Privacy policy
Who we are
OpenHood is a community and curated marketplace for enthusiast cars, operated from the United Kingdom by Victor Ulgenes, an individual (not yet an incorporated company). For data-protection purposes that individual is the "data controller": the person responsible for your data and accountable for how it is handled. You can contact us at help@openhood.uk.
The short version
We use what you give us, and how you use OpenHood, to run the service, to improve it, and to produce statistics about the car market that we sell. If you agree in Your data, we also pass your details to partners for their offers and choose adverts for you. Your V5C and MOT documents are kept private and never shown to buyers. You choose whether your surname is shown. On the Register you choose who sees each car page, and number plates are covered before anyone else sees your photos.
What we collect, and why
We only collect data for specific, stated purposes. Where the law requires a "lawful basis", ours is performance of a contract (running your account and your listing), our legitimate interests (keeping the site secure and free of fraud and spam, understanding how OpenHood is used, improving it, and producing and selling anonymous market statistics), or your consent, as noted below.
- Account details: your email address and password. Passwords are hashed by our authentication provider; we never see or store them in readable form.
- Profile details: your name, optional phone number, and optional profile photo. Others see your first name and the initial of your surname (for example "John D****"), or your full name if you choose to show your surname. Your phone number and email address are not shown publicly.
- Listing details: everything you enter about a car you are selling: specification, price, location, history, modifications, known faults, and the story you choose to write about owning it. This is published on the site, so treat it as public.
- Listing photos and cold-start video: published publicly as part of your listing. Please do not upload photos containing other people, or images you do not have the right to share. Photos are stored at the quality you took them. We store a short description and tags for each photo (for example "front left wheel") to sort your gallery.
- The iPhone app: the app uses your camera to take listing photos, documents and the cold-start video, and your photo library only when you choose photos from it. While you work on a listing, your drafts are kept on your phone, excluded from iCloud backup, and sent to us when you save. While you take a photo the app reads the phone's motion sensor to help you hold it level; that reading never leaves your phone. The app has no advertising code. It tells us which cars and posts you open, as described under "Usage and market statistics".
- Notifications: if you turn them on, we keep your phone's notification address (a token from Apple) with your account to send them, and remove it when you sign out. You choose which kinds you get.
- Use my location: if you use it to find cars near you, the app reads your position once, rounded to about a kilometre, and sends it with that search. It is kept only if you save the search.
- App diagnostics: when something goes wrong, or while photos upload, the app sends us what happened, with the app version, so we can fix it. Linked to your account, kept for 90 days.
- Verification documents: a photo of your V5C logbook and MOT certificate. These contain your name and address. They are stored privately, are never published, and are visible only to you and to OpenHood staff reviewing your listing.
- Vehicle identifiers: the registration number and, where provided, the VIN of the car you list. Stored encrypted and not published in full.
- Enquiries and messages: the content of enquiries you send about a car, with your name and email, and the content of direct messages between buyers and sellers. Messages are visible to the people in that conversation and, where necessary to investigate abuse or a report, to OpenHood staff.
- Messaging: your first name, or your full name if you show your surname, is shown to whoever you message, and theirs to you.
- Test drives: when you book a test drive you give the seller your phone number, the times you can do, a suggested meeting place if you choose one, and confirm you hold a licence and insurance. The seller sees these; once they confirm, you both see the agreed time and place. Test drives are UK only, so meeting places include a UK postcode.
- Views and saves: we count how many times a listing is viewed and how many people saved it, and show the seller those totals, not who viewed or saved it.
- Welcome questions and saved searches: after sign-up you can tell us what you drive and what you are looking for. This is optional, used to set up a saved search and suggest cars for you, and can be skipped.
- Early access and testing: we record when a tester accepted the tester agreement and which version, and the answers to the optional feedback survey. These are read only by the OpenHood team.
- Activity data: which listings you save, favourite, or swipe yes/no on in Swipe mode. This is tied to your account and used to order recommendations for you, and, without anything that identifies you, in the market statistics described below. It is not shown to sellers or other users.
- Technical and security data: your IP address and basic request information, used to rate-limit abuse (for example to stop bots flooding the enquiry form) and to run anti-bot checks. Retained only briefly for that purpose.
- Payment data: if you pay a listing fee, the payment itself is handled entirely by Stripe. We never see or store your full card details. We store only a payment reference, the amount, and whether it succeeded.
The Register: car pages, posts and your profile
The Register is the community part of OpenHood. What you put there is meant to be seen, so this is what is public, what is not, and how we protect it. Our lawful basis is running the service you signed up for.
- Your profile: your @username, first name, country and area (never a town or street), a short bio and a profile photo, all optional except the username. They are public, with how many people follow you and whom you follow. Profile photos are checked automatically before anyone else sees them.
- Car pages: the facts about your car, its photos, your story, your dated history entries and the past owners you add (first names and dates only). You choose who sees each page: only you, anyone with the link, or everyone.
- A car's history: each entry can hold a date, a mileage, who did the work, what it cost and photos of receipts and documents. You choose who sees each entry: only you, the car's followers, or everyone who can see the page. New entries start as only you. What it cost is only ever shown to you. Receipts and documents often show names, addresses and the registration, so we remind you before you share one. Like any photo, each is sent to Google's Gemini API to check it is suitable before it is kept, and its location data is removed. If you scan a receipt, it is also sent to Gemini to read it into an entry for you to check; nothing is saved until you save it. Services, repairs, MOTs and mileage readings are not shown on the car's page: if you sell the car on OpenHood, the ones you haven't kept to yourself appear on its sale page.
- A car's MOT history: if you import it, we send the car's registration to DVSA's MOT history service and add the tests it holds to the car's history. If you scan screenshots of the GOV.UK MOT history page instead, they are sent to Gemini to read the tests for you to check, then deleted.
- A car's jobs list and cheat sheet: the jobs you plan, the parts and estimates, and figures like tyre sizes and the paint code. Only you can see them. A suggested cheat sheet comes from the car's make, model and year, sent to Gemini without anything about you.
- Your want list: the cars you would love to own. It is private unless you make it public on your profile. A car's page shows how many members want one like it, never who.
- The registration number: kept privately and never shown on the page. We use it so a car can only have one page, to fill in its specification, and to check a car against its V5C when you ask us to.
- Number plates in photos: before anyone else sees a photo, it is sent to Google's Gemini API to find any number plates, and each one is covered with a blank plate. The photo as you took it is kept privately, for you and OpenHood staff, so a plate can be covered again or, if you choose, shown. If the check cannot run, the photo stays hidden until it can.
- Posts: photos, videos of up to a minute and a caption about a car. A post can be seen by whoever can see that car's page. Number plates are covered in photos but can be seen in videos. If you @mention someone, they can see it and their username links to their profile.
- Comments: what you write under a post, and the comments you like. A comment can be seen by whoever can see the post. Deleting one removes what it said; replies to it stay.
- Offers: an offer you make on someone's car, with any note, is seen only by its owner, who sees who made it. Offers also count, combined with others, in the market statistics below.
- Meets: the meets you suggest, say you would go to, host or go to, and what you write in a meet's chat, which whoever can see the meet can read. How many are going is public; the host is named. A meet's place is the public venue its host chose.
- Likes, follows and communities: the people and cars you follow, the posts you like, and the communities your public cars put you in. Totals are shown publicly; a community shows its members.
- Location: only the country and area you choose. We remove location data from every photo and video before it is stored, and we never show where a car is kept.
- Reports and blocks: what you report and why, and whom you block. The person reported is never told who reported them, and people you block are not told.
- When you delete your account: your profile, car pages (with their photos, posts, history and follows), likes, follows, offers, want list and community memberships are deleted, and what your comments said is removed.
Usage and market statistics
We count how OpenHood is used: which car pages, posts and listings are opened, and which cars are followed, saved and offered on, along with the car's make, model, year and area. It is linked to your account so we can understand how people use OpenHood and improve it. Turn off "Help improve OpenHood" in Your data and it is anonymous from then on. We keep it for 25 months. When you delete your account, anything linked to it becomes anonymous.
- From this, the Register and the Marketplace we produce statistics about the market for enthusiast cars: how many cars of a model there are and where, asking prices, the range of offers made, and how many people follow, save, want and look at them.
- Figures from small groups are withheld so that no one can be identified, and offers only appear combined with others.
- We sell or license these statistics to businesses such as dealers, specialists, insurers, valuers and auction houses, and may publish them. They contain no personal data.
- Our lawful basis for counting use and producing statistics is our legitimate interest in running and funding OpenHood; you can object at help@openhood.uk or turn it off in Your data.
Partners and adverts
Some businesses pay OpenHood to reach owners and buyers of enthusiast cars. Nothing about you goes to any of them unless you say so, kind by kind, in Your data (in your account on the website and the app), or you ask for a quote from one. Each choice is off until you turn it on, and you can turn it off at any time.
- Finance offers, insurance quotes, car services (inspections, transport and storage) and dealers buying cars are separate choices.
- What a partner receives: what its offer needs, usually your name, email address, phone number if you gave it, and the car (which can include its registration). Never your messages or your V5C and MOT documents. Each partner then holds it under its own privacy policy. Ask us and we will tell you which partners have received your details.
- Turning a choice off stops anything further going to those partners; ask them, or us, to delete what they already have.
- Adverts: any adverts may be chosen from the page you are on (for example the make of car) and from what you look at on OpenHood, which never leaves OpenHood. Turn off personalised adverts in Your data and they are chosen from the page alone.
- Our lawful basis for passing your details to a partner is your consent; for choosing adverts from what you look at on OpenHood, our legitimate interest in funding OpenHood, which you can object to by turning it off.
What stays private
A few things are never published or passed on.
- Your V5C and MOT documents and your messages: never in our statistics and never passed to a partner.
- Your address, phone number and email address are not published, and your surname only if you choose to show it.
- We use an automated check on listing photos. When you add photos to a listing, they are sent to Google (Gemini API) to work out which view each photo shows, whether it is clear enough to publish, and whether the set shows the same car. Google processes them on our instructions under a paid API tier whose terms prohibit using the content to train their models, and the images are not retained by them for that purpose. This check never sees your V5C or MOT documents, which are never sent to any third party.
Who processes data on our behalf
We use a small number of established providers to run the service. They process data on our instructions under their own data-processing terms and are not permitted to use it for their own purposes. Some are based outside the UK; where that is the case, transfers rely on the safeguards those providers offer, such as standard contractual clauses.
- Supabase: database, file storage, and account authentication.
- Vercel: website hosting and content delivery.
- Stripe: payment processing for listing fees. Stripe acts as an independent controller of the payment data it collects; see stripe.com/privacy.
- Resend: sending transactional email, such as enquiry notifications and listing status updates.
- Cloudflare: anti-bot checks (Turnstile) on our sign-up, sign-in, and enquiry forms, which involves your IP address and basic browser signals.
- Upstash: short-lived storage of rate-limiting counters keyed to your IP address, to protect the site from abuse.
- Google (Gemini API): the automated check on listing photos described above; checking Register photos, post photos and profile photos and finding number plates to cover in them; reading receipts and MOT screenshots you choose to scan; plus checks that send only the car's make, model, trim and year: whether it is an enthusiast car, filling in its specification and cheat sheet, and estimating a typical price range so an asking price can be sanity-checked. The app asks before it sends the first photo. Never your verification documents, and never your account details.
- Apple: sending notifications to your iPhone, if you turn them on.
- Vercel Web Analytics: anonymous counts of page views on the website. It sets no cookies and does not identify you.
- postcodes.io: an open, free UK postcode lookup, used to place your listing on the map so buyers can filter and sort by distance. Only the postcode itself is sent; the result is stored rounded to roughly a mile of precision before it is ever shown to a buyer, so it never pinpoints a specific address.
Verification documents
Your V5C and MOT are the most sensitive thing you give us, so they get the strictest handling. They are stored in a private location that is not publicly reachable, access is restricted at the database level to you and to OpenHood staff reviewing your listing, and they are retrieved only through short-lived expiring links. They are never shown to buyers, never attached to your public listing, and never used for any purpose other than verifying that the car and seller are genuine. If your listing is rejected or withdrawn you can ask us to delete them immediately.
How long we keep things
We keep data only as long as there is a reason to.
- Account and profile data: while your account exists, and deleted on request.
- Listings and their photos: while the listing exists. Sold or withdrawn listings may be kept for a limited period for records and disputes.
- Verification documents: until the listing is resolved, or sooner if you ask us to delete them.
- Live listings: shown for 30 days at a time; an expired listing is hidden, not deleted, until you renew it or delete it.
- Test-drive bookings: kept with the conversation they belong to, so both sides have a record, and deleted with your account.
- Enquiries and messages: kept so both sides retain a record of the conversation, and deleted on request where we are not required to keep them.
- Reports: the report, and a copy of what was reported as it was then, for three years, even if it or the account behind it is deleted.
- Payment records: kept as long as legally required for financial and tax records.
- Usage data: 25 months, then automatically deleted.
- App diagnostics: 90 days, then automatically deleted.
- Your choices in Your data, and each change to them: while your account exists, so we can show what you agreed to and when.
- Security and rate-limiting data: minutes to hours, then automatically discarded.
Your rights
Under UK data-protection law you have the right to ask us for a copy of the data we hold about you, to correct it if it is wrong, to delete it, to restrict or object to how we use it, and to receive it in a portable format. You can also withdraw consent at any time where we relied on it. Contact us at help@openhood.uk and we will respond within one month, at no charge. If you are unhappy with our response you can complain to the Information Commissioner's Office (ico.org.uk), the UK's data-protection regulator.
Security
Everything is served over an encrypted connection, and data is encrypted at rest by our hosting providers. Access is restricted at the database level so users can only reach their own records, and verification documents sit in private storage reachable only through expiring links. No system is perfectly secure, but if a breach ever affects your rights we will tell you and the Information Commissioner's Office as the law requires.
Children
OpenHood is not intended for anyone under 18 and we do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
We may update this policy. The date at the top shows when it last changed, and the app opens this same page, so it is always the current version. If a change significantly affects how we use your data, we will let you know.
Contact
For anything about your data, including requests to see or delete it, email help@openhood.uk.