Privacy Policy

Last updated 3 September 2026.

Questions about this policy or your data: support@autodemand.co.uk.

Who we are

AutoDemand is a UK stock and profit tracking tool for used-vehicle dealers.

It is operated by AutoDemand, with a trading address at *****.

We are the data controller for the personal data described in this policy. We are registered with the Information Commissioner's Office (ICO) under registration number [ZXXXXXXX].

We have not appointed a Data Protection Officer, as we do not meet the threshold that requires one. All data-related queries are handled directly by the founding team. You can reach us at support@autodemand.co.uk or in writing at the address above.

This is a business service

AutoDemand is designed for use by vehicle dealers and dealer groups operating as businesses. Where we collect personal data — such as the name and email address of the individual who creates an account — we do so in a business context. We do not knowingly collect data relating to consumers or individuals under the age of 18.

What we collect

Account details you give us directly — your name, work email address, and a hashed password. We never store your password in plain text.
Business details — your dealership or dealer group name, trading postcode, and trading radius.
Stock data you choose to enter — vehicles you add manually or upload via CSV, including registration plates (VRMs), purchase and sale prices, and mileage. Note: vehicle registration marks can, in some contexts, constitute personal data under UK GDPR. We process them solely to help you manage your own dealership's stock, on the basis of our contract with you.
Billing details — handled entirely by Stripe. We never see or store your card number or full payment details.
Usage data — audit-log entries of key actions taken on your account (for example, changes to account settings or data exports) and login timestamps. These are retained for security and fraud-prevention purposes.
Analytics data — via Google Analytics: pages viewed, actions taken on the site, and whether you arrived via a Google Ads campaign. This is subject to your cookie consent. See Cookies and Analytics below.

Why we collect it, and our lawful basis

Under UK GDPR, we must have a lawful basis for every type of processing we carry out. Here is what applies in each case:

What we process	Why	Lawful basis
Account details, business details, stock data	To provide the service you have signed up for	Contract (Art. 6(1)(b))
Billing (via Stripe)	To process your subscription payments	Contract (Art. 6(1)(b))
Transactional emails (password resets, welcome emails)	Necessary to operate your account	Contract (Art. 6(1)(b))
Weekly digest emails	Only sent if you opt in	Consent (Art. 6(1)(a))
Audit logs, login timestamps	Security and fraud prevention	Legitimate interests (Art. 6(1)(f))
Google Analytics data	Understanding how the product is used, to improve it; measuring ad effectiveness	Legitimate interests (Art. 6(1)(f)) — subject to cookie consent

Where we rely on legitimate interests, we have considered whether that interest is proportionate and unlikely to override yours, given the limited, business-focused nature of the data involved. You have the right to object to legitimate interests processing — see Your Rights below.

Cookies and analytics

We use Google Analytics to understand how AutoDemand is used and to measure the effectiveness of our advertising. Google Analytics works by setting cookies in your browser.

Under the Privacy and Electronic Communications Regulations (PECR), non-essential cookies — including analytics cookies — require your consent before they are placed. When you first visit the site, you will be asked to accept or decline analytics cookies. If you decline, Google Analytics will not be activated.

This is the only cookie category we use today. Your choice is remembered in your own browser; there is currently no in-app settings page to revisit it — to change your decision, clear your browser's cookies/site data for autodemand.co.uk, which will show the banner again on your next visit.

International data transfers

Some of the third-party processors we work with operate outside the United Kingdom. Where that is the case, we ensure an appropriate transfer mechanism is in place before any data is shared:

Stripe (payments) — may process data in the United States. Stripe relies on Standard Contractual Clauses (SCCs) with the UK addendum (IDTA) as the transfer mechanism.
Google (Analytics and Ads) — processes data in the United States. Google relies on SCCs with the UK addendum as the transfer mechanism.
Resend (email delivery) — processes data in the United States (Plus Five Five, Inc., San Francisco). Relies on the EU-U.S. Data Privacy Framework (including its UK Extension) where certified, and UK SCCs otherwise, as the transfer mechanism.
Railway (hosting) — processes data in the United States. Our specific services run in Railway's US West region. Relies on the EU-U.S. Data Privacy Framework (including its UK Extension) where certified, and UK SCCs otherwise, as the transfer mechanism.

We only work with processors we are satisfied handle data to an appropriate standard.

Who we share your data with

Stripe, Resend, Railway, and Google each process data on our behalf as necessary to run the service. We have data processing agreements in place with each of them.

We do not share your data with any other organisation for any purpose. Aggregated, de-identified market statistics — the same figures shown across the product — may be visible to other dealers on the platform. Your own stock details, purchase prices, and profit data are never shared.

Automated decision-making

AutoDemand uses automated algorithms to generate demand scores, seasonality indicators, and price forecasts. These outputs are produced without individual human review.

However, these are informational tools — they do not produce legally binding decisions or decisions that otherwise significantly affect you in the way envisaged by Article 22 of UK GDPR. The decision of whether and what to stock is entirely yours. We say clearly throughout the product which figures are algorithm-generated, which are drawn from verified data sources, and which are estimates — we never blend these without labelling them.

Special category data

We do not process any special category personal data as part of this service. This includes data relating to health, racial or ethnic origin, political opinions, religious beliefs, genetic or biometric data, sexual orientation, or trade union membership.

How long we keep it

Data type	Retention period
Account details and stock data	For as long as your account is active. Deleted when you close your account, subject to the exceptions below.
Billing records	7 years from the date of the transaction, as required for accounting and tax purposes. This applies even if your account is deleted.
Audit logs	Retained indefinitely while your account remains active; no fixed expiry date. Deleted along with your account data (see above).
Google Analytics data	Per Google Analytics' own retention settings: 2 months for event-level data, 14 months for user-level data.
Backup copies	Deleted account data may remain in encrypted backups for up to 90 days before being permanently purged.
Aggregated, anonymised statistics	Retained indefinitely. Once data is fully anonymised it is no longer personal data under UK GDPR and falls outside the scope of this policy.

When you delete your account, your personal data is removed as described on the Settings → Privacy & Data page, subject to the retention periods above.

Your rights

Under UK GDPR you have the following rights in relation to your personal data:

Right of access — you can request a copy of the personal data we hold about you.
Right to rectification — you can ask us to correct personal data that is inaccurate or incomplete.
Right to erasure — you can ask us to delete your personal data (“the right to be forgotten”). Some data may need to be retained for legal reasons, as set out in the retention table above.
Right to restriction — you can ask us to pause processing your data in certain circumstances — for example, while a correction is being investigated.
Right to data portability — where we process your data by automated means on the basis of a contract or your consent, you can ask us to provide it in a structured, commonly used, machine-readable format.
Right to object — where we rely on legitimate interests as our lawful basis, you have the right to object to that processing. We will stop unless we can demonstrate compelling legitimate grounds that override your rights and interests.
Right to withdraw consent — where we process your data on the basis of consent (for example, the weekly digest email), you can withdraw that consent at any time. You can do this from Settings or via the unsubscribe link in any digest email. Withdrawing consent does not affect the lawfulness of anything we did before you withdrew it.
Rights relating to automated decision-making — you have rights in relation to automated decisions that have legal or similarly significant effects on you. As explained in Automated Decision-Making above, our scoring tools are advisory and do not produce decisions of that nature. If you believe a specific output has significantly affected you, please contact us to discuss.

You can exercise most of these rights directly from Settings → Privacy & Data. For anything not available there, contact us at support@autodemand.co.uk or in writing at our registered address. We will respond within one calendar month.

Your right to complain

If you are not satisfied with how we handle your data or how we respond to a request, you have the right to lodge a complaint with the UK's data protection regulator:

Information Commissioner's Office (ICO)
Website: ico.org.uk
Telephone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would always prefer the opportunity to resolve a concern directly before you contact the ICO, so please do reach out to us first if you can.

Changes to this policy

If we make a material change to how we handle your personal data, we will update this page, change the date at the top, and where appropriate let you know directly before the change takes effect.

AutoDemandLegal