Legal
Privacy notice
Version 1 · 26 October 2026
Who we are
SuperCar AI decides how your personal data is used, which makes us the controller under UK data protection law. Our details are on the company details page. For anything about your data, email hello@supercarai.co.
This notice covers this website, the membership request form, membership of SuperCar AI including the Specialist at specialist.supercarai.co, and SuperDealers Seat at seat.supercarai.co.
What we collect and why
| What | Why | Lawful basis | How long |
|---|---|---|---|
| Membership request: your name and email address | To read your request, reply, and set up membership if you join. We send one email confirming we received it. | Steps you ask us to take before a contract | 12 months if you do not join; as a member, see below |
| Optional details on the form: buying or selling, the car's make and model, its registration and chassis number, anything you tell us | To prepare your first car report. A registration lets us read the car's public MOT history from the DVSA. | Steps you ask us to take before a contract | As above |
| The short link you arrived from (for example /ig) | To know which of our links bring requests. Kept in your browser for the visit only and sent with your request. | Our legitimate interest in knowing what works | With your request |
| Members: your email address and one-time sign-in codes | To let you sign in. Codes are kept only in scrambled (hashed) form. | Contract | Email: while you are a member. Codes: one hour. |
| Members: your conversations with the Specialist, the cars you add, and files you upload | To answer you and keep your history. | Contract | While you are a member, or until you delete them |
| Members: usage records | To apply fair-use limits and run the service. | Contract; legitimate interests | While you are a member, then 12 months |
| Payment details, once card payments open | To take your monthly payment. Stripe processes your card; we never see the full card number. | Contract; legal obligation for tax records | Payment records: 6 years, for tax law |
| Emails you send us | To answer you. | Legitimate interests | Up to 2 years |
| Your IP address when you visit | Our host uses it to deliver and protect the site, including limits on how often a form can be sent. | Legitimate interests (security) | Held by our host under its own terms |
This website uses no advertising or analytics trackers. Our host, Cloudflare, may set a cookie that protects the site from automated abuse. The members' service and SuperDealers Seat each set one cookie, only to keep you signed in: for 90 days in the members' service and 14 days in the Seat. Pages load their fonts from Google Fonts, which means your browser sends your IP address to Google.
We do not make decisions about you by automated means that have legal or similarly significant effects. The Specialist's answers are written by an AI model: they are information, not decisions about you.
SuperDealers Seat, for dealers
Your sign-in email address is held only as a one-way hash: a scrambled form that cannot be turned back into the address. Sign-in codes are six digits, work once for ten minutes, are kept only as a hash and are deleted within 16 minutes. A cookie keeps you signed in for 14 days, and we keep only a hash of it. If you use Market Watch, the address its digest goes to is stored encrypted, used only for that digest (at most one a day, each with a link to stop them), and deleted when no watch needs it or the seat is closed. Seat emails are sent through Resend, and everything the Seat holds is stored on Cloudflare.
Car records and public sources
Our services are built from public sources: auction results, dealers' adverts, public registers and published articles. Our public pages name no private person and show no registration plate. If you think we hold information about you, email hello@supercarai.co and we will tell you what we hold and act on your rights below.
Who we share it with
We use these providers to run the service. They act on our instructions. We do not sell personal data or share it for advertising.
| Provider | What they do for us |
|---|---|
| Cloudflare | Hosts the website, the members' service and SuperDealers Seat, stores their data and protects the site |
| Notion | Our record of membership requests |
| Resend | Sends our emails: request confirmations, sign-in codes and Market Watch digests |
| Anthropic | The AI model that writes the Specialist's answers. It receives what you write in a conversation. |
| GoDaddy | Hosts our mailbox, hello@supercarai.co |
| Stripe | Will take membership payments once card payments open |
| DVSA | We send a registration number to read the car's public MOT history |
| Google Fonts | Supplies the website's fonts and receives your IP address |
Some of these providers process data outside the UK, including in the United States. Where they do, we rely on the safeguards UK law provides for this, such as the UK–US data bridge or the UK International Data Transfer Addendum.
Your rights
You can ask us to give you a copy of your personal data, correct it, erase it, limit how we use it, stop using it where we rely on our legitimate interests, or send it to you or another provider in a usable format. Email hello@supercarai.co. We reply within one month.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would like the chance to put it right first.
Keeping it safe, and under-18s
Data travels encrypted. You sign in with one-time codes, so we hold no passwords. Access to our systems is limited to the people who run the service. SuperCar AI is not for anyone under 18, and we do not knowingly collect their data.
Changes to this notice
When we change this notice we update the version and date at the top. If a change affects members, we email them first.