← Back to The Lemon Check

Privacy Policy

Updated 22 October 2026

The Lemon Check is operated by M & S CRANES Pty Ltd, ABN 58 604 165 693 (we, us, our). We are committed to handling personal information responsibly. This policy explains what information we collect when you use www.thelemoncheck.com, purchase a report, request support or subscribe to email updates; how we use and share it; and how you can contact us about it.

1. What personal information we collect

Depending on how you use our services, we may collect:

We collect information directly from you, automatically through website use, and from providers that confirm payments, deliver emails or return vehicle-search results. If you do not provide information needed for a purchase or search, we may be unable to supply that service. Marketing signup is optional.

2. Why we collect information and how we use it

We use information to process payments; find or prepare Common Faults Reports; perform VIN-based PPSR and available NEVDIS searches; deliver reports, purchase confirmations and certificates; recover report access; respond to enquiries and complaints; manage refunds; prevent misuse; diagnose failures; and meet legal and accounting obligations.

Common Faults research uses the vehicle year, make and model. We do not include your payment email address, card details or private report link in requests to our third-party research provider.

If you separately choose to subscribe, we use your email address for occasional used-car buying tips and Lemon Check updates. Purchasing a report does not, by itself, give us permission to send marketing emails. You can unsubscribe using the link in a marketing email or contact support@thelemoncheck.com. Unsubscribing does not prevent purchase-related messages or recovery emails you request.

We do not sell or trade your personal information.

3. Disclosure to third parties

We share information with third-party providers as needed to operate and deliver our services. Stripe processes secure payments and payment confirmations. Other third-party providers support website hosting, database and certificate storage, purchase and recovery emails, optional marketing subscriptions, vehicle-model research, VIN-based PPSR and available NEVDIS searches, certificate retrieval, technical logs and software-error monitoring.

The information shared depends on the service being provided. For example, our research provider receives vehicle year, make and model without the customer details described in section 2; our VIN-search provider receives the VIN needed to conduct the search; and email providers process the email address and message content needed for delivery.

Our software-error monitoring is configured to avoid deliberately sending customer identity, cookies, request headers or bodies, URL query details, payment information, private report links, database values or vehicle-research content. Our private operating dashboard uses aggregate service figures and non-personal records of corrections, source checks and support incidents.

We may also disclose information where required or authorised by law, or where reasonably necessary to investigate misuse or protect legal rights. Our providers handle information under their own privacy policies and applicable service agreements.

Some third-party providers process information outside Australia. Our currently documented arrangements include email data processing in the United States and software-error data storage in Germany. Other processing locations depend on provider infrastructure, subprocessors and account settings. Contact us for further information about overseas processing and the providers involved.

Stripe's privacy information is available at stripe.com/privacy. You can contact us for privacy information about our other third-party providers.

4. Payment security

Stripe handles card transactions through its secure payment service. The Lemon Check does not receive or store your full card number or card security code. We retain payment references and purchase information needed to confirm payment, provide access, handle support and maintain accounting records.

Please do not send card details to us by email or through support enquiries.

5. Storage, retention and security

Application records are stored with our third-party database and storage providers. Email content and delivery records are processed by our third-party email providers. Our support correspondence is handled through our support email service.

We generally keep purchase, accounting, report-access, support, email-consent and unsubscribe records for at least five years from creation or last meaningful use. Common Faults Report versions and their supporting sources are also retained as business and service records. Records may be retained longer when needed for ongoing report access, unresolved matters, legal or accounting requirements, or to respect unsubscribe preferences.

Exact Vehicle Check data is treated differently. VIN-search results and the official certificate are available through the purchaser's private link for up to 14 days. After expiry, scheduled cleanup removes the VIN, results and certificate from the active Exact Vehicle Check record. Separate purchase, payment, delivery and support records remain subject to the retention arrangements above. Removal from active records does not mean every copy in provider systems, previously delivered emails or rotating backups is erased immediately; provider retention and backup processes may also apply.

Technical logs and provider-held records follow the applicable system settings and provider retention requirements. Unsubscribing does not automatically delete separate purchase or support records.

We take reasonable technical and organisational steps to protect information against misuse, interference, loss and unauthorised access, modification or disclosure. These include restricted access, private report access controls, monitoring and backups. No online service can guarantee absolute security. Treat your private report link as confidential and contact us if you believe it has been shared without your permission.

The website stores small browser preferences to remember whether you have joined the email list or recently seen the signup prompt. These preferences do not contain your email address. You can remove them by clearing your browser storage.

With your permission, we use Google’s advertising measurement service (Google Ads) to understand how our advertisements perform. If you allow Google advertising cookies, we share your order reference, purchase amount, currency and report type with Google to measure how our ads lead to sales. It may process technical information such as your IP address, browser information, visits to public pages and advertising-cookie identifiers, including outside Australia. Advertising cookies are enabled only after you allow them. You can decline or change your choice using Cookie choices on public pages. This permission is separate from email-marketing consent. We do not intentionally send your email address, VIN, payment-card details or private report links through this measurement tag. When you complete a paid purchase after allowing advertising cookies, we may also send an order reference, the paid amount, currency and report product to measure sales and avoid counting the same order twice. Test payments are excluded. Advertising personalisation and enhanced conversions are not enabled.

With your separate permission for Website analytics, we use Google Analytics 4 to measure visits to public pages, traffic sources, engagement time and steps in the buying journey. We use Microsoft Clarity for click and scroll heatmaps and masked session recordings to understand where visitors have difficulty. These services may process IP addresses, device and browser information, cookie identifiers and interaction data outside Australia, including in the United States. Clarity is configured for strict text masking; we also mask page content and form entries in our website code. We do not load Clarity on private reports, payment-confirmation pages, report recovery pages or our operating dashboard. We exclude token-bearing URLs and unknown URL parameters from analytics and send clean page paths to Google Analytics. Confirmed paid purchases may send an order reference, amount, currency and product type to Google Analytics to measure sales and avoid duplicate purchases. We do not send VINs, email addresses, payment-card details, private access tokens or report contents as analytics event fields. Website analytics is disabled until you allow it, independently of Google advertising cookies. You can decline or change your choice using Cookie choices on public pages. Google signals, advertising personalisation and enhanced conversions remain disabled. Browser blocking and declined consent mean these tools do not capture every visit.

With your separate permission for Meta advertising, we use Meta Pixel to measure eligible public-page visits and confirmed purchases from Facebook and Instagram advertising. Meta may receive technical information such as your IP address, browser information, advertising-cookie identifiers and eligible page addresses, and may process this information outside Australia, including in the United States. For a confirmed live purchase, we send the paid amount in AUD and a pseudonymous order-based event reference to help avoid duplicate counting. We do not include your name, email, VIN, registration, vehicle search details, payment-card details, report contents or private access links in these events. We exclude private reports, report recovery, the inspection checklist and URLs containing vehicle queries or private access information. Automatic configuration and history tracking are disabled in our integration; Automatic Advanced Matching and automatic events must remain disabled in Meta’s settings. Meta advertising requires its own choice, independently of Google advertising and website analytics; an earlier Google choice does not opt you into Meta. You can decline or change your choice using Cookie choices on public pages. Changing consent stops future collection through this integration but does not remove information already received by a provider. Browser blocking and declined consent mean these tools do not capture every purchase. We do not enable Meta’s server-side Conversions API through this integration.

Provider information: Google Privacy Policy, Microsoft Privacy Statement and Meta Privacy Policy. Analytics and recording retention follows the applicable account settings and provider retention policies. Contact us if you need details.

6. Access, correction and removal

You may request access to personal information we hold about you, ask us to correct inaccurate or incomplete information, or request its removal. Contact support@thelemoncheck.com and describe your request and the email address used with us. Please do not include card details or private report links.

We may need to verify your identity before providing information or making changes. We will respond within a reasonable period. If information must be retained for legal, accounting, service or other legitimate reasons, we will explain what can be removed and what must remain. Where we cannot provide access or make a requested correction, we will explain our response and available complaint options.

7. Complaints

If you have a concern about our handling of personal information, email support@thelemoncheck.com so we can investigate and try to resolve it. Include enough information to explain the concern, without sending payment-card details or private report links.

We will review your complaint and respond within a reasonable period. If you remain dissatisfied, the Office of the Australian Information Commissioner provides information about privacy complaints and whether it can assist.

8. Contact us

For privacy questions, access or correction requests, unsubscribe requests or complaints:

The Lemon Check Operated by M & S CRANES Pty Ltd ABN 58 604 165 693 Email: support@thelemoncheck.com Website: www.thelemoncheck.com/contact

9. Changes to this policy

We may update this policy to reflect changes in our services, information-handling practices or legal obligations. Once approved and published, the current version will be available at www.thelemoncheck.com/privacy with its updated date. Where required, we will provide additional notice or seek consent for changes to how information is used.