PRIVACY POLICY

RevRadar is operated by RevRadar Ltd.

This Privacy Policy explains how we collect, use, store and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

RevRadar Ltd is the data controller for personal data collected through this Service. Contact us at [email protected] for any data-related queries.

RevRadar Ltd is registered in England and Wales. ICO Registration Number: ZC199673. If you have any questions about how we handle your data, contact us at [email protected].

• Email address
• Password (stored as a bcrypt hash — never in plain text)
• A display name, only if you choose to set one
• Account creation date, and your subscription tier and status (free, Pro, or Dealer)

• Search queries and filter preferences
• Saved searches and alert settings
• Saved (favourited) listings
• Pages visited and features used
• IP address and approximate geographic location
• Browser type, device type, and operating system
• Referring website

When you are signed in, we record which listings you view (and how many times), and how you interact with on-page prompts we show you — for example a vehicle-history-check nudge, a delivery-partner suggestion, or a "thinking about this one?" prompt. We use this to decide what, if anything, to show you on the listing you are currently looking at, and to measure whether those prompts are useful. Any prompt we show refers only to the listing in front of you — never to a summary of your browsing across sessions or other cars.

• Emails you send us and our responses

• Your subscription tier, status, and billing dates
• A Stripe customer ID and subscription ID that link your account to your billing record

If you subscribe to a paid plan, payment is taken by Stripe, our payment processor. Stripe collects and processes your card details directly — RevRadar never sees or stores your card number. See section 8 for more on Stripe.

The RevRadar app can store two things the website does not.

Your home area. If you set one, we store the postcode you enter, the approximate coordinates of that postcode's centre, and your preferred search radius in miles. We use them for the "search around home" shortcut and to set the starting point for distance filters.

The coordinates are the centre point of the postcode as published by the postcode lookup service we use — they are not your device's location. The app never asks your phone for location access, and we do not collect or store GPS or precise location data. Setting a home area is optional, and clearing it in the app deletes the postcode and its coordinates together.

Push notification subscriptions. If you turn on notifications, your browser or device creates a subscription and we store it so we can deliver the saved-search alerts you have already asked for. A subscription is made up of a delivery address issued by your browser's push service, two encryption keys your device generates for that address, and a shortened description of the browser and device — so you can tell your devices apart on your account screen.

We do not receive your phone number, an advertising identifier, or any identifier that follows you between apps.

• Your payment card number (this is handled entirely by Stripe — we never receive it)
• Government ID or driving licence information
• Vehicle registration plates you search for
• Sensitive personal data (race, religion, health, etc.)

If you save a search we will send email notifications when matching listings are detected. You can:

• Delete saved searches through your account at any time
• Unsubscribe via the link in any alert email
• Delete your account to stop all communications

Push notifications (RevRadar app only). If you install the RevRadar app and allow notifications, we can deliver the same saved-search alerts as a notification as well as an email. Push follows exactly the same rules as your email alerts — the same saved searches, the same frequency for your plan, and the same opt-outs. Turning notifications off in the app or in your device settings stops them, as does deleting the saved search or closing your account.

RevRadar displays publicly available vehicle listing information from third-party platforms. We extract structured factual data (make, model, price, mileage, location) from public listings, and we also store the seller's full description text exactly as it appears on the original listing. We do not:

• Intentionally seek out or specifically target personal data about vehicle sellers
• Use any seller contact details for our own purposes, or share them with third parties

However, because listing descriptions are free text written by the seller on the original platform, they can incidentally contain a phone number, email address, or first name. Where this happens, it is publicly available information the seller chose to post; RevRadar did not solicit it and does not use it.

Since 20 August 2026, before a listing description is shown anywhere on RevRadar — search results, listing pages, and any other display surface — an automated process scans it for phone numbers, email addresses, and names directly adjacent to a phone number or email, and replaces them with a placeholder (for example, "[phone number removed]") before display. This redaction happens at the point of display, not at the point of storage: the original text a seller posted, unredacted, remains in our database. We do not currently remove or redact this information from storage itself. This automated process has been tested extensively against real listing data, but — like any automated detection — it is not a guarantee that every possible format is caught. If you believe a listing displays your personal data and wish it removed, please use our listing removal page. Removal requests are reviewed within 48 hours.

RevRadar uses a small number of strictly necessary cookies and browser local storage items to operate the service. We do not use advertising cookies, tracking cookies, or any third-party analytics cookies that identify you personally.

Cookies set by RevRadar:

• rr_rt — A secure, httpOnly authentication cookie used to keep you signed in. This cookie is strictly necessary for the login function to work. It expires after 30 days of inactivity and is never accessible to JavaScript. No consent is required for this cookie under UK PECR as it is strictly necessary.

Local storage items (not cookies):

• rr_token — Your session access token, stored locally to authenticate API requests
• rr_user — Basic account details (email, tier) stored locally to display your account information without repeated server requests
• rr_theme — Your dark/light mode preference
• rr_lat, rr_lng, rr_postcode, rr_city — Your location preference on the website, used for distance-based search filtering and, on a listing you're viewing, to work out whether it's far enough away that a vehicle-delivery partner prompt is relevant. These items are stored only on your device and are used only to decide what to show on our own pages. To turn a postcode, a town name, or your current position into coordinates in the first place, that value is sent to a location lookup service — see section 8; the coordinates that come back are kept on your device. If you instead set a home area in the RevRadar app, that is saved to your account rather than to local storage, and the postcode is checked against the same postcode lookup service — see §3.6 and section 8
• rr_view, rr_loc_tab — UI layout preferences

All local storage items are stored only on your device and are cleared when you sign out. You can clear them at any time via your browser settings.

Analytics: we use Cloudflare Web Analytics, a privacy-first, cookieless analytics tool. It measures aggregate page views and performance without setting any cookie, without cross-site tracking, and without building a profile of you or identifying you personally. See cloudflare.com/web-analytics.

We do not use Google Analytics, Meta Pixel, or any advertising or cross-site tracking scripts.

We do not sell your personal data. We share data only with:

• Resend: email delivery service for alerts and account emails — resend.com/privacy
• Cloudflare: hosting, HTTPS, and cookieless Web Analytics — cloudflare.com/privacy
• Stripe Inc: payment processing and subscription management — USA (Standard Contractual Clauses apply) — stripe.com/privacy
• Push services (Google, Mozilla, Apple): deliver notifications to your device if you turn them on in the app. They receive a message they cannot read, because it is encrypted before it leaves us — see section 5
• postcodes.io: turns a postcode into approximate coordinates — for a home area you save in the app, for a postcode you type into the location filter on the website, and to find the nearest postcode if you use the website's "use my current location" button. It receives the postcode, or in that last case your device's coordinates — never your name, email, or account details
• OpenStreetMap Foundation (Nominatim): turns a town or city name you type into the location filter on the website into approximate coordinates. It receives the place name only — never your name, email, or account details — osmfoundation.org/privacy
• Law enforcement or regulators: only when legally required

We do not share data with advertisers, data brokers, or marketing companies.

RevRadar earns commission from affiliate partners. Some links and prompts on the site — for example a carVertical vehicle-history check, a DeliverMyMotor delivery quote, or AutoAid breakdown cover — are affiliate links. If you click one you are taken to that partner's own website, and anything you do there is governed by their privacy policy, not this one. We may earn a commission if you buy, at no extra cost to you.

We do not hand your account details (email, name, search history) to these partners. An affiliate link may carry a non-identifying campaign tag (e.g. "revradar") in its URL so the partner can credit the referral — this tag does not identify you.

Resend, Cloudflare, and the push services described in section 5 may process data outside the UK. Where this occurs, appropriate safeguards are in place in accordance with UK GDPR requirements. In the case of push, the only content leaving us is encrypted and cannot be read by the service carrying it.

We retain your data for the following periods:

• Account data — Retained for the duration of your account. Deleted within 30 days of account deletion request
• Search history — Retained for 90 days, then automatically deleted
• Saved searches and saved listings — Retained until you delete them or close your account
• Home area (app) — Retained until you clear it in the app or close your account. Clearing the postcode also deletes its coordinates
• Push notification subscriptions (app) — Retained until you turn notifications off, remove that device, or close your account. We also delete a subscription automatically as soon as your browser's push service tells us the device can no longer be reached
• Waitlist entries — Retained until you request removal or are onboarded
• Listing removal requests — Retained for 12 months for legal record-keeping purposes, then deleted
• Listing view & prompt-interaction data — We track which listings you view and how you interact with on-page prompts to power features like "thinking about this one?" nudges and a distance-based delivery-partner prompt, referencing only the listing you're currently viewing — never a summary of your browsing history across sessions or other listings. Retained for 12 months. We never send automated emails based on your viewing activity — email alerts always require your explicit opt-in on a saved search. Occasionally, a member of our team may personally follow up about a specific listing you viewed, to ask how your search went and suggest relevant services; these are individually reviewed and sent by a person, never by an automated system, arrive at most once a month, reference only the single listing concerned, and every one includes a one-click unsubscribe that stops them permanently
• Email send logs (Resend) — Retained by Resend for up to 30 days per their data processing terms
• Payment records (Stripe) — Retained by Stripe in accordance with their legal obligations and privacy policy

• Right to erasure — You can delete your account at any time from your account settings page. This will permanently delete your profile, saved searches, saved listings, and search history within 30 days.
• Right to object to automated processing — Deal scoring and search ranking on RevRadar is automated. You may request that we do not apply automated scoring to your usage by contacting us, though this may limit platform functionality.

We implement appropriate technical and organisational measures including:

• bcrypt password hashing (cost factor 12)
• HTTPS encryption for all data in transit via Cloudflare
• Database access controls
• Regular backups
• Server access limited to authorised personnel

No internet transmission is 100% secure. We cannot guarantee absolute security but will notify you of any breach affecting your personal data as required by law.

RevRadar is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has provided personal data, contact us at [email protected] and we will delete it promptly.

We do not make automated decisions that significantly affect you. Our deal scoring feature is informational only and does not constitute automated decision making under UK GDPR.

We may update this Privacy Policy. For significant changes, we will notify registered users by email. The date at the top shows when it was last updated. Continued use after changes constitutes acceptance.

If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO):

We would appreciate the opportunity to address your concerns before you contact the ICO.

For any privacy queries or to exercise your rights: