Privacy Notice

Find Me A Car UK is the data controller for the personal data described here.

Contact: findmeacar-uk@outlook.com.

[FOR LEGAL REVIEW: confirm the controller's registered name and address, and whether ICO registration is required for this processing.]

This list was compiled from what the system actually stores, not from a template. If something is not listed here, we do not hold it.

• Account: your email address, a display name if you give one, a password stored only as a scrypt hash, and whether your email is confirmed.
• Seller profile: a display name, postcode, and your contact preferences.
• Adverts: vehicle details, registration, mileage, price and price history, description, your declarations about the vehicle, postcode, and the advert's status history.
• Photographs: the images you upload, and their dimensions and file details.
• Enquiries: for a buyer, the name, email address, optional phone number and message they send a seller.
• Reports: the reason, any detail given, and an optional email address if the reporter supplies one.
• Security: a SHA-256 hash of your session token, and salted hashes of your IP address and browser user-agent. We do not store raw IP addresses.
• Rate limiting: hashed identifiers and counts, used to stop abuse. These expire automatically.
• Email records: which kind of message was sent, when, whether it was delivered, and a salted hash of the recipient — not the address itself.
• Audit events: a record of consequential actions such as publishing, selling, suspending or reporting an advert.

We do not hold payment card details, bank details, date of birth, government identity documents, or your precise location. We do not use analytics or advertising trackers, and we do not sell or share your data with advertisers or data brokers.

• To run your account and publish your adverts — performance of our contract with you.
• To pass buyer enquiries to sellers — performance of our contract, and our legitimate interest in operating a marketplace.
• To send service email such as verification, password reset and enquiry notifications — performance of our contract.
• To prevent fraud, abuse and misuse — our legitimate interest in protecting users, and yours in not being defrauded.
• To keep records of consequential actions — our legitimate interest in being able to investigate disputes and reports.

A published advert is public. It shows your vehicle details, photographs, price, the town and approximate distance derived from your postcode, and whether you are a private seller or a trader.

Your email address is never shown publicly. Buyers contact you through FMAC, and we pass their message to you.

Your phone number is shown only if you explicitly choose to show it. Your full address is never shown — only the town and distance.

A draft advert is not public. Its photographs are not publicly accessible.

Only the suppliers needed to run the service:

• Our email provider, to deliver service messages.
• Our hosting and database providers, who store the data on our behalf.
• Our object-storage provider, which holds uploaded photographs.
• Law enforcement or another authority, where we are legally required, or where we reasonably believe it necessary to prevent fraud or harm.

Account and advert data is kept while your account is open, and for a period afterwards where we have a legitimate reason.

Sold and withdrawn adverts are retained rather than deleted. Their history and photographs are evidence if a dispute or report arises later.

Security and audit records are kept longer than ordinary account data, because their purpose is to investigate things that come to light after the fact. Deleting them on request would defeat their purpose and remove protection from other users.

Rate-limiting records expire within hours.

[FOR LEGAL REVIEW: fixed retention periods should be set for each category before public launch.]

You have the right to ask for a copy of your data, to have inaccurate data corrected, to ask us to delete data, to object to or restrict processing, and to complain to the Information Commissioner's Office.

During beta these requests are handled manually. Email us and we will respond within one month.

We cannot always delete everything. Where we have a legal obligation, or a legitimate need to retain fraud, security or audit records, we will keep that specific data and tell you what we have kept and why. We will not simply refuse the request.

We aim to keep data within the UK or European Economic Area. Where a supplier processes data elsewhere, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or Addendum.

[FOR LEGAL REVIEW: confirm each supplier's processing region once provisioned, and record the transfer mechanism.]

This is version 2026-08-25. We record which version you accepted and when.