attached to your account unless you save it to a part request, and we do not sell it or share it for advertising.
- Mech chat - chat text and chat attachments are processed by Google Gemini under a Cloud Billing project. Google states that Paid Service prompts and responses are not used to improve its products, but may be logged for a limited period for abuse prevention and legal compliance.
- Mech voice input - microphone access starts only when you tap the mic and approve the browser prompt. The short recording is sent through our server to Groq Whisper for transcription, then placed in the composer for you to review; it is not auto-sent as a chat message and no third-party browser cookie is set.
- Catalogue results - when we show matching listings from participating catalogue partners, the search runs server-side from our backend. The external catalogue never sees your browser or IP address, and no third-party tracking cookies are set on your device.
- Basket & recent searches - saved in your browser's local storage as a strictly-necessary preference so your basket survives a refresh. You can clear it from the basket page or your browser settings.
- Rate limiting - to prevent abuse we record the request count per IP address for a short window. This is essential and is not used for advertising or profiling.
Because none of this relies on analytics or marketing tools, the Smart Finder works the same whether you accept or reject the optional categories above.
5. Changes
If we add or change cookies in a way that affects your privacy, we will update this page and ask for fresh consent where required.