Privacy Policy

1. Who We Are

Motorly (“we”, “us”, “our”) operates the motorly.ie website, a used car marketplace with buyer research tools. We are the data controller for the personal data processed through our platform.

Contact: privacy@motorly.ie

2. Data We Collect

2.1 Aggregated Listing Data

We aggregate publicly available car listing data from Irish and UK automotive marketplaces. This data includes vehicle details (make, model, year, price, mileage), dealer business names, and listing metadata. We do not collect or display private seller contact information (phone numbers, email addresses) from aggregated sources.

2.2 Data You Provide

If you use our services, we may collect:

• Sell My Car form: Email address, phone number (optional), vehicle details
• Dealer applications and subscriptions: Business and contact name, business email, optional phone and public website, county, approximate stock range, current stock-management method, plan interest, application status, and the business email used for checkout
• Payments and subscriptions: Product, amount, currency, payment/subscription status and Stripe transaction references; Motorly does not receive or store your full card details
• Takedown requests: Email address, listing details, reason for removal
• Email preferences: The purpose you explicitly opted into or withdrew, the consent wording/version, source, and timestamp
• Saved Searches: Your confirmed account, search name and Irish vehicle filters, whether you requested daily or weekly email alerts, evaluation times, and a bounded snapshot of up to eight public matches when an alert is prepared
• Saved Cars: A private account preference containing the car reference, market, price when first saved, and time saved; signed-out saves remain only in this browser until you sign in
• Seller performance: Daily aggregate counts of first-party listing-page opens, account saves and enquiry delivery attempts; the page-open counter stores no visitor identity, IP, device, URL or message content

2.3 Automatically Collected

• Consented analytics: Page views, tool usage, and privacy-filtered conversion events via Google Analytics 4 and PostHog
• Technical: IP address, browser type, device type (standard web server logs)
• Abuse prevention: Before a rate-limit key is stored in Supabase, Motorly replaces its IP-based identifier with a server-keyed HMAC token; the database does not receive the raw IP in that key

3. How We Use Your Data

• Marketplace operation: Displaying listings, connecting buyers and sellers
• Buyer research tools: Generating pricing analytics, market trends, and insights
• Saved Cars: Keeping a private shortlist and showing price movement or availability since you saved a car. Saving does not opt you into email or marketing.
• Saved Searches: Keeping reusable Irish search filters and, only when you request it, checking for newly observed matches or price reductions of at least €250 and 2%. You can save a search without email and pause any alert.
• Seller performance: Showing a seller aggregate activity for their own advert without exposing buyer identities or using advertising profiles
• Communication: Responding to enquiries, processing takedown requests
• Dealer onboarding: Reviewing a dealer’s identity, proposed stock route and activation requirements before anything is published
• Optional seller updates: Only for the specific purpose the seller actively selected; free listings and essential emails do not depend on this choice. A dealer application does not grant marketing permission.
• Platform improvement: Understanding usage patterns, improving features

4. Legal Basis for Processing

Under GDPR, we process personal data on the following bases:

• Contract steps: Providing listings, accounts, purchases and enquiries you request
• Consent: Optional analytics and purpose-specific seller updates, using an unchecked choice you can withdraw. Dealer marketing requires a separate mailbox-confirmed choice and is not enabled by an application.
• Requested service: Saved Search email alerts are sent only for a confirmed account and an explicit per-search request; saving filters alone does not enable email.
• Legitimate interest: Aggregating publicly available listing data to provide buyer research tools
• Legal obligation: Responding to data subject access requests and takedown requests

5. Data Sharing

We do not sell your personal data. We may share data with:

• Supabase: Database hosting (EU region)
• Vercel: Website hosting
• Cloudflare R2: Storage and delivery of seller-uploaded vehicle photos and approved archived listing images
• Resend: Delivery of verification, enquiry, application acknowledgement, requested Saved Search alerts, other requested service emails and seller tips you explicitly chose to receive
• Stripe: Secure checkout, payment and subscription processing; Stripe receives the checkout email and payment details under its own privacy terms
• Google Analytics 4: Consented website usage and aggregate conversion analytics
• PostHog EU: Consented, privacy-filtered product analytics; sensitive routes are excluded from session replay

We configure EU collection where supported and limit each provider to the data needed for its purpose. Some providers may process data outside the EEA under their data-processing terms and recognised transfer safeguards, such as adequacy decisions, the EU-US Data Privacy Framework where applicable, and Standard Contractual Clauses.

6. Data Retention

• Aggregated listing data: Retained for market analysis purposes. Historical data is anonymized.
• Seller contact information: Retained for 90 days after listing expiry, then deleted.
• Takedown requests: Retained for 12 months for compliance record-keeping.
• Dealer applications: Reviewed after 24 months if onboarding was not activated; active customer records are retained while needed to provide and administer the service.
• Payment and subscription records: Retained while needed to administer the service, resolve payment disputes, and meet applicable accounting and tax obligations. Full card details are retained by Stripe, not Motorly.
• Email preferences: Retained while active. A minimal suppression record may be kept to honour an opt-out; inactive consent evidence is reviewed after 24 months.
• Saved Searches: Retained while you keep the search in your account. Muted searches are reviewed after 12 months. Unsent alert jobs expire within 24 hours and their terminal delivery metadata is reviewed after 90 days; the alert snapshot contains no registration or seller contact details.
• Seller check-in schedule: Contains no email address or message content. Unsent check-ins expire within 120 hours of first publication, and terminal scheduling metadata is reviewed after 90 days.
• Saved Cars: Account saves remain until you remove them or delete your account. Signed-out browser saves expire after one year and can be cleared from Saved Cars.
• Listing performance counters: Aggregate daily counters are retained for marketplace performance reporting; they contain no visitor identifiers or message content.
• Analytics data: Retained according to the configured Google Analytics 4 and PostHog EU retention settings.
• Rate-limit tokens: Short-lived pseudonymous counters expire with their abuse-prevention window and are cleaned up approximately one day later.

7. Your Rights

Under GDPR, you have the right to:

• Access your personal data (Article 15)
• Rectification of inaccurate data (Article 16)
• Erasure of your data (Article 17) — submit a takedown request
• Restrict processing (Article 18)
• Data portability (Article 20)
• Object to processing (Article 21)
• Lodge a complaint with the Data Protection Commission (Ireland)

To exercise any of these rights, email privacy@motorly.ie or use our takedown request form.

8. Cookies

We use essential storage for site functionality, including a versioned Saved Cars shortlist on this device when you are signed out. Google Analytics 4 and PostHog remain denied until you actively accept analytics. Advertising storage, ad user data, and ad personalization remain denied; Motorly does not currently install Meta, TikTok, Reddit, or Google Ads pixels. You can withdraw or restore analytics consent at any time below.

9. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated “last updated” date. A policy update does not override your recorded analytics choice.

10. Contact

Data Protection Officer: privacy@motorly.ie

You may also contact the Irish Data Protection Commission: www.dataprotection.ie