1. Who we are and what this covers

DealerPricing (we, us) runs www.dealerpricing.co.uk: a vehicle pricing and valuation platform for motor traders, one-off vehicle history and service history checks for anyone, free MOT and DVLA checks, and a developer API. This policy explains what personal data we collect, why, who we share it with, how long we keep it and your rights under the UK GDPR and the Data Protection Act 2018. We are the controller of the data described here. Questions or requests: support@dealerpricing.co.uk.

2. What we collect

2.1 Information you give us

One-off checks (no account): the email address you give to receive a vehicle history or service history report, and the registration numbers you check.
Trade accounts: name, business name, email address, phone number, postcode and website, password (stored as a hash), and the settings you save.
Developer accounts: company name, website, a named contact and phone number, email address, password (hashed), and the API keys you create (we store only a hash and a short prefix of each key).
Payments: handled by our payment provider, Square. We receive confirmation of payment, the amount, the last four digits and brand of the card, and a reference; we never see or store full card numbers.
Messages: anything you send us by email or through the contact form.

2.2 Information created when you use the services

Searches and checks: the registration numbers and VINs you look up, when, and the results returned, including saved reports.
Developer API usage: a log of each request (endpoint, registration or VIN, cost, response status, timing, IP address) and any callback URLs you give us.
AI assistant connections: if you connect an AI assistant (such as Claude or ChatGPT) to your trade account, we record which assistant you connected and when, and a log of each request it makes for you (the tool used, the registration or VIN, the result status, whether it used one of your searches, timing, the assistant's software name and IP address), and a record of each change to your tokens and connections (created, renamed, revoked, removed, connected or disconnected) with the IP address, approximate location (town and country, worked out from the IP address by our hosting provider) and browser it came from, so a leaked or shared token can be traced. If one token is used from more than three different networks in a day, we email you and our support team so you can check it; access is not suspended. Access tokens are stored only as hashes. We do not receive or store your conversation with the assistant: we see only the specific request it sends us.
Teams: if you own, manage or join a team on a trade account, we keep a log of team activity (invites and resends, people joining, leaving, being removed or moved between branches, role changes, branch and team deletions, seat changes and ownership transfers), with the email address of the person who acted and the person affected. The team owner, and a branch manager for their own branch, can see this log and the searches and reports made on the team's plan, as the team's Data Visibility setting allows. Reports paid from the team's balance or searches stay with the team when a member leaves.
Technical data: IP address, browser and device type, pages visited, and cookies described in section 8.

2.3 Vehicle data and personal data

A registration number or VIN describes a vehicle, but it can be linked to a person, so we treat vehicle data as personal data where that is possible. Our reports do not contain the name or address of a vehicle's keeper.

3. How we use it and our lawful basis

To provide the service you asked for (contract): running checks and searches, emailing your report, keeping saved reports available, running your subscription or developer account, taking payment and processing refunds.
To run and protect the platform (legitimate interests): security, fraud and abuse prevention, rate limiting, fixing faults, measuring which features are used and improving them.
To communicate with you (contract and legitimate interests): service emails about your account, orders, payments and changes to terms. Marketing emails only with your consent, which you can withdraw at any time.
To help you finish signing up (legitimate interests): when you start a trade sign-up, the details you enter in each step (name, email, phone number, business name and address, and the plan you chose) are saved as you go, so you can pick up where you left off. If you do not finish, we may send you one reminder email with a link back to your sign-up, and our team may contact you to help. Every reminder has an unsubscribe link. Card details are never saved: they go straight to our payment provider.
To understand our customers and tailor our marketing (legitimate interests): we combine what you have bought from us (for example the vehicles you ran checks on, with their make, model, year, fuel type and gearbox, and when you bought them), where you found us, and whether you have an account or started signing up, into a customer profile. We use it to decide which offers and news are relevant to you, for example telling a frequent buyer of history checks about our trade plans. We do not make decisions about you that have legal or similarly significant effects, and we never sell profiles. You can object at any time by emailing us or using the unsubscribe link in any email; a profile never overrides your email choices.
To comply with the law (legal obligation): accounting records, responding to lawful requests, and the rules of the registers we query.

4. Where vehicle data comes from

To answer a check or search we send the registration number (or VIN) to the sources that hold vehicle records: the DVLA and the DVSA, licensed providers of vehicle, finance, insurance write-off and stolen-vehicle data, vehicle manufacturers' dealer-network service records, valuation providers and market-listing providers. They receive the vehicle identifier and, in some cases, our account reference - not your name or email. Their own privacy notices govern what they do with it.

We do not sell personal data. We share it only with:

Processors that run the platform for us: hosting and databases (Supabase, Vercel, Railway), payment processing (Square), transactional email (Zoho Mail), the language model that powers the support chat (Ollama), and error and analytics tooling. Each acts on our instructions under a contract.
Data sources as described in section 4.
AI assistants you connect: when you connect an assistant and approve it on our consent screen, we send it the vehicle data and account information it requests for you (valuations, specification, MOT and service history, comparable listings, your live stock, your recent searches and your remaining search allowance). We never send it your password, payment details or balance-spending ability. The assistant's provider (for example Anthropic or OpenAI) is an independent controller of what it receives and handles it under its own privacy policy. You can disconnect an assistant at any time in Profile → AI assistants, which stops access immediately. If you instead create a private token or connector URL there and choose to allow paid history checks, the assistant can also run a history check from your balance, only after you confirm each one and within the limits you set for that token.
Developer API customers: if you use a product built on our API, that business is its own controller of what it collects from you; we receive only the vehicle identifiers it sends us.
Authorities and advisers where the law requires or to establish, exercise or defend legal claims.
A buyer or successor of our business, who would take on this policy.

6. International transfers

Our data is stored in the UK and the European Economic Area. Some processors may access it from other countries, including the United States; where that happens we rely on the UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. Developer API customers outside the UK are responsible for their own transfers of the data we return to them.

7. How long we keep it

Vehicle history reports (one-off buyers and trade accounts alike): you can open a report for six months from purchase. After that it is no longer available to you. We keep a copy of what the report showed, and the data it was built from, for six years from the date of the check, in a restricted archive that only our staff can reach, so that we can deal with a query, a payment dispute or a legal claim about what a report said. The email address the report was sent to is removed after 18 months (the period within which a card payment can be disputed); the sale record (date, registration, amount, buyer type and payment reference) is kept with our accounting records. A registration number and a payment reference can still identify you indirectly, so we treat these records as personal data.
One-off service history reports: six months from purchase, then deleted. Payment references are kept for our accounting records.
Dashboard searches: a search you have run can be re-opened from your recent searches for 90 days, after which it is deleted. Service history results on a trade account are kept while the account is open.
Business statistics: monthly totals, such as the number of accounts, searches and reports sold, are kept indefinitely. They contain no personal data.
Measurement records: daily totals like the monthly ones above, and records of how our service is used (for example which website or assistant a purchase or sign-up came from, failed sign-up attempts and subscription changes), are kept indefinitely so we can measure the business. Contact details from failed sign-up attempts are removed after 18 months. Any other contact details or account references in those records are removed or replaced with an irreversible code after six years (seven for payment records).
Customer profiles: rebuilt every night only from the records described above, so a profile is kept no longer than those records. For example, when the email address on an old history check is removed after 18 months, it is removed from the profile at the next rebuild.
Unfinished sign-ups: the details saved while signing up are deleted after 30 days if the sign-up is not finished. When it is finished they move to your account and the saved copy is removed.
Closed accounts: account data is deleted or anonymised within 90 days of closure, except records we must keep.
Developer API usage records: the log of chargeable requests is the record of what was supplied for the money received, so it is kept for six years with our accounting records. Security details in it (IP address) are removed after 12 months.
AI assistant connections: the request log and the record of token and connection changes (both with IP addresses) are kept for six months. A token or connection is kept until you revoke or disconnect it, then for six months after that as a security record, even if you remove it from your list; expired sign-in codes and access tokens are deleted within seven days.
Team activity log: 18 months from each entry, then deleted.
Payment and accounting records: six years after the end of the financial year, as UK tax law requires.
Security and access logs: sign-in records for up to 12 months. Records of paid one-off checks (email, IP address and browser) for 18 months where the check succeeded, so we can answer a payment dispute, and 12 months otherwise.
Emails and support messages: up to two years after the conversation ends.
Support chat: the chat on our site is automated. Conversations, and the name and email address a visitor gives to start one, are kept for 12 months so we can follow up and improve the answers; a ticket raised from a chat is kept with support messages. The text of a conversation is sent to the language model provider to generate replies and is not used to train models.

8. Cookies and similar technologies

We use essential cookies to keep you signed in, protect forms against forgery and remember choices such as your theme. With your consent we use analytics cookies to understand how the site is used. You can accept or reject non-essential cookies in the banner and change your choice at any time in Manage preferences; browser settings can also block cookies, though essential parts of the site may then not work. Local storage is used for conveniences such as a dismissed notice or a draft.

9. How we protect it

Data is encrypted in transit and at rest with our hosting providers. Passwords and API keys are stored as hashes. Access to production data is limited to the people who need it, and paid reports can only be opened by the account or email address that bought them. No system is perfectly secure; if we discover a breach that affects you we will tell you and the Information Commissioner's Office as the law requires.

10. Your rights

You can ask us to:

give you a copy of the personal data we hold about you;
correct data that is wrong or incomplete;
delete your data, where we do not need to keep it;
restrict or object to how we use it, including any use for marketing;
provide the data you gave us in a portable format;
withdraw consent where we rely on it.

Email support@dealerpricing.co.uk; we reply within one month. You can also complain to the Information Commissioner's Office at ico.org.uk, although we would like the chance to resolve your concern first.

11. Children and third-party links

Our services are for adults and businesses; we do not knowingly collect data from anyone under 18. The site links to other websites, including data sources and guides; their privacy practices are their own.

12. Changes to this policy

We update this policy when our services or the law change. The date at the top shows the current version; material changes are notified to account holders by email.

13. Contact

DealerPricing · support@dealerpricing.co.uk · contact form · see also our Terms of Service and Developer API Terms.

Privacy Policy