Cookie notice

Last updated 24 September 2026

Draft — this document is being reviewed by a solicitor and may change before MotorPortal HQ launches publicly.

MotorPortal HQ only uses cookies and similar browser storage that are strictly necessary to make the service work — for example, keeping you signed in securely. We don’t use analytics, advertising or third-party tracking cookies, which is why you don’t see a cookie banner.

1. Strictly necessary cookies

These are set by MotorPortal HQ itself and are needed for signing in and for securely connecting other services. On our live site some names start with __Secure- or __Host-, which tells your browser to apply extra security rules.

authjs.session-token

Also named: __Secure-authjs.session-token
Purpose: Keeps you signed in to your MotorPortal HQ account.
Duration: 14 days, or until you sign out

authjs.csrf-token

Also named: __Host-authjs.csrf-token
Purpose: Protects sign-in forms against cross-site request forgery.
Duration: Until you close your browser

authjs.callback-url

Purpose: Remembers which page to return you to after signing in.
Duration: Until you close your browser

hmrc_oauth_state

Purpose: Protects the connection to HMRC while you link your Making Tax Digital account.
Duration: 10 minutes — only set while you connect HMRC

accounting_oauth_state_xero / accounting_oauth_state_quickbooks

Purpose: Protects the connection while you link Xero or QuickBooks.
Duration: 10 minutes — only set while you connect

2. Local storage and similar technologies

Some information is kept in your browser’s local storage rather than in cookies. It stays on your device until you clear it, and is only used by MotorPortal HQ.

mph_hmrc_device_id

Purpose: A random device identifier that HMRC requires software to send with Making Tax Digital requests, to help prevent fraud.
When: Only if you use the Making Tax Digital features

motorportal-dashboard-visited

Purpose: Remembers your progress through the dashboard’s getting-started steps.
When: When you use the dashboard

mphq-invite-visitor

Purpose: Stores the name you entered on the private invite page, so it remembers you’ve already filled it in.
When: Only on the private invite page

mphq-admin-key

Purpose: Keeps the platform administrator signed in to an internal admin page.
When: Platform administrator only

App cache (service worker)

Purpose: Stores MotorPortal HQ’s app icons and app manifest so the app loads quickly and can be added to your home screen. It doesn’t store personal data.
When: When you visit MotorPortal HQ

3. What we don’t use

We don’t use analytics, advertising, social media or other third-party tracking cookies. When someone views a dealership’s vehicle page, we count the view on our own servers without any cookie and without storing their IP address.

If you pay a subscription or a reservation deposit, you’ll do so on Stripe’s secure payment page, where Stripe may set its own cookies under Stripe’s cookie policy.

Because everything listed here is strictly necessary, the law doesn’t require us to ask for your consent, so we don’t show a cookie banner. If we ever add optional cookies, we’ll ask for your consent before setting them and update this page.

4. How to clear or block them

You can delete cookies and local storage for this site at any time in your browser’s settings — usually under “Privacy” or “Site data”. Signing out removes the sign-in cookie. If you block these cookies, you won’t be able to sign in or use parts of MotorPortal HQ.

5. Questions

See our privacy notice or email anaymakwana@icloud.com.