Privacy Policy

1. Introduction

DealerAgent ("we", "us", "our") operates the dealeragent.co.uk website and platform. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our services. We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Our two roles

We handle two different kinds of personal data, and we are responsible for them in two different ways. Which one applies decides who is accountable for what, so it is worth being clear about.

We are the controller — we decide what happens to the data — for: your own account details as a dealer; people whose details appear in public vehicle adverts we read (see section 5); and the records we keep to run and secure the platform.

We are the processor — you decide, and we act on your instructions — for: your customers and the records you build about them; enquiries and leads that reach you through us; and your sales, deals and paperwork. For that data you are responsible for having a lawful basis, and we are responsible for doing only what you ask and keeping it safe.

Questions about either: hello@dealeragent.co.uk. We will respond within one month.

3. Information We Collect

We collect the following types of information:

3.1 Account Information

• Name, email address, and password (encrypted) when you create an account
• Business name, address, and postcode
• Phone number (if provided)

3.2 Vehicle & Business Data

• Vehicle search criteria and preferences
• Inventory records including vehicle details, purchase prices, and sale prices
• Notes, costs, and preparation records you enter

3.3 Automatically Collected Data

• IP address and approximate location
• Browser type, device information, and operating system
• Pages visited, features used, and interaction patterns
• Cookies and similar tracking technologies (see Section 8)

3.4 Third-Party Data

• Vehicle listing data from eBay and other marketplace APIs
• Vehicle history data from DVLA VES and MOT History APIs
• Market valuation data from publicly available sources
• Geocoding data from location service providers

4. How We Use Your Information

We use your information for the following purposes:

• Providing our service: Matching vehicles to your search criteria, managing your inventory, generating valuations, and facilitating marketplace listings
• Communications: Sending match notifications, price drop alerts, daily briefings, and weekly digests via email (you can opt out at any time)
• AI features: Powering the AI assistant, generating listing descriptions, analysing vehicle data, and scoring deals
• Service improvement: Understanding how our platform is used to improve features and fix issues
• Security: Protecting against fraud, unauthorised access, and abuse
• Legal compliance: Meeting our legal and regulatory obligations

5. Legal Basis for Processing

We process your personal data on the following legal bases under UK GDPR:

• Contract performance (Article 6(1)(b)): Processing necessary to provide our services to you
• Legitimate interests (Article 6(1)(f)): Improving our services, preventing fraud, and sending relevant communications about your account
• Consent (Article 6(1)(a)): Marketing communications and optional analytics (you can withdraw consent at any time)
• Legal obligation (Article 6(1)(c)): Where required by law

5A. If your details came from a vehicle advert

Our systems read vehicle adverts published on public marketplaces so that dealers can find cars to buy. Where an advert was placed by a private individual, what we hold can include the name, contact details and rough location shown in that advert.

We hold it on the basis of our legitimate interest in operating a vehicle sourcing service. We did not obtain it from you directly, so you may not have expected us to have it — and you can ask us what we hold, ask us to correct it, or ask us to delete it, at any time.

To do any of those, email hello@dealeragent.co.uk with the registration or the advert. We will respond within one month, and we will not ask you to justify the request.

6. Who we share data with

We use the following categories of third party, only as necessary to provide the service:

• Infrastructure: Vercel (hosting), Supabase (database and authentication), Railway (background processing)
• Communications: Resend (email), Twilio (SMS and WhatsApp), Telegram (alerts you choose to receive)
• AI providers: Vercel AI Gateway, Google (Gemini), Groq, Replicate (image processing), Plate Recognizer (reading number plates from advert photographs)
• Vehicle data: DVLA, the DVSA MOT History API, One Auto (provenance checks)
• Marketplaces: AutoTrader, eBay, Meta, Ayrshare (social posting)
• Money and accounts: Stripe (payments), Xero and QuickBooks (accounting, if you connect them)
• Location: Mapbox, Postcodes.io

Some of these are configured but not yet in use — where that is the case, no data has been sent to them. We do not sell your personal data, and we do not share it with third parties for their own marketing.

7. International Data Transfers

Some of our service providers are based outside the UK. Where data is transferred internationally, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office, or transfers to countries with adequate data protection as recognised by the UK government.

8. Cookies

We use essential cookies only. They keep you signed in and make the platform work; they cannot be turned off without breaking it.

We do not currently use analytics or advertising cookies of any kind. If that changes we will ask for your consent first, and this policy will be updated before it does.

9. Data Retention

We retain your data for the following periods:

• Account data: For as long as your account is active, plus 12 months after account deletion
• Vehicle and inventory data: For as long as your account is active
• Transaction records: 7 years (as required by UK tax and accounting regulations)
• Server logs: 90 days
• AI conversation history: 12 months, then automatically deleted

10. Your Rights

Under UK GDPR, you have the following rights:

• Right of access: Request a copy of your personal data
• Right to rectification: Request correction of inaccurate data
• Right to erasure: Request deletion of your data ("right to be forgotten")
• Right to restrict processing: Request limitation of how we use your data
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests or for direct marketing
• Rights related to automated decision-making: Our deal scoring and vehicle matching involve automated processing, but no decisions with legal or similarly significant effects are made solely by automated means

To exercise any of these rights, contact us at hello@dealeragent.co.uk. We will respond within one month.

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS/HTTPS), encryption at rest for sensitive data, secure authentication via Supabase Auth, rate limiting on API endpoints, regular security audits, and access controls limiting data access to authorised personnel only.

12. Children's Privacy

Our services are designed for business use by motor vehicle dealers and are not directed at individuals under the age of 18. We do not knowingly collect personal data from children.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a notice on our platform. The "Last updated" date at the top of this page indicates when this policy was last revised.

14. Complaints

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection. You can contact the ICO at ico.org.uk or by calling 0303 123 1113.

15. Contact Us

For any questions about this Privacy Policy or our data practices, please contact us at: hello@dealeragent.co.uk