Privacy Policy

YourCar is a vehicle marketplace operated on the Isle of Man. For the personal data you give us as a buyer or seller, YourCar is the data controller. We handle your data in line with the Isle of Man Data Protection Act 2018 and the applied GDPR.

To ask a privacy question or exercise any of your rights, email our data team at privacy@yourcar.im.

We collect the following categories of information:

• Account data: your name, email address, a password hash if you set one, and an identifier from any sign-in provider you connect.
• Contact & verification: phone number where you choose to add one.
• Listing data: details of vehicles you list, shortlist, or enquire about.
• Registrations you look up: a plate you type into the look-up on our sell pages, and the vehicle details it returns. You do not need an account for this. The details come from the Isle of Man vehicle register, which publishes them without a login; we cache a decode for 90 days so a repeat look-up does not hit the register again.
• A listing you start before signing up: the vehicle details, price, mileage, photos and answers you give while building a listing (for example its service history, the number of owners, and any damage you describe). We store these on our servers so your work is not lost, and keep a random key in your browser (listed in our Cookie Policy) so that only your browser can open the listing again. We do not ask for your name, email or phone number at this stage. When you create an account or sign in, the listing becomes part of your account; if you do not, we delete it 30 days after you last changed it.
• Usage data: pages viewed, searches, and device information.
• Communications: messages you send to other users or to us.
• Buying agent chats: what you ask the buying agent, its replies, and which cars each reply showed you. We keep them so you can open a past chat again and to count your monthly messages; only you can see them.
• What your advert shows about you: if you sell privately, your advert says “Private seller”, the year you joined, and whether your email address and phone number are verified. It never shows your name, email address or phone number, and we hide phone numbers typed into your description. Buyers reach you through messages on yourcar.im.

We only process your personal data where we have a lawful basis to do so. Our purposes and their bases are:

Where our basis is consent, you can withdraw it at any time from Privacy & data, or, for what is stored on your device, from the cookie preferences page: no account needed. Withdrawing does not affect processing carried out before you withdrew.

How we measure usage, precisely. When your browser asks us for a page, our own servers record that the page was looked at, as they answer the request. Nothing is written to or read from your device to do it, which is why it does not sit behind a cookie choice. If you are signed in, that record carries your account, because the request carried your sign-in; we remove the account link after 24 months. Separately, your browser can send us one extra event, chiefly to say which campaign link brought you here, and that one does need your permission, so refusing it means your browser sends nothing of the kind. Two things are sent whatever your cookie choice: when you share a listing, which way you shared it; and when you tap a dealership’s phone number, website or directions link on a listing, which of the three you tapped and on which listing. Neither carries an account or device identifier, and a dealership sees only totals.

And separately, only with your permission, we use PostHog to see how the site is used and (a second, separate choice) to record how you move around it, with all text hidden. Neither is loaded at all unless you allow it, so refusing is not a setting we apply afterwards: nothing runs. Web addresses are cleaned before they are sent, so one-time links (an e-signature link, an unsubscribe link) never leave with them, and the signing page is never recorded at all.

The record of your cookie choice. When you answer the cookie prompt we keep a short record that the choice was made: a random reference, the version of what you were shown, which categories you allowed, and when. We are required to be able to demonstrate that consent was properly obtained, which is what that record is for. It holds no IP address, no browser fingerprint and no device identifier, we keep it for 24 months, and if you delete your account we unlink it from you rather than deleting it: erasing the proof that your consent was properly obtained would leave everybody worse off.

The record of what happens on your account. We keep a record of the things you do and that are done to your account: turning marketing emails or demand sharing on or off, accepting our terms, asking for your data or for your account to be deleted, signing in and out, sending a message, saving a search or a car, and what happens to your listings. Each entry says what happened, when, and from where, but only roughly: we keep your IP address with its last part removed, and the kind of browser and device (“Chrome on Windows”), never their versions. We never copy what you write in a message into it. It lets us show you, or a regulator, that you gave or withdrew a consent, and lets us answer if you tell us something on your account was not you. Your copy is in your data download.

We do not sell your personal data. We share it with service providers who process it on our behalf, under contract and only as needed to run the platform:

We also share data with other users where you choose to make contact, and with authorities where the law requires it.

What we tell dealers about saved searches. When you save a search, we tell Isle of Man dealers that somebody is looking for that kind of car, so they know what to stock. What they see is a description of a car: the make and model, your price, mileage and year ranges, and details like fuel, gearbox, body style and colour. What they never see is any part of you (not your name, your email address, your phone number, your account, or the label you gave the search) and they have no way to reply to you or find out who you are. Anything you type into the free-text search box, or into the trim/variant field, is never included: the dealer is told only that you narrowed the search further, never what you typed.

Our basis for this is legitimate interests: running a marketplace means telling the supply side what the demand side is asking for, and a buyer who saves a search wants the car to appear. Because the basis is legitimate interests rather than consent, you have the right to object, and you can do that with one switch, at any time, from Privacy & data. Turning it off takes your saved searches out of these emails entirely.

What we pass on when you ask for a part-exchange quote. If you send a dealership your car's details to get a part-exchange quote, we email that dealership a summary so somebody there can act on it. It contains your car's make, model and year, its mileage, the overall condition you gave it, which of their cars you are enquiring about, and when the request arrived. It does not contain your name, your email address, your phone number, your photographs, anything you wrote in the “anything we should know” box, or your registration number. The dealership contacts you through YourCar or through the details you have already given them. We only send this to dealerships that have agreed to receive part-exchange requests; on any other listing the option is not offered at all.

Some of our processors operate outside the Isle of Man. Where personal data is transferred abroad, we rely on an adequacy decision or on Standard Contractual Clauses (SCCs) together with any additional safeguards needed, so your data keeps an equivalent level of protection.

You have the following rights over your personal data:

• Access: get a copy of the data we hold about you.
• Portability: receive your data in a portable format.
• Rectification: correct data that is wrong or incomplete.
• Erasure: have your account and personal data deleted.
• Restriction & objection: limit or object to certain processing.
• Withdraw consent: stop marketing at any time.

You can exercise the most common rights yourself from Privacy & data: request a downloadable export of your data, toggle marketing consent, and start a deletion. Deletion runs on a 30-day grace period you can cancel by logging back in; see the deletion section of our Terms for detail. For anything else, email privacy@yourcar.im. You also have the right to complain to the Isle of Man Information Commissioner.

We keep personal data only as long as necessary for the purpose it was collected, then delete or anonymise it. In summary:

When you interact with a dealer on YourCar, that dealer may keep you in their own customer book. For those dealer-side records the dealer is the controller and YourCar acts as their processor. If you delete your YourCar account we sever the link between your account and the dealer's customer record; to have the dealer's own copy erased, contact the dealer, who handles that request under their own obligations.

If you're selling privately and have said buyers can book an independent inspection, we give your phone number to the one garage that takes the job, so they can arrange to see the car. No other garage sees it, and the buyer doesn't get it. The buyer and you are both told the garage's name and phone number.

You can switch inspections off for a car at any time. That stops new bookings. An inspection a buyer has already booked still goes ahead, and the garage that takes it can call you, unless you decline it on the car's page, which refunds the buyer and calls the garage off. The garage is a separate controller for the number it receives.

For any privacy question, or to exercise your rights, contact our data team at privacy@yourcar.im. See also our Cookie Policy for how we use cookies and local storage.