Privacy policy

Last updated: 11 August 2026 · AutoSweep is in beta

This policy explains what personal data AutoSweep collects, why, and what rights you have over it. It covers information about you — not the car listings themselves, which are public marketplace data about vehicles.

Who we are (data controller)

AutoSweep is operated by AutoSweep Ltd, a company registered in England & Wales (company number 17297450), registered office 82a James Carter Road, Mildenhall, IP28 7DE, United Kingdom (“we”, “us”). We are the data controller for the personal data described below.

Contact us about privacy or your data at info@autosweep.co.uk.

We are registered with the UK Information Commissioner’s Office (ICO), registration number 00014830852.

What we collect

• Account data: your email address and a password (stored hashed by our authentication provider — we never see it in plain text), and, if you choose to provide it, your home location — a postcode, a postcode area, or a town or city. It is optional, you can change or remove it at any time from your account, and we use it only to work out how far a car is from you.
• Feature data: the searches you save, the alerts you set, and your subscription status.
• Technical data: basic logs (such as IP address, browser type and timestamps) that we keep to run, secure and troubleshoot the service.
• Search demand data: when a search is run we record what was searched for (the text you typed and the filters applied), how many cars matched, the approximate area the request came from (town/city and nation, e.g. “Manchester, England”), and a random anonymous identifier if you have accepted analytics cookies. We work out the approximate area from your IP address at the moment of the request and then discard it — the IP address itself is never stored with this record, and the record is never linked to your account. If, and only if, you have used “Use my location” and agreed to it, this record also includes your postcode area (for example “M1”, which covers thousands of addresses) instead of only the town estimate. We never add a location you have saved to your account to these records.
• Seller contact activity: when you press “Call dealer” on a car page to reveal a seller’s phone number, or follow the link to the original listing, we record that it happened: which car it was, which of the two you pressed, the seller’s name and postcode, whether your device could place a call, and the same basic technical data (IP address, browser type) we keep for the rest of the site. We do this to understand how often people want to contact a seller, and we share the resulting figures with dealers as counts and totals — never as anything that identifies you. We do not connect, listen to, record or take part in the call itself: pressing the button simply gives you the number the seller published, and if you call, that call is between you and them.
• Location used to order results: to show you nearer cars first, we work out roughly where you are. If you have typed a postcode into your search filters, or saved a postcode, postcode area or town to your account, we use that. If you have not, we make a rough estimate from your internet connection — this is accurate only to the level of a town or city, and we discard it with the request. We use this only to decide the order cars appear in, and it never removes cars from your results. You can also press “Use my location” in the search filters. If you do, we first show you a short explanation of what we keep and what we use it for, and you have to agree before your browser asks its own permission question. If you agree, your device’s position is sent directly from your browser to postcodes.io, a UK postcode lookup service, purely to convert it into a postcode area. Only that area — for example “M1” — comes back to us; we never receive or store your device’s precise position or your full postcode. We use it to order your results and, as described above, we include it in our anonymous search demand records. It is stored in a cookie on your device, expires after six months, and you can remove it at any time from the search page.

We do not collect your card details — payments are handled entirely by Stripe. AutoSweep is not intended for anyone under 18, and we do not knowingly collect data from children.

How we use your data, and our lawful basis

Under UK data protection law we must have a lawful basis for each use of your data. Ours are:

• Signing you in, saving your searches, and running your account — to perform our contract with you.
• Sending the alerts you asked for — to perform our contract with you / with your consent, which you can withdraw at any time.
• Account emails (verification, welcome, service and billing notices) — to perform our contract with you and to meet our legal obligations.
• Taking payment and managing your subscription — to perform our contract with you.
• Showing you relevant results, including ordering cars by how near they are to you — necessary to perform our contract with you, or our legitimate interests in providing a useful search where you are not logged in.
• Keeping the service secure, preventing abuse and fraud, and fixing problems — our legitimate interests in running a safe, reliable service.
• Understanding what car buyers are looking for, by area and over time, so we can improve the service and produce market insight — our legitimate interests in developing our business. This analysis is carried out on aggregated figures, not on individuals.
• Measuring how often people choose to contact a seller, so we can show dealers the interest their cars attract — our legitimate interests in developing our business. What we share with a dealer is counts and totals for their own vehicles; we never pass on who you are or how to reach you, and we never tell a seller that a particular person looked at a particular car.

We do not sell your personal data, and we do not send marketing emails you haven’t asked for. We may share or publish aggregated market insight drawn from search demand data (for example, “interest in used electric cars in Leeds rose 12% this quarter”). Anything shared in this way is aggregated and anonymised so that it cannot identify you, and we do not share the underlying individual records. AutoSweep ranks cars to help you find good value. That ranking is based on the vehicles themselves — price, mileage and age — and on how near a car is to you; it is not based on any profile of you or your behaviour, and we do not make automated decisions that produce legal or similarly significant effects about you.

Cookies

We use essential cookies to run the service: your login session, and a counter for the free anonymous search. These are strictly necessary, so they don’t require consent under the Privacy and Electronic Communications Regulations (PECR).

If you use “Use my location”, we store the postcode area you agreed to share in one further cookie (“asw_loc”). It is only ever set after you have agreed to the explanation shown at the time, it holds nothing but that area (for example “M1”), it expires after six months, and you can remove it at any time from the search page. It is not linked to your account and is not used to track you across other websites.

With your consent — and only with your consent — we also use Google Analytics cookies to understand how the site is used and improve it, and we set one further analytics cookie of our own (“asw_sid”). That cookie holds nothing but a random identifier, lasts about a year, and is used only so that repeat searches from the same browser can be counted once in our aggregate figures. It is not linked to your account and is not used to track you across other websites.

Analytics stays completely off until you choose “Accept” on the cookie banner; choosing “Essential only” means the analytics code never loads, no data is sent to Google, and the asw_sid cookie is not set (and is deleted if it already exists). We still record the anonymous search demand data described above, but with no identifier attached. You can change your mind at any time by clearing this site’s data in your browser, which brings the banner back. We do not use advertising cookies.

Who processes your data

We rely on a small set of trusted providers to operate AutoSweep. Each acts as our processor and only handles your data on our instructions:

• Supabase — accounts and database.
• Stripe — payments.
• Resend — email delivery.
• Vercel — hosting.
• Anthropic — AI processing of your search text to power search and matching. Your search text is used only to provide this feature; it is not used to train AI models, and no decision with legal or similarly significant effect about you is made by it.
• Our vehicle data provider — the source of our car-listing data. It supplies us with public data about vehicles and does not receive your personal data.
• postcodes.io — a UK postcode lookup service. Your browser contacts it directly if you press “Use my location” in the search filters, to turn your device’s position into a postcode; we do not send it any data for that, and we do not receive the position it was given. Separately, our server sends postcodes.io a postcode or place name whenever it needs to turn one into a location — for example a town or city you save as your home location, a postcode you enter in the search filters, or a place named in a search — and receives back only coordinates, never anything that identifies you.

Where your data is processed (international transfers)

Some of our providers process data outside the UK (for example in the United States). Where your personal data is transferred outside the UK, we make sure an appropriate safeguard recognised under UK law is in place. The safeguards our providers rely on are:

• Supabase — the EU Standard Contractual Clauses together with the UK Addendum (data hosted in a UK/EU region where available).
• Stripe — the UK Extension to the EU–US Data Privacy Framework, backed by the UK International Data Transfer Addendum.
• Resend — the EU Standard Contractual Clauses together with the UK Addendum.
• Vercel — the EU–US Data Privacy Framework (with UK extension), backed by the EU Standard Contractual Clauses and UK Addendum.
• Anthropic — the EU–US Data Privacy Framework, backed by the UK International Data Transfer Addendum (IDTA).
• Our vehicle data provider — not applicable; it provides public vehicle data to us and does not receive your personal data.
• postcodes.io — the browser-only lookup above is not applicable, since we are never in that path. For the server-side lookup, we send only a postcode or place name — never your name, email or account identity — so what we send is not personal data of an identifying kind. postcodes.io is a UK postcode-lookup service; we have not verified where it or any provider in front of it processes data.

How long we keep it

• Account, saved searches and alerts — kept while your account exists. Deleting your account removes your saved searches and alerts.
• Home location — kept until you change or remove it, or until your account is deleted. The rough location estimated from an internet connection is used for that single request and is never written to our records. A postcode area you shared with “Use my location” is kept on your device for six months unless you remove it sooner.
• Technical and security logs — kept for up to 12 months, then deleted.
• Search demand data — individual search records are kept for up to 90 days. After that they are rolled up into aggregate, anonymous totals by area and date, and the individual records are deleted.
• Billing records — kept for 6 years, to meet our legal and tax obligations.
• Backups — deleted data may persist in routine backups for up to 30 days before being overwritten.

Security

We take reasonable technical and organisational measures to protect your data, including hashing of passwords, access controls, and using reputable providers. No service can be completely secure, but we work to keep your data safe and will notify you and the ICO of a personal data breach where the law requires.

Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to certain processing;
• receive your data in a portable format; and
• withdraw any consent you have given, at any time.

To exercise any of these, contact us at info@autosweep.co.uk and we’ll respond within one month.

Complaints

If you’re unhappy with how we’ve handled your data, please contact us first at info@autosweep.co.uk — we’ll acknowledge your complaint within 30 days and investigate it. You also have the right to complain to the ICO at any time: ico.org.uk/make-a-complaint or 0303 123 1113.

Changes to this policy

If this policy changes materially, we’ll update this page and the date at the top, and where appropriate we’ll let you know by email.