PRIVACY POLICY

RevRadar is operated by RevRadar Ltd.

This Privacy Policy explains how we collect, use, store and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

RevRadar Ltd is the data controller for personal data collected through this Service. Contact us at [email protected] for any data-related queries.

RevRadar Ltd is registered in England and Wales. ICO Registration Number: ZC199673. If you have any questions about how we handle your data, contact us at [email protected].

• Email address
• Password (stored as a bcrypt hash — never in plain text) — only if you create an account with an email and password. If you sign in with Google instead, we receive your Google account's unique identifier and the email address Google has verified to us, and we store them so you can sign in again. An account created this way has no password, and we do not receive your Google password or any other Google account details.
• A display name, only if you choose to set one
• Account creation date, and your subscription tier and status (free, Pro, or Dealer)

• Search queries and filter preferences (including, in the RevRadar app, optional For You price, mileage and year filters)
• Saved searches and alert settings
• Saved (favourited) listings
• In the RevRadar app's For You feed: which listings you swipe to dismiss or like
• Which listings were included in your saved-search alerts and, in the RevRadar app, whether you have looked at them yet
• Pages visited and features used
• IP address and approximate geographic location
• Browser type, device type, and operating system
• Referring website

When you are signed in, we record which listings you view (and how many times), and how you interact with on-page prompts we show you — for example a vehicle-history-check nudge, a delivery-partner suggestion, or a "thinking about this one?" prompt. We use this in two ways. First, to decide what, if anything, to show you on the listing you are currently looking at, and to measure whether those prompts are useful — any prompt we show still refers only to the listing in front of you, never to a summary of your browsing across sessions or other cars. Second, we use your recent viewing history as one signal (among several) that shapes your For You feed: views of a make and model count towards showing you more listings like it, views in the last 30 days count in full, views 30–90 days old count for less, and views older than 90 days no longer count at all. This signal is deliberately weaker than an explicit search or a swipe-like on the same make and model, and can never outweigh a single like of it. Clearing your recently viewed history (Account settings → Recently Viewed → Clear All) deletes this data and removes it from your feed personalisation immediately, the same way it removes it everywhere else.

When you first set up your account, we ask you to pick a few car makes and/or categories (for example "SUVs" or "Electric") you're interested in. We store these picks and use them only to help personalise your For You feed — for example, so a make you picked can appear in your feed even before you've searched for or viewed anything in it. We do not use these picks for search results, alerts, or any advertising or promotional targeting. They are deleted immediately and permanently if you delete your account, along with the rest of your account data.

In the RevRadar app you can also set optional For You filters: a minimum and maximum price, a minimum and maximum mileage, and a minimum and maximum year. Each one is a single number stored on your account (six optional values in total) — when you change one, the old value is replaced and nothing is kept of it — and you can clear any of them to remove that limit. We use them only to narrow which cars appear in your For You feed. We do not use them for search results, alerts, or any advertising or promotional targeting, and we do not share them with anyone. They are deleted immediately and permanently if you delete your account, along with the rest of your account data.

When we send you a saved-search alert, by email or push, we note which listings were included in it. For each one we store which of your saved searches it matched, the listing, when it matched and — once you have looked at it — when you saw it. We store only those references and timestamps, not the text of the alert. This applies to every saved-search alert; only the RevRadar app shows it. The app uses it only to show you which of your saved searches have new matches you have not looked at yet: the badge on the Alerts tab and the highlighted cars under each search. A match counts as seen when you open that car from the search's matches or tap Clear alerts, and the app only counts matches from the last 30 days as new. We do not use these records to decide what to send you, for analytics, or for any advertising or promotional targeting, and we do not share them with anyone. They are not deleted on a timer; they are deleted immediately and permanently when you delete the saved search they belong to or delete your account, and they are also removed if the listing itself is removed from our database.

• Emails you send us and our responses

• Your subscription tier, status, and billing dates
• A Stripe customer ID and subscription ID that link your account to your billing record

If you subscribe to a paid plan, payment is taken by Stripe, our payment processor. Stripe collects and processes your card details directly — RevRadar never sees or stores your card number. See section 8 for more on Stripe.

Besides the For You feed filters described in section 3.4, the RevRadar app can store two things the website does not.

Your home area. If you set one, we store the postcode you enter, the approximate coordinates of that postcode's centre, and your preferred search radius in miles. We use them for the "search around home" shortcut and to set the starting point for distance filters.

The coordinates are the centre point of the postcode as published by the postcode lookup service we use — they are not your device's location. The app never asks your phone for location access, and we do not collect or store GPS data. A UK postcode centre is a fairly precise location even though it is typed in rather than read from your device — it covers only a small handful of addresses — so we treat and declare it as precise location data, not approximate. Setting a home area is optional, and clearing it in the app deletes the postcode and its coordinates together. If you had a postcode set when you saved a search, that saved search also keeps its own copy of the resolved coordinates as part of its stored filters — clearing your home area does not remove that copy. It is kept until you delete that saved search or close your account.

Push notification subscriptions. If you turn on notifications, your device registers with a push service and we store what is needed to reach it. In a web browser that is a delivery address issued by the browser's push service, two encryption keys your device generates for that address, and a shortened description of the browser and device. In the Android app it is instead a Firebase Cloud Messaging registration token issued by Google, together with the platform and app version and a short description of the device — see section 5 for how this affects what Google can see about a notification sent through it.

We do not receive your phone number, an advertising identifier, or any identifier that follows you between apps.

• Your payment card number (this is handled entirely by Stripe — we never receive it)
• Government ID or driving licence information
• Vehicle registration plates you search for
• Sensitive personal data (race, religion, health, etc.)

If you save a search we will send email notifications when matching listings are detected. You can:

• Delete saved searches through your account at any time
• Unsubscribe via the link in any alert email
• Delete your account to stop all communications

Push notifications (RevRadar app only). If you install the RevRadar app and allow notifications, we can deliver the same saved-search alerts as a notification as well as an email. Push follows exactly the same rules as your email alerts — the same saved searches, the same frequency for your plan, and the same opt-outs. Turning notifications off in the app or in your device settings stops them, as does deleting the saved search or closing your account.

RevRadar displays publicly available vehicle listing information from third-party platforms. We extract structured factual data (make, model, price, mileage, location) from public listings, and we also store the seller's full description text exactly as it appears on the original listing. We do not:

• Intentionally seek out or specifically target personal data about vehicle sellers
• Use any seller contact details for our own purposes, or share them with third parties

However, because listing descriptions are free text written by the seller on the original platform, they can incidentally contain a phone number, email address, or first name. Where this happens, it is publicly available information the seller chose to post; RevRadar did not solicit it and does not use it.

We also download copies of the photographs shown on listings and store them on RevRadar's own servers, so they are displayed to you from RevRadar rather than from the original platform. Each stored copy is deleted from our servers within about a day of the listing being removed or expiring. The photographs remain the property of their original owners.

Phone numbers and email addresses are removed before a description is stored. When we collect a listing, an automated process replaces any phone number or email address in the seller's description with a placeholder (for example, "[phone number removed]") before it is saved to RevRadar's database, so the original is not kept. Descriptions collected earlier were cleaned the same way in a one-off pass. As a second layer, since 20 August 2026 the same scan also runs before a description is shown anywhere on RevRadar, and additionally removes a first name placed directly beside a phone number or email. Like any automated detection, this is not a guarantee that every possible format is caught. If you believe a listing shows your personal data and wish it removed, please use our listing removal page. Removal requests are reviewed within 48 hours.

One-way hash of removed phone numbers. For each phone number we remove, we keep a one-way keyed hash of it (a fixed-length code that cannot be turned back into the number, and cannot be computed without a secret key that only we hold). We use it for fraud prevention and duplicate detection — for example, to recognise that one number appears on many listings, which usually means a trade seller, or that two listings are the same vehicle. We do not use it to contact anyone, and it is not shown to users. Because it can still single out the same number across listings, we treat it as personal data. It is stored with the listing and deleted with it (see the retention table below).

RevRadar uses a small number of strictly necessary cookies and browser local storage items to operate the service. We do not use advertising cookies, tracking cookies, or any third-party analytics cookies that identify you personally.

Cookies set by RevRadar:

• rr_rt — A secure, httpOnly authentication cookie used to keep you signed in. This cookie is strictly necessary for the login function to work. It expires after 30 days of inactivity and is never accessible to JavaScript. No consent is required for this cookie under UK PECR as it is strictly necessary.

Local storage items (not cookies):

• rr_token — Your session access token, stored locally to authenticate API requests
• rr_user — Basic account details (email, tier) stored locally to display your account information without repeated server requests
• rr_theme — Your dark/light mode preference
• rr_lat, rr_lng, rr_postcode, rr_city — Your location preference on the website, used for distance-based search filtering and, on a listing you're viewing, to work out whether it's far enough away that a vehicle-delivery partner prompt is relevant. These items are stored only on your device and are used only to decide what to show on our own pages. To turn a postcode, a town name, or your current position into coordinates in the first place, that value is sent to a location lookup service — see section 8; the coordinates that come back are kept on your device. If you instead set a home area in the RevRadar app, that is saved to your account rather than to local storage, and the postcode is checked against the same postcode lookup service — see §3.7 and section 8
• rr_view, rr_loc_tab — UI layout preferences

All local storage items are stored only on your device and are cleared when you sign out. You can clear them at any time via your browser settings.

Analytics: we use Cloudflare Web Analytics, a privacy-first, cookieless analytics tool. It measures aggregate page views and performance without setting any cookie, without cross-site tracking, and without building a profile of you or identifying you personally. See cloudflare.com/web-analytics.

We do not use Google Analytics, Meta Pixel, or any advertising or cross-site tracking scripts.

We do not sell your personal data. We share data only with:

• Resend: email delivery service for alerts and account emails — resend.com/privacy
• Cloudflare: hosting, HTTPS, and cookieless Web Analytics — cloudflare.com/privacy
• Stripe Inc: payment processing and subscription management — USA (Standard Contractual Clauses apply) — stripe.com/privacy
• Push services (Google, Mozilla, Apple): deliver notifications to your device if you turn them on. For a web browser, they receive a message they cannot read, because it is encrypted before it leaves us. For the Android app, delivery goes through Google's Firebase Cloud Messaging, and Google can read the notification text — see section 5
• Google (Sign-In): if you choose to sign in with Google, Google verifies your identity to us and we receive your Google account ID and verified email — policies.google.com/privacy
• Google Fonts: the website loads its typefaces from Google's font service, which sees the IP address and device details of the request — policies.google.com/privacy. The RevRadar Android app's own screens do not do this: their typefaces are bundled with the app instead. This privacy policy page and the terms page are included in the app so they're readable without needing our website, and — being copied from the website unchanged — still reference Google Fonts the same way the website pages do
• postcodes.io: turns a postcode into approximate coordinates — for a home area you save in the app, for a postcode you type into the location filter on the website, and to find the nearest postcode if you use the website's "use my current location" button. It receives the postcode, or in that last case your device's coordinates — never your name, email, or account details
• OpenStreetMap Foundation (Nominatim): turns a town or city name you type into the location filter on the website into approximate coordinates. It receives the place name only — never your name, email, or account details — osmfoundation.org/privacy
• Law enforcement or regulators: only when legally required

We do not share data with advertisers, data brokers, or marketing companies.

RevRadar earns commission from affiliate partners. Some links and prompts on the site — for example a carVertical vehicle-history check, a DeliverMyMotor delivery quote, or AutoAid breakdown cover — are affiliate links. If you click one you are taken to that partner's own website, and anything you do there is governed by their privacy policy, not this one. We may earn a commission if you buy, at no extra cost to you.

We do not hand your account details (email, name, search history) to these partners. An affiliate link may carry a non-identifying campaign tag (e.g. "revradar") in its URL so the partner can credit the referral — this tag does not identify you.

Resend, Cloudflare, Google (Sign-In, Firebase Cloud Messaging, Fonts), and the push services described in section 5 may process data outside the UK. Where this occurs, appropriate safeguards are in place in accordance with UK GDPR requirements. In the case of web push specifically, the content leaving us is encrypted and cannot be read by the service carrying it — Android push notifications are not end-to-end encrypted, as section 5 explains.

We retain your data for the following periods:

• Account data — Retained for the duration of your account. Deleting your account (in the app or on the website) removes your profile, saved searches, saved listings, search history, push registrations, viewing/prompt-interaction data, For You preferences and filters, alert match records, and sign-in links immediately from our live database — there is no 30-day grace period. Backups taken before you deleted are not edited and expire within about four weeks; see what is deleted and what we keep
• Search history — Retained while your account is open, deleted immediately when you delete your account. It is not deleted on any fixed timer while the account stays open
• Saved searches and saved listings — Retained until you delete them or close your account
• For You likes and dismissals — Retained until you close your account
• For You preferences (onboarding picks) — Retained until you close your account. Used only to personalise your For You feed
• For You feed filters (app) — Retained until you clear them or close your account. Used only to narrow your For You feed
• Alert match records — Retained until you delete the saved search they belong to or close your account; not deleted on a timer. Used only to show which alert matches you have not looked at yet
• Home area (app) — Retained until you clear it in the app or close your account. Clearing the postcode also deletes its coordinates. A saved search created while that postcode was set keeps its own copy of the coordinates regardless — that copy is retained until the saved search itself is deleted or the account is closed
• Push notification subscriptions (app) — Retained until you turn notifications off, remove that device, or close your account. We also delete a subscription automatically as soon as your browser's push service tells us the device can no longer be reached
• Waitlist entries — Retained until you request removal or are onboarded
• Listing descriptions and photos (from third-party platforms) — When a listing is taken down or expires, its stored photograph and the seller's description text are both deleted or blanked within about a day, and any phone number or email address in the listing title is redacted at the same time. If a listing is removed because someone asked us to remove it (see Listing removal), the description is blanked immediately and the listing is kept off RevRadar even if the source site still shows it. Phone numbers and emails in a description are removed before it is stored; the one-way hash kept for fraud and duplicate detection is deleted with the listing. The rest of the record (title, price, mileage and similar facts) is deleted after 30 days
• Listing removal requests — Retained for 12 months for legal record-keeping purposes, then deleted
• Listing view & prompt-interaction data — We track which listings you view and how you interact with on-page prompts to power features like "thinking about this one?" nudges and a distance-based delivery-partner prompt (referencing only the listing you're currently viewing), and to weight your recent viewing history into your For You feed (see §3.3). It is retained while your account is open — there is no fixed-duration automatic purge — and deleted immediately if you clear your recently viewed history (Account settings) or close your account. We never send automated emails based on your viewing activity — email alerts always require your explicit opt-in on a saved search. Occasionally, a member of our team may personally follow up about a specific listing you viewed, to ask how your search went and suggest relevant services; these are individually reviewed and sent by a person, never by an automated system, arrive at most once a month, reference only the single listing concerned, and every one includes a one-click unsubscribe that stops them permanently
• Email send logs (Resend) — Retained by Resend for up to 30 days per their data processing terms
• Payment records (Stripe) — Retained by Stripe in accordance with their legal obligations and privacy policy

• Right to erasure — You can delete your account at any time, in the RevRadar app (Account → Settings → Delete my account) or on the website (Account settings). This permanently and immediately deletes your profile, saved searches, saved listings, search history, push registrations, viewing/prompt-interaction data, For You preferences and filters, and alert match records, and cancels any active subscription. There is no waiting period. Nightly database backups taken before you deleted are not edited and expire within about four weeks. The steps, and exactly what is deleted and what we keep, are on our account deletion page, which works without the app installed. You can also email [email protected] and we will do it for you.
• Right to object to automated processing — Deal scoring and search ranking on RevRadar is automated. You may request that we do not apply automated scoring to your usage by contacting us, though this may limit platform functionality.

We implement appropriate technical and organisational measures including:

• bcrypt password hashing (cost factor 12)
• HTTPS encryption for all data in transit via Cloudflare
• Database access controls
• Regular backups
• Server access limited to authorised personnel

No internet transmission is 100% secure. We cannot guarantee absolute security but will notify you of any breach affecting your personal data as required by law.

RevRadar is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has provided personal data, contact us at [email protected] and we will delete it promptly.

We do not make automated decisions that significantly affect you. Our deal scoring feature is informational only and does not constitute automated decision making under UK GDPR.

We may update this Privacy Policy. For significant changes, we will notify registered users by email. The date at the top shows when it was last updated. Continued use after changes constitutes acceptance.

If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO):

We would appreciate the opportunity to address your concerns before you contact the ICO.

For any privacy queries or to exercise your rights: