Privacy policy.

1. Who is responsible

Double Clutch is responsible for deciding how personal data is used on this marketplace (the data controller). This policy explains our approach under the UK GDPR and Data Protection Act 2018. For privacy questions or requests, contact hello@doubleclutch.co.uk.

2. What we collect

• Account information: email address, display name, avatar and authentication records. Passwords are handled by our authentication provider and are not displayed to other users.
• Listings: vehicle details, town, descriptions, service history, known issues, reason for selling and uploaded photos.
• Messages and conversation information, including participants, timestamps and read status.
• Reports, moderation decisions and any correspondence you send us.
• Technical information needed for service delivery and security, such as IP address, browser information, error logs and essential session or browser-storage data.

Published listings, photos, the seller’s display name and avatar are public. Your account email is not shown on listings or seller cards. Messages are available to conversation participants; authorised personnel may access information where necessary for security, support or legal obligations. Avoid putting private contact details, documents or sensitive information in listings, photos or messages.

3. Why we use it and our lawful bases

• To create accounts, authenticate users, publish and manage listings and deliver messages: necessary to perform our service contract with you.
• To prevent fraud and abuse, review reports, secure the service and resolve support issues: our legitimate interests in running a safe marketplace, balanced against your rights.
• To meet legal obligations or respond to valid legal requests: compliance with legal obligations.

We do not sell your personal data or use your messages for advertising. We currently use only essential storage, not optional advertising or analytics cookies. Agreeing to our terms is not blanket consent to unrelated data processing.

4. Service providers and sharing

Our hosting and backend providers, including Lovable Cloud and its infrastructure providers, process data to host the site, manage authentication, store listings and photos and deliver messages. Providers may also process technical logs needed for reliability and security. They are permitted to process information for service delivery under applicable contractual safeguards, not for their own unrelated use.

The site loads fonts from Google Fonts, so Google receives technical request information such as your IP address when those fonts load. We may disclose data where legally required or necessary to protect users and investigate wrongdoing. If data is transferred outside the UK, applicable safeguards must be used, such as adequacy regulations or approved contractual protections.

5. How long we keep it

We keep account data while your account is active and listing data while needed to provide and manage your listings. Messages are retained while needed to provide conversation history. You can delete your own listings and contact us to request account or personal-data deletion.

We retain reports, security records and relevant correspondence only as long as reasonably necessary to investigate abuse, resolve disputes or comply with legal obligations. Where such a reason applies, some records may be kept after an account or listing is deleted. Backups and technical logs may take additional time to expire through our providers’ retention cycles; deletion from the live service does not guarantee immediate removal from all backups. We review retention against these purposes rather than keeping data indefinitely without a reason.

6. Your rights

Subject to legal conditions and exceptions, you can request access to your data, correction of inaccuracies, deletion, restriction of processing and a portable copy of data. You can object to processing based on legitimate interests. If any processing relies on consent, you can withdraw that consent at any time without affecting earlier lawful processing.

Email hello@doubleclutch.co.uk to make a request. We may need to verify your identity securely. We normally respond within one month; complex requests may take up to two additional months, and we will explain any extension. You can also complain to the Information Commissioner’s Office at ico.org.uk.

7. Security and updates

We use access controls and authentication to protect private account information and conversations. No online service can guarantee complete security. Keep your password private and tell us promptly about suspected account misuse.

We may update this policy as the service changes. The date above shows the latest revision; we will communicate material changes where appropriate.