Privacy Policy

Last updated: 16 October 2026

1. Introduction

DealerAgent ("we", "us", "our") operates the dealeragent.co.uk website and platform. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our services. We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Our two roles

We handle two different kinds of personal data, and we are responsible for them in two different ways. Which one applies decides who is accountable for what, so it is worth being clear about.

We are the controller — we decide what happens to the data — for: your own account details as a dealer; people whose details appear in public vehicle adverts we read (see section 5A); and the records we keep to run and secure the platform.

We are the processor — you decide, and we act on your instructions — for: your customers and the records you build about them; enquiries and leads that reach you through us; and your sales, deals and paperwork. For that data you are responsible for having a lawful basis, and we are responsible for doing only what you ask and keeping it safe.

Questions about either: hello@dealeragent.co.uk. We will respond within one month.

3. Information We Collect

We collect the following types of information:

3.1 Account Information

  • Name, email address, and password when you create an account. The password is held in hashed form by our authentication provider (Supabase Auth) and is never stored by us in readable form
  • Business name, address, and postcode
  • Phone number (if provided)
  • Email addresses of colleagues you invite to your team, and the role you give them
  • Any custom domain you connect for your dealer web page
  • Access tokens issued by services you choose to connect — eBay, Auto Trader, Xero, QuickBooks, Stripe, Facebook, Telegram, social accounts. These are stored as ordinary database columns; see section 11

3.2 Vehicle & Business Data

  • Vehicle search criteria and preferences
  • Inventory records including vehicle details, purchase prices, and sale prices
  • Notes, costs, and preparation records you enter
  • Messages you write in the AI assistant, and messages you draft to customers or sellers
  • Documents you send for signature, including the IP address and browser of whoever signs them

3.3 Automatically Collected Data

  • IP address and approximate location
  • Browser type, device information, and operating system
  • Which screens you open, which features you use, and which actions the AI agent proposes that you approve or reject. This is first-party product telemetry stored in our own database — it is not sent to an analytics company
  • Page-load speed measurements, sent to Vercel Speed Insights (see section 8)
  • If you send us feedback: the page you sent it from, your browser and screen size, and a screenshot if you attach one
  • Cookies and browser storage (see section 8)

3.4 Third-Party Data

  • Vehicle advert data from eBay Motors, through eBay's official API, and from public advert pages on Auto Trader and Gumtree
  • Vehicle history data from the DVLA Vehicle Enquiry Service and the DVSA MOT History API
  • Market valuation data derived from the adverts above
  • Geocoding data from location service providers

4. How We Use Your Information

We use your information for the following purposes:

  • Providing our service: Matching vehicles to your search criteria, managing your inventory, generating valuations, and drafting adverts for the marketplaces and social accounts you connect
  • Communications: Sending match notifications, price drop alerts, daily briefings, and weekly digests via email (you can opt out at any time)
  • AI features: Powering the AI assistant, generating listing descriptions, analysing vehicle data and photographs, and scoring deals
  • Service improvement: Understanding how our platform is used to improve features and fix issues
  • Security: Protecting against fraud, unauthorised access, and abuse
  • Legal compliance: Meeting our legal and regulatory obligations

5. Legal Basis for Processing

We process your personal data on the following legal bases under UK GDPR:

  • Contract performance (Article 6(1)(b)): Processing necessary to provide our services to you
  • Legitimate interests (Article 6(1)(f)): Improving our services, preventing fraud, sending relevant communications about your account, and holding the advert data described in section 5A
  • Consent (Article 6(1)(a)): Joining our waiting list and receiving marketing email from us. Every such email carries an unsubscribe link, and an unsubscribed address is added to a suppression list so it is never emailed again
  • Legal obligation (Article 6(1)(c)): Where required by law

5A. If your details came from a vehicle advert

This section is our notice under UK GDPR Article 14 — the article that applies when we hold your data without having got it from you.

Our systems read vehicle adverts published on public marketplaces so that dealers can find cars to buy. Most of those adverts are placed by dealers; some are placed by private individuals. What we keep is not the same on every marketplace:

  • eBay Motors: the town and postcode district shown against the item, whether you sell as a private or business seller, your eBay feedback score, links to your photographs, and the advert text. We do not store your eBay user ID. We do not collect a phone number or email address as a separate field, but if you typed one into your description it is part of the advert text we hold
  • Auto Trader: the seller name shown on the advert, the town, postcode and map location, photograph links, and the advert text, again unedited
  • Gumtree: the town or area and whether the seller is private or trade. Your name is never read, and phone numbers and email addresses are stripped out of the advert text before it is stored
  • Facebook Marketplace: built but switched off — no data has been collected from it

We also read the vehicle's details — registration, mileage, price, specification — and look the vehicle up with the DVLA and the DVSA MOT service.

We hold this on the basis of our legitimate interest, and our dealers' legitimate interest, in operating a vehicle sourcing service for the trade. We did not obtain it from you directly, so you may not have expected us to have it.

No message is sent to a private seller from DealerAgent. A feature that would let a dealer send one enquiry about the car you advertised exists in the software but is switched off, and it will stay off until we have taken legal advice on it.

How long we keep it. An advert we can no longer see on the marketplace is marked inactive after 48 hours. Seven days after that, the listing is archived and deleted, and the archive keeps only the vehicle, town and postcode district — the seller name and the advert text are dropped. Two things are worth saying plainly: the deletion job clears at most 200 listings a night and is currently a long way behind, so seven days is the rule rather than today's practice; and a listing a dealer has acted on (saved, dismissed or bought) is kept so that their own record of the decision stays intact.

eBay adverts follow a stricter rule. Once eBay tells us an advert has ended, or it has not appeared in eBay's results for 48 hours, we delete it rather than marking it inactive, normally within a day. eBay adverts are never added to the archive described above, and the eBay adverts it held from before this rule were deleted on 26 September 2026, so it now holds none. If a dealer has acted on a car that was advertised on eBay (saved, dismissed or bought it, for example), their own notes and decision are kept, but our copy of the advert (its text, photograph links, price, location and seller details) is deleted; we keep only the eBay item number, the car's make, model and year, and the dates we first and last saw the advert, so that their decision is not lost if the car is listed again. If a dealer adds the car to their own stock records, the details, advert link and photographs copied into that record at the time stay with the dealer's record and are not deleted with the advert.

You can ask us what we hold, ask us to correct it, ask us to delete it, or object to us holding it at all. Email hello@dealeragent.co.uk with the registration or the advert. We will respond within one month, and we will not ask you to justify the request.

6. Who we share data with

We use the following categories of third party, only as necessary to provide the service:

  • Infrastructure: Vercel (hosting, custom domains, and Speed Insights page-speed measurement), Supabase (database, authentication and file storage), Railway (background processing)
  • Communications: Resend (email), Twilio (SMS and WhatsApp), Telegram (alerts you choose to receive)
  • AI providers: Vercel AI Gateway, which routes every AI request to Google Gemini models; Replicate (image enlargement)
  • Vehicle data: DVLA, the DVSA MOT History API, One Auto (provenance checks)
  • Advert sources: eBay and Auto Trader, and Apify, which would run the Facebook Marketplace scraping if we switched it on
  • Publishing: AutoTrader, eBay, Meta, Ayrshare (social posting) — only for accounts you connect yourself
  • Money and accounts: Stripe (payments), Xero and QuickBooks (accounting, if you connect them)
  • Location: Mapbox, Postcodes.io

Some of these are configured but not yet in use — where that is the case, no data has been sent to them. We do not sell your personal data, and we do not share it with third parties for their own marketing.

7. Where your data is held

Our application and our database are hosted in France (Vercel and Supabase, Paris region). Several of the providers in section 6 process data in the United States. We are currently checking the transfer terms in each of those providers' data processing agreements as part of a legal review of this notice, and this section will state the mechanism for each one when that review is finished.

8. Cookies and browser storage

We set two kinds of cookie, and nothing else:

  • Strictly necessary: the sign-in cookie set by our authentication provider. It keeps you signed in and cannot be turned off without breaking the platform
  • Preference: small cookies and browser-storage entries that remember how you left the interface — whether the sidebar is open or pinned, which view of the Buy screen you last used, card density, and which panels you had collapsed. You can clear them in your browser at any time; the interface simply returns to its defaults

Two things running in your browser send data elsewhere without setting any cookie: Vercel Speed Insights, which reports how quickly a page loaded, and Mapbox, which draws the maps on our sourcing screens and therefore sees your IP address when it loads map tiles.

We use no advertising cookies, no third-party analytics (no Google Analytics, no Meta pixel, no tag manager), and no cross-site tracking. If that changes, this policy will be updated before it does.

9. Data Retention

  • Account, vehicle and inventory data: kept for as long as your account exists. When you delete your account, your account record and everything that is yours alone is deleted from our database immediately, and we do not keep a copy afterwards. The one exception is your dealership's VAT records: a car you bought for the dealership, with its stock book entry, invoices and credit notes, is handed to the dealership's owner rather than deleted, because the law requires those records to be kept for six years
  • Your sign-in identity: deleting your account also removes the identity held by our authentication provider (your email address and login), at the same moment. If that step ever fails we tell you on screen, and you can email us to have it removed
  • AI conversation history: kept until you delete the conversation or your account. Nothing deletes it on a timer
  • Advert data about sellers: as described in section 5A
  • A dealership's audit trail: a record of who changed a price, recorded a sale, issued a credit note or refund, filed with DVLA, handled a privacy request or changed a team member's role. It names the staff member and their role and the record's reference (an invoice or stock number), never a customer's name or contact details. Nobody can edit or delete a line. Each line is kept for six years, like the VAT records it describes, and then removed automatically; a line records that the removal happened
  • Unsubscribe and do-not-contact lists: kept indefinitely, because that is the only way the suppression keeps working
  • Server logs: held by our hosting providers under their own retention periods. We do not set one ourselves

10. Your Rights

Under UK GDPR, you have the following rights:

  • Right of access: Request a copy of your personal data. A dealer's customer asks the dealer, who can give you a copy from DealerAgent
  • Right to rectification: Request correction of inaccurate data
  • Right to erasure: Request deletion of your data ("right to be forgotten"). If you are a customer of a dealer that uses DealerAgent, ask the dealer: they can erase you from DealerAgent, and they keep only the records the law makes them keep (VAT invoices, credit notes, the stock book and the signed paperwork for a car you bought, normally for six years), hidden from their searches, lists and marketing. Your email and phone are then kept only as a scrambled code, so you are never marketed to again
  • Right to restrict processing: Request limitation of how we use your data
  • Right to data portability: Receive your data in a structured, machine-readable format
  • Right to object: Object to processing based on legitimate interests or for direct marketing
  • Rights related to automated decision-making: Our deal scoring and vehicle matching involve automated processing, but no decisions with legal or similarly significant effects are made solely by automated means

To exercise any of these rights, contact us at hello@dealeragent.co.uk. We will respond within one month.

11. Data Security

These are the measures actually in place:

  • All traffic between you and the platform is encrypted in transit (TLS/HTTPS)
  • Our database and file storage are encrypted at rest by our hosting provider. We do not apply a second, application-level layer of encryption to individual fields, so the access tokens described in section 3.1 sit in ordinary database columns behind that platform encryption
  • Authentication is handled by Supabase Auth; passwords are hashed and never stored by us
  • Every database query is scoped to the dealership making it, and row-level security is enabled on the database
  • Secrets are held in our hosting platforms' secret stores, not in source code
  • Access to production data is limited to authorised personnel
  • Four public endpoints are rate-limited to resist abuse

12. Children's Privacy

Our services are designed for business use by motor vehicle dealers and are not directed at individuals under the age of 18. We do not knowingly collect personal data from children.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a notice on our platform. The "Last updated" date at the top of this page indicates when this policy was last revised.

14. Complaints

If you are unhappy with how we handle your personal data, you can complain to us directly — email hello@dealeragent.co.uk and say that you are making a data protection complaint. We will acknowledge it within 30 days and respond without undue delay.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection, at any time. You can contact the ICO at ico.org.uk or by calling 0303 123 1113.

15. Contact Us

For any questions about this Privacy Policy or our data practices, please contact us at: hello@dealeragent.co.uk