Auto Market Explorer

Privacy Policy

Last updated: 22 August 2026

1. Data Controller

The data controller for information collected through the Auto Market Explorer platform (the “Service”) is AKP Ventures Ltd, a company registered in England and Wales under company number 15968817.

Contact email: [email protected]

2. Information We Collect

We may collect and process the following categories of personal data:

  • Account information — email address when you create an account.
  • Payment information — billing details processed securely through Stripe. We do not store card numbers on our servers.
  • Phone number — mobile number provided for SMS notifications (Pro plan only).
  • AI search queries — the natural-language search text you enter when using AI search.
  • Usage data — alerts created, pages visited, features used, and interaction timestamps.
  • Analytics data — if you opt in, Google Analytics and PostHog may record page views, feature usage, device/referral information, and privacy-masked session replays.
  • Technical data — IP address, browser type, operating system, device type, and timezone.
  • Communications — any correspondence you send to us via email or support channels.

3. Legal Basis for Processing

We process your personal data on the following legal bases under the UK GDPR:

  • Contract performance — to provide the Service, manage your account, and process payments.
  • Legitimate interests — to improve the Service, monitor usage patterns, prevent fraud, and ensure security.
  • Legal obligation — to comply with applicable laws and regulations.
  • Consent — where you have opted in to receive SMS notifications or marketing communications.

4. How We Use Your Information

We use the information collected to:

  • Provide, maintain, and improve the Service.
  • Process transactions and manage subscriptions.
  • Send alert notifications via email and SMS.
  • Send service-related communications (e.g. account confirmations, billing notices).
  • Respond to support requests and enquiries.
  • Analyse usage patterns to improve features and user experience.
  • Detect, prevent, and address fraud, abuse, or technical issues.

5. Data Sharing

We do not sell your personal data to third parties. We may share your data with:

  • Payment processors — Stripe processes payments on our behalf, subject to their own privacy policy.
  • SMS delivery — Amazon Web Services (AWS) Simple Notification Service delivers SMS messages to Pro subscribers.
  • AI search provider — natural-language search queries are sent to a third-party AI provider (via OpenRouter) to interpret them into search criteria, subject to their own privacy terms.
  • Hosting providers — Hetzner Cloud hosts the application; Supabase and Amazon Web Services provide managed data, email, and messaging services.
  • Analytics providers — Google Analytics and PostHog help us understand site usage and performance. PostHog session replays are configured to mask all inputs and page text.
  • Bot protection — Cloudflare Turnstile checks sign-in and sign-up attempts, subject to the Cloudflare Turnstile Privacy Addendum.
  • Legal authorities — when required by law, regulation, or valid legal process.

6. AI Search and Query Processing

When you use AI search, the text of your query is sent to a third-party AI provider (accessed via OpenRouter) so it can be interpreted into structured search criteria. We do not send your account email, payment details, or contact details to the AI provider as part of a search.

We log AI search queries with directly identifying personal data redacted. These logs are retained for a limited period to monitor for abuse and to improve the quality and reliability of the feature, after which they are deleted or further anonymised. AI search is subject to fair-use limits and the outputs are estimates that should be verified against the underlying listings.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Following account deletion, we may retain certain data for a reasonable period to comply with legal obligations, resolve disputes, and enforce our agreements.

Alert history and notification logs are retained for up to 90 days after an alert is deleted.

Optional analytics and session replay data are retained according to our configured provider retention settings and deleted when no longer needed for product monitoring and improvement.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS), secure session handling, CSRF protection, and rate-limited authentication. However, no method of transmission over the internet is completely secure.

9. Bot Protection (Cloudflare Turnstile)

We use Cloudflare Turnstile on our sign-in and sign-up pages to tell people apart from automated systems. Turnstile is necessary to keep accounts and the Service secure. It is not an advertising tool, and it does not track you across other websites.

To make this check, Turnstile collects your IP address, your browser user-agent, your connection’s TLS fingerprint, and the site key with the web address of the page you are on. It may also store a short-lived value in your browser to record that a check passed. Cloudflare processes this data on our behalf, and also uses it to improve its own bot detection.

For more detail, see the Cloudflare Turnstile Privacy Addendum and the Cloudflare Privacy Policy. To use your data protection rights for this processing, contact us first at [email protected].

10. Your Rights

Under the UK GDPR and the Data Protection Act 2018, you have the following rights:

  • Access — request a copy of the personal data we hold about you.
  • Rectification — request correction of inaccurate or incomplete data.
  • Erasure — request deletion of your personal data (subject to legal obligations).
  • Restriction — request that we restrict processing of your data.
  • Data portability — receive your data in a structured, commonly used format.
  • Objection — object to processing based on legitimate interests.
  • Withdraw consent — where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within one month.

11. Cookies

The Service uses essential cookies required for session management and security. Google Analytics and PostHog analytics, including privacy-masked session replay, are optional and only enabled after you select “Accept” in the analytics consent banner. You can reject or change this choice at any time using the Privacy preferences control. Cloudflare Turnstile may store a short-lived value in your browser as part of the security check described in section 9; this is strictly necessary and is not covered by the analytics choice. We do not use third-party advertising cookies.

12. International Transfers

Our service providers may process data in the United Kingdom, the European Economic Area, or other countries in which they operate. Where data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with the UK GDPR.

13. Children

The Service is not directed at individuals under 18. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a person under 18, we will delete it promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or by posting a notice on the Service. The “Last updated” date at the top indicates when the policy was last revised.

15. Complaints

If you are unsatisfied with our handling of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

16. Contact

For questions about this Privacy Policy, contact us at [email protected].