Privacy Policy

1. Information We Collect

We collect information you provide directly to us and information generated automatically as you use our Platform.

Account Information

When you register, we collect your name, email address, username, and password (stored in hashed form). If you use Google Sign-In, we receive your name, email address, and profile picture from Google. You may also optionally provide a phone number and seller type.

Listing Information

When you create a listing, we collect vehicle details (make, model, year, mileage, condition, price), photographs, written descriptions, registration information (if provided), and your location (city or region).

Communications

We store messages sent through our Platform messaging system, offers submitted between buyers and sellers, and your responses to our communications.

Payment Information

Payment card details are collected and processed by Stripe. ClassicRevs does not store full card numbers. We retain records of transaction amounts, dates, and outcomes for accounting and fraud prevention purposes.

Usage Information

We automatically collect your IP address, approximate location (derived from your IP address via Geoapify), browser type, device type, pages visited, search queries, filter preferences, and referring URLs. We use this data to operate and improve the Platform.

Verification Documents

If you apply for Seller Verification, we collect identity documents and vehicle ownership documentation. These are stored securely and accessed only by authorised staff.

2. How We Use Your Data

We use your personal data to:

Create and manage your account and authenticate your identity
Publish and manage vehicle listings on your behalf
Process payments and issue receipts
Facilitate messaging and offers between buyers and sellers
Send transactional emails (listing status updates, messages, offer notifications)
Send marketing communications, where you have opted in
Generate AI-assisted listing descriptions and valuation estimates
Detect and prevent fraud, abuse, and security incidents
Comply with legal obligations and respond to lawful requests
Analyse usage to improve Platform features and performance
Promote the Platform using your listing photographs and content (as permitted by our Terms of Service)

3. Legal Basis for Processing

Under the UK GDPR, we rely on the following lawful bases to process your personal data:

Contractual necessity: Processing required to provide the services you have requested, including account management, listing publication, and payment processing
Legitimate interests: Fraud detection, platform security, analytics, and marketing using listing content (balanced against your rights and freedoms)
Consent: Marketing emails and optional analytics cookies — you may withdraw consent at any time
Legal obligation: Retention of financial records and compliance with lawful requests from regulatory or law enforcement authorities

We share personal data only as necessary to operate the Platform:

Other users: Your public listing information, seller profile, username, and verification badge are visible to all Platform visitors
Stripe: For payment processing. Stripe is an authorised payment institution regulated in the UK and EU
Resend: For transactional and marketing email delivery
OpenAI: For AI-powered listing descriptions, search parsing, and valuation features. Data submitted to OpenAI is subject to their privacy policy
Geoapify: For location autocomplete and IP-based currency detection
Sentry: For error tracking and performance monitoring
Replit: Our hosting provider, which stores application data on our behalf
Legal authorities: Where required by law, court order, or to protect the rights and safety of ClassicRevs or others

We do not sell your personal data to third parties.

5. International Transfers

Some of our service providers process data outside the United Kingdom. Where personal data is transferred to countries not deemed adequate by the UK Information Commissioner's Office, we rely on UK International Data Transfer Agreements or equivalent safeguards to protect your data. For questions about international transfers, contact us at support@classicrevs.com.

6. Data Retention

We retain your personal data for as long as your account is active and for a reasonable period thereafter to comply with legal obligations, resolve disputes, and prevent fraud. Specific retention periods:

Account data: Held for the duration of your account and up to 3 years after closure
Transaction records: Held for 7 years in accordance with UK tax and accounting law
Listing data: Retained for analytical and promotional purposes after a listing expires or is removed
Verification documents: Retained for up to 2 years after verification or account closure
Server logs and usage data: Retained for up to 12 months

7. Security

We implement appropriate technical and organisational measures to protect your personal data, including encrypted data transmission (TLS), hashed password storage, access controls limiting staff access to personal data, and regular security assessments. However, no method of transmission over the internet is entirely secure. You are responsible for keeping your login credentials confidential.

8. Your Rights

Under the UK GDPR, you have the following rights in relation to your personal data:

Right of access: Request a copy of the personal data we hold about you
Right to rectification: Request correction of inaccurate or incomplete data
Right to erasure: Request deletion of your data ("right to be forgotten") where there is no compelling reason for us to continue processing it
Right to data portability: Receive your data in a structured, machine-readable format
Right to restriction: Request that we restrict processing of your data in certain circumstances
Right to object: Object to processing based on legitimate interests, including direct marketing
Right to withdraw consent: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at support@classicrevs.com. We will respond within one month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Marketing Communications

We may send you marketing emails about new features, promotions, and classic car content where you have opted in. You can unsubscribe at any time by clicking the unsubscribe link in any marketing email or by updating your preferences in your account settings. Opting out of marketing does not affect transactional or service communications.

10. Cookies & Tracking

We use cookies and similar technologies to maintain your session, remember your preferences, and analyse Platform usage. We respect your cookie preferences and obtain your consent before setting non-essential cookies. For full details, please read our Cookie Policy.

11. Third-Party Services

The Platform integrates with third-party services that have their own privacy policies:

Stripe: Payment processing — stripe.com/gb/privacy
Google: Sign-In and analytics — policies.google.com/privacy
OpenAI: AI-powered features — openai.com/policies/privacy-policy
Sentry: Error monitoring — sentry.io/privacy

12. Children's Privacy

The Platform is not directed at, and we do not knowingly collect personal data from, anyone under 18 years of age. If you believe we have inadvertently collected data from a minor, please contact us immediately at support@classicrevs.com and we will delete it promptly.

13. Contact

If you have questions about this Privacy Policy, wish to exercise your rights, or need to contact our Data Protection Officer, please reach out to us:

ClassicRevs Ltd
Privacy enquiries: support@classicrevs.com
Data Protection Officer: support@classicrevs.com
Address: London, United Kingdom