Privacy policy

Who we are

OpenHood is a curated marketplace for enthusiast cars, operated from the United Kingdom by Victor Ulgenes, an individual (not yet an incorporated company). For data-protection purposes that individual is the "data controller": the person responsible for your data and accountable for how it is handled. You can contact us at hello@openhood.uk.

The short version

We collect what we need to run a verified marketplace and nothing more. We do not sell your data, we do not use it for advertising, and we do not track you across other websites. Your V5C and MOT documents are stored privately and never shown to buyers. Your surname is never published: buyers only ever see your first name with the surname masked.

What we collect, and why

We only collect data for specific, stated purposes. Where the law requires a "lawful basis", ours is either performance of a contract (running your account and your listing), legitimate interests (keeping the site secure and free of fraud and spam), or your consent, as noted below.

• Account details: your email address and password. Passwords are hashed by our authentication provider; we never see or store them in readable form.
• Profile details: your name, optional phone number, and optional profile photo. Your name is shown publicly only in masked form (for example "John D****"). Your phone number and email address are never shown publicly.
• Listing details: everything you enter about a car you are selling: specification, price, location, history, modifications, known faults, and the story you choose to write about owning it. This is published on the site, so treat it as public.
• Listing photos and cold-start video: published publicly as part of your listing. Please do not upload photos containing other people, or images you do not have the right to share. Photos are stored at the quality you took them. We store a short description and tags for each photo (for example "front nearside wheel") to sort your gallery.
• The iPhone app: the app uses your camera to take listing photos, documents and the cold-start video, and your photo library only when you choose photos from it. While you work on a listing, your drafts are kept on your phone, excluded from iCloud backup, and sent to us when you save. While you take a photo the app reads the phone's motion sensor to help you hold it level; that reading never leaves your phone. The app has no advertising or analytics code.
• Verification documents: a photo of your V5C logbook and MOT certificate. These contain your name and address. They are stored privately, are never published, and are visible only to you and to OpenHood staff reviewing your listing.
• Vehicle identifiers: the registration number and, where provided, the VIN of the car you list. Stored encrypted and not published in full.
• Enquiries and messages: the content of enquiries you send about a car, with your name and email, and the content of direct messages between buyers and sellers. Messages are visible to the people in that conversation and, where necessary to investigate abuse or a report, to OpenHood staff.
• Test drives: when you book a test drive you give the seller your phone number, the times you can do, a suggested meeting place if you choose one, and confirm you hold a licence and insurance. The seller sees these; once they confirm, you both see the agreed time and place. Test drives are UK only, so meeting places include a UK postcode.
• Views and saves: we count how many times a listing is viewed and how many people saved it, and show the seller those totals. Sellers never see who viewed or saved their car.
• Welcome questions and saved searches: after sign-up you can tell us what you drive and what you are looking for. This is optional, used only to set up a saved search for you, and can be skipped.
• Beta testing: while OpenHood is in beta, we record when you accepted the beta agreement and which version, and the answers to the optional beta survey. These are read only by the OpenHood team.
• Activity data: which listings you save, favourite, or swipe yes/no on in Swipe mode. This is tied to your account and is used only to order recommendations for you. It is not shown to sellers or other users, and it is never sold or shared.
• Technical and security data: your IP address and basic request information, used to rate-limit abuse (for example to stop bots flooding the enquiry form) and to run anti-bot checks. Retained only briefly for that purpose.
• Payment data: if you pay a listing fee, the payment itself is handled entirely by Stripe. We never see or store your full card details. We store only a payment reference, the amount, and whether it succeeded.

What we deliberately do not do

Some things are worth stating plainly, because they are what many sites do and we do not.

• We do not sell, rent, or trade your personal data to anyone.
• We do not use your data for advertising, and we run no advertising or tracking cookies.
• We do not track you across other websites, and we use no third-party advertising pixels or social-media trackers.
• We do not publish your surname, address, phone number, email address, or verification documents.
• We do not sell your data, and we do not use it to train our own machine-learning models.
• We do use an automated check on listing photos. When you add photos to a listing, they are sent to Google (Gemini API) to work out which view each photo shows, whether it is clear enough to publish, and whether the set shows the same car. Google processes them on our instructions under a paid API tier whose terms prohibit using the content to train their models, and the images are not retained by them for that purpose. This check never sees your V5C or MOT documents, which are never sent to any third party.

Who processes data on our behalf

We use a small number of established providers to run the service. They process data on our instructions under their own data-processing terms and are not permitted to use it for their own purposes. Some are based outside the UK; where that is the case, transfers rely on the safeguards those providers offer, such as standard contractual clauses.

• Supabase: database, file storage, and account authentication.
• Vercel: website hosting and content delivery.
• Stripe: payment processing for listing fees. Stripe acts as an independent controller of the payment data it collects; see stripe.com/privacy.
• Resend: sending transactional email, such as enquiry notifications and listing status updates.
• Cloudflare: anti-bot checks (Turnstile) on our sign-up, sign-in, and enquiry forms, which involves your IP address and basic browser signals.
• Upstash: short-lived storage of rate-limiting counters keyed to your IP address, to protect the site from abuse.
• Google (Gemini API): the automated check on listing photos described above, plus two checks that send only the car's make, model, trim and year: whether it is an enthusiast car, and filling in its specification. Never your verification documents, and never your account details.
• Vercel Web Analytics: anonymous counts of page views on the website. It sets no cookies and does not identify you.
• postcodes.io: an open, free UK postcode lookup, used to place your listing on the map so buyers can filter and sort by distance. Only the postcode itself is sent; the result is stored rounded to roughly a mile of precision before it is ever shown to a buyer, so it never pinpoints a specific address.

Verification documents

Your V5C and MOT are the most sensitive thing you give us, so they get the strictest handling. They are stored in a private location that is not publicly reachable, access is restricted at the database level to you and to OpenHood staff reviewing your listing, and they are retrieved only through short-lived expiring links. They are never shown to buyers, never attached to your public listing, and never used for any purpose other than verifying that the car and seller are genuine. If your listing is rejected or withdrawn you can ask us to delete them immediately.

Cookies and similar technologies

We keep this deliberately minimal. We use no advertising or tracking cookies. Page views are counted anonymously without cookies (Vercel Web Analytics).

• A strictly-necessary cookie that keeps you signed in to your account.
• A small local setting that remembers whether you chose light or dark mode. This stays in your browser and is never sent to us.
• Cloudflare Turnstile may set a short-lived token when you submit a form, purely to confirm you are not a bot.

How long we keep things

We keep data only as long as there is a reason to.

• Account and profile data: while your account exists, and deleted on request.
• Listings and their photos: while the listing exists. Sold or withdrawn listings may be kept for a limited period for records and disputes.
• Verification documents: until the listing is resolved, or sooner if you ask us to delete them.
• Live listings: shown for 30 days at a time; an expired listing is hidden, not deleted, until you renew it or delete it.
• Test-drive bookings: kept with the conversation they belong to, so both sides have a record, and deleted with your account.
• Enquiries and messages: kept so both sides retain a record of the conversation, and deleted on request where we are not required to keep them.
• Payment records: kept as long as legally required for financial and tax records.
• Security and rate-limiting data: minutes to hours, then automatically discarded.

Your rights

Under UK data-protection law you have the right to ask us for a copy of the data we hold about you, to correct it if it is wrong, to delete it, to restrict or object to how we use it, and to receive it in a portable format. You can also withdraw consent at any time where we relied on it. Contact us at hello@openhood.uk and we will respond within one month, at no charge. If you are unhappy with our response you can complain to the Information Commissioner's Office (ico.org.uk), the UK's data-protection regulator.

Security

Everything is served over an encrypted connection, and data is encrypted at rest by our hosting providers. Access is restricted at the database level so users can only reach their own records, and verification documents sit in private storage reachable only through expiring links. No system is perfectly secure, but if a breach ever affects your rights we will tell you and the Information Commissioner's Office as the law requires.

Children

OpenHood is not intended for anyone under 18 and we do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

If we change how we handle your data we will update this page, change the date at the top and list what changed there. The app opens this same page, so it is always the current version. Where a change is significant we will tell you directly rather than relying on you to notice.

Contact

For anything about your data, including requests to see or delete it, email hello@openhood.uk.