Privacy Policy

1. Who we are

autoza.co.uk ("Autoza", "we", "us") is an AI-first vehicle marketplace operated by Mesabook Limited trading as Autoza, an Irish-incorporated company (Companies Registration Office number 801808) with its registered office at County Dublin, Ireland. We are the data controller for personal data processed through autoza.co.uk.

Because we are established in Ireland but offer goods and services to individuals in the United Kingdom, both the UK GDPR and the Data Protection Act 2018 apply to our processing of UK personal data, and the EU GDPR applies in parallel. The Privacy and Electronic Communications Regulations 2003 (PECR) govern our use of cookies and electronic marketing in the UK.

Our UK ICO registration is currently: Registration in progress. The appointment of our UK GDPR Article 27 Representative is being processed via Rivacy and full contact details will be published on this page once finalised.

2. What personal data we collect

2.1 Buyers

• Account data: name, email, password (hashed), phone number, profile photo.
• Listing preferences: saved searches, favourites, recently viewed vehicles, finance enquiry inputs.
• My Vehicles: if you add a vehicle you own to My Vehicles, its make, model, year, registration and the details and dates you enter, and the service records you confirm or dispute for it (see 2.6).
• Mark chat history: the messages you exchange with Mark, our buyer-side AI assistant, including any vehicle criteria you share.
• Enquiries: messages you send to dealers via the Autoza platform, including any phone number or email address you type into them.
• Voice messages: if you record a voice message for Mark or Aidan, the recording is sent to OpenAI to be turned into text.
• Trust Score: a points score on your account that goes up when you verify your email address, phone number or identity. It is not shown to other people at present. An account needs a score of at least 20 to send the first message in a new conversation, as a check against scam accounts.
• Optional identity document: only if you choose to upload one (a passport or UK photocard driving licence) on the Verification page. It is used only to confirm who you are, it is kept in private storage, a member of our team reviews it, and it is never shown publicly. We keep it while your account is open, unless you ask us to delete it sooner. We do not ask for or collect National Insurance numbers.

2.2 Dealers

• Account data: business contact name, work email, password (hashed), phone, role.
• Business details: trading name, company number, VAT/registered address, opening hours, services offered, social handles, logo and showroom imagery.
• Listings: vehicle data and images you upload or import.
• Review invitations: if you invite a customer to review you, the customer's name and the email address or phone number you give us (see 2.5).
• Trust Score: a score held on your dealer account. It starts at a figure we set when your account is created, and changes when it is recalculated from the verification steps on your account and your account's activity. It is not shown on your dealer page or on your adverts at present, nor to buyers you message, on your public user page or in the dealer details our public data feed returns.
• Billing: billing address and Stripe customer reference when a paid subscription is active (card data is processed directly by Stripe and never touches our servers).

2.3 Everyone (website visitors)

• Analytics: advert views, taps on an advert's phone, WhatsApp and share buttons, and blog article reads, counted on our own servers. So that one visitor is not counted twice, our server uses your network (IP) address to make a one-way scrambled code and keeps that code, not the address; for advert views the code is also made from the date, so it changes every day. You can stop this counting at any time (see our Cookies Policy, section 3.3). Only if you accept analytics cookies: Google Analytics (pages viewed, approximate location, device/browser type, referring site, with IP addresses truncated). We use no advertising identifiers.
• Cookies and similar technologies: see Section 9 and our Cookies Policy.
• Support correspondence: emails, WhatsApp messages and form submissions you send us.
• Registration checks: if you use our free registration check, the registration number you type. We pass it to the DVLA and DVSA to get the answer (see 4.2) and show you what they return. We do not store the registration or the result, we do not write either to our logs, and neither goes into the address of any page on our site. (The DVSA's service takes the registration in the address of the request our server makes to it, which is not a page of our site; see 4.2.) The check needs JavaScript so that the registration is never sent as part of a page address. To stop misuse we count requests using a one-way code made from your network (IP) address, and delete those counters after about two days.
• Mark, if you are not signed in: Mark does not keep a chat history for you. To apply the daily message limit we keep only a count, against a one-way code made from your network (IP) address and your browser tab. The count is kept with no message text and no IP address. The one exception is a question you ask Mark to pass to our team: we keep that question, the recent messages around it and the name and email address you give us, so that we can reply to you. We keep it for 12 months, then delete it.

2.4 Dealership contact details we did not get from you

Sometimes we hold business contact details for a dealership that we did not get from you directly. UK GDPR Article 14 requires us to tell you what we hold and where it came from, so:

• What we hold: the dealership’s trading name, business email address, business phone number, website, town and postcode, the type of vehicles sold, which website or stock system the business uses, a contact name where the business publishes one, and — where the business is incorporated — its registered company name and company number. We also keep a record of the emails we send you and your replies, and notes of any phone calls with you.
• Where we got it: almost all of it from publicly accessible sources. Principally Google Business Profile / Google Maps listings, followed by the dealership’s own public website (including public web records, such as security-certificate logs, that show which website or stock system a business uses), the DVSA’s published list of MOT testing stations, the public member and dealer directories of trade bodies and manufacturers (for example The Motor Ombudsman, the BVRLA, the BIMTA and Honda), the Companies House public register, and the Scoot business directory. A small number of Northern Ireland dealerships were passed to us by the team that runs our website for the Republic of Ireland, which came across them in its own work. We do not buy marketing lists, and we do not take prospect data from other vehicle marketplaces.
• Why we hold it: to tell UK dealerships about Autoza, which is a service aimed specifically at their trade. Our lawful basis is legitimate interests (promoting a relevant B2B service to businesses). We have carried out a balancing assessment; because the details are business contact details, almost all of them already public, and we stop immediately on request, we consider the impact on any individual to be minimal.
• How long: there is no fixed end date. We do not delete these records on a timetable. If you object, we stop contacting you at once. If you reply STOP, we also mark your record do-not-contact straight away; if you tell us in your own words, we mark it once we have read your reply. We keep that marked record, with no end date, so that we never contact you again. If you would rather we deleted it, ask us and we will treat it as an erasure request. We will still keep your email address, or your company’s email domain, on our do-not-contact list so that we never contact you again, and we will tell you what else we still hold, such as copies of emails we exchanged, and why.
• How to stop it: reply STOP to any email from us, or email info@autoza.co.uk. You have an absolute right to object to direct marketing under Article 21 — you do not have to give a reason, and we must stop. We action these immediately and permanently.

If you would like to know exactly what we hold about your dealership, or want it deleted, ask us and we will tell you and act on it.

2.5 People a dealer invites to leave a review

A dealer can create a review link for one of their customers. To do that the dealer gives us the customer's name and email address or phone number, and may add the vehicle and a note. We use these details only to create and track that review invitation; we do not use them for marketing. If this is you and you would like the details deleted, email info@autoza.co.uk.

2.6 Mechanics, garages and service centres (Vehicle Logbook)

• Application details: your business name, area, phone number, website, specialisms, and your Companies House number (limited company) or HMRC tax reference (sole trader), plus a VAT number if you give one.
• Photo ID and business documents: uploaded when you apply. They are kept in private storage, a member of our team reviews them to decide whether to approve your account, and they are never shown publicly. We keep them while your account is open, unless you ask us to delete them sooner.
• Service records you log: the vehicle's registration, the work done, any parts and the date. A record is shown publicly on the vehicle, with your business name, only after the vehicle's owner confirms it.
• Reviews: people linked to one of your confirmed records can review you, and your average rating is shown on your public profile.

2.7 People using Autoza through an AI assistant

Autoza runs a free, read-only service that AI assistants, such as ChatGPT and Claude, can use to search the cars listed on Autoza and to use our calculators for you (our “MCP server” at autoza.co.uk/api/mcp).

• What we receive: the name of the tool the assistant used and the details it sent with it, for example a make, a model, a budget or a town. We do not receive your name, your email address or your conversation with the assistant, and we ignore the optional details some assistants add, such as an approximate location or anonymised user, session or organisation identifiers.
• What we keep: we do not store the details sent with a request. We keep only a daily count of how many times each tool was used and how many requests failed, with nothing about who made them.
• Who else processes it: our hosting provider (see 4.1) handles each request and keeps short-lived technical logs, such as an IP address and the time, for security and reliability.
• Your assistant: the company that provides the AI assistant you use is responsible for your conversation and account under its own privacy policy.
• Lawful basis: our legitimate interests in providing this service and keeping it secure. Questions: info@autoza.co.uk.

3. How we use your data and the lawful basis

Under Article 6 UK GDPR we rely on the following lawful bases. For each category we set out the purpose, the basis we rely on, and how long we keep the data.

4. Who we share your data with

4.1 Service providers (processors)

We use the following carefully-selected processors. Each is bound by a written data-processing agreement that mirrors Article 28 UK GDPR.

• Vercel Inc. — website hosting and serverless functions (London region).
• Neon — PostgreSQL database hosting (London region).
• Amazon Web Services (AWS S3) — image and file storage (London region).
• Google (Google Workspace, including Gmail) — our email. Messages you send to info@autoza.co.uk, our replies, and our emails to dealers are handled and stored in Google Workspace.
• Resend — transactional email delivery.
• Anthropic and OpenAI — large-language-model processing for Mark and Aidan. OpenAI also turns voice messages into text. Both providers' API terms say data sent through their APIs is not used to train their models.
• Twilio — SMS verification codes and, where a dealer uses Aidan, the WhatsApp message that passes a buyer's question on to that dealer.
• Stripe — payment processing for dealer subscriptions. Not in use at present: listing on Autoza is currently free.

4.2 Other organisations that receive data

• Google sign-in — if you choose to sign in with Google, Google tells us your name and email address and handles that sign-in under its own privacy policy.
• DVSA and DVLA — when you, a dealer, Mark or Aidan look up a vehicle, its registration number is sent to the DVSA MOT History service and the DVLA Vehicle Enquiry Service to fetch its MOT and tax records. The same is true when a visitor uses our free registration check: the registration they type is sent from our server to both services — to the DVLA in the body of a POST request, and to the DVSA in the address of the request, which is how its service takes it — and is not stored by us.
• NHTSA (the US Department of Transportation) — if you use the VIN lookup while creating a listing, your browser sends that vehicle's VIN straight to NHTSA's free vehicle-decoding service in the United States to fill in the vehicle's details. NHTSA also receives your IP address, as any website you connect to does.
• postcodes.io and OpenStreetMap (Nominatim) — postcodes and place names from listings and searches are sent to these services to work out where they are on a map.
• YouTube and Vimeo — where a dealer has added a video, the video player is loaded from YouTube (Google) or Vimeo when you open that page.

4.3 Marketing partners

We do not currently share personal data with third-party advertising or marketing partners. If that changes we will update this policy and, where required, obtain your consent first.

4.4 Buyers and dealers on the platform

The platform exists to connect buyers and dealers. When you message a dealer, the dealer can see your name, the message content and any contact details you choose to share. If the dealer uses Aidan, Aidan also shows the dealer a summary of your messages and how ready you seem to buy. When a dealer publishes a listing, the dealer's public business profile is visible to all visitors. Buyers can leave reviews of dealers, which become public. Where a dealer's stock reaches us through their dealer-management system, we also send a copy of your enquiry (the car, your name, email, phone number and message) to that dealer's own system, so it is filed with their other enquiries.

4.5 Legal disclosures and business transfers

We may disclose personal data where required by law (e.g. a court order or a request from the police or HMRC) or in connection with a merger, acquisition or sale of the Autoza business — in which case we will notify affected users.

5. International data transfers

Our website, database and file storage are hosted in London, in the United Kingdom (Vercel's London region, Neon and Amazon Web Services' London region). Some of our providers are based in the United States (notably Anthropic, OpenAI, Google and our email and SMS providers) and personal data may be transferred there.

For transfers out of the UK we rely on the UK's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with the European Commission's Standard Contractual Clauses for transfers out of the EEA. Where the UK Government has recognised an adequacy decision or "Data Bridge" for the destination country, we rely on that. We carry out transfer risk assessments before onboarding any new non-UK/EEA processor.

6. Your rights under UK GDPR

You have the following rights in relation to your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your data (the "right to be forgotten"), subject to legal retention obligations.
• Restriction — ask us to suspend processing while a query is investigated.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests, or to direct marketing at any time.
• Automated decision-making — Autoza does not make solely-automated decisions that produce legal or similarly significant effects on you. Mark and Aidan provide AI-generated recommendations and information but a human-led contracting process remains in place. When a dealer uses Aidan, Aidan rates how ready a buyer seems to buy (cold, warm or hot) from the words in their messages, to help the dealer decide whom to reply to first; the dealer still decides how to respond. You can object to this at any time.
• Withdraw consent — where we rely on consent, you can withdraw it at any time.

To exercise any of these rights, email info@autoza.co.uk. We will respond within one month, as required by UK GDPR Article 12(3).

7. Supervisory authorities — ICO and Irish DPC

You can complain to whichever supervisory authority is more convenient for you. Both supervise the processing of personal data on autoza.co.uk.

The UK GDPR is published at legislation.gov.uk. The Data Protection Act 2018 is at legislation.gov.uk/ukpga/2018/12.

8. UK Representative (UK GDPR Article 27)

Because Mesabook Limited trading as Autoza is established outside the UK but offers services to UK residents, we are appointing a UK representative through Rivacy as required by Article 27 UK GDPR. Current status: UK Representative appointment in progress (Rivacy).

Once the appointment is finalised, full contact details (name, postal address and contact email of the UK representative) will be published in this section. In the meantime, UK individuals can contact us directly at info@autoza.co.uk and we will respond to requests with the same UK GDPR timelines.

9. Cookies and similar technologies

In summary: we use a small number of strictly-necessary cookies for sign-in and security, browser storage for features you use (such as your comparison list), markers in your browser tab that stop one visit to an advert or article being counted twice, and Google Analytics cookies only if you accept them via our consent banner. We count advert views and blog reads on our own server, as described in section 2.3. We use no advertising cookies. Our Cookies Policy has the complete list of everything stored on your device and explains how to change your settings.

10. Data retention

Concrete retention periods:

• Active accounts: retained while your account is open.
• Closed accounts: retained for 6 years after closure to satisfy UK tax and accounting obligations (HMRC); then deleted or fully anonymised.
• Mark chat history: kept while your account is open, so you can pick up where you left off. It is deleted when you close your account (unlike the other records of a closed account above), or sooner if you ask us at info@autoza.co.uk. Mark keeps no chat history for visitors who are not signed in (see 2.3).
• Website analytics: anonymised after 14 months.
• Security and access logs: 12 months.
• Registration checks: the registration you type and the result are not stored. The request counters that limit misuse are deleted after about two days.
• Marketing suppression list (unsubscribes): kept indefinitely so we don't email you again after you opt out.
• Dealership contact records we did not get from you (section 2.4): no fixed end date. After an objection the record stays, marked do-not-contact, so we never contact you again. A request to delete it is handled as an erasure request, as section 2.4 explains.

11. Security

We take security seriously and apply technical and organisational measures appropriate to the risk, including:

• Encryption in transit via TLS 1.2+ for every page and API.
• Encryption at rest for the production database and image storage.
• Role-based access control with least-privilege defaults.
• Hashed passwords (we never store passwords in plain text).
• Monitoring, anomaly detection and regular vulnerability review.
• Breach notification: in the unlikely event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware and notify affected individuals without undue delay where the risk is high, as required by Articles 33 and 34 UK GDPR.

No system is ever 100% secure, but we work hard to keep your data safe and to learn from incidents that occur anywhere in the industry.

12. Children

Autoza is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please email info@autoza.co.uk and we will delete it promptly.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or other factors. When we do, we will update the "Last updated" date at the top of this page. Material changes will be notified to registered users by email or by a prominent notice on the site.

14. Contact us

For any privacy-related question or to exercise your rights:

• Data controller: Mesabook Limited trading as Autoza
• Postal address: County Dublin, Ireland
• Email: info@autoza.co.uk
• WhatsApp: +353 87 459 9273
• UK Representative: UK Representative appointment in progress (Rivacy)