Privacy policy

Last updated: 31 October 2026

This policy explains what personal data Car Watcher (carscraper.co.uk) collects, why, how long we keep it, and the rights you have over it under UK data protection law (the UK GDPR and the Data Protection Act 2018).

Who we are

Car Watcher is run by Charles Bull, who is the data controller for your personal data. Contact: [email protected]. ICO registration number: registration pending.

What we collect

Data	Why	Lawful basis
Your name and email address	To create and run your account, sign you in, and send the emails you ask for	Contract
Your password	To sign you in. We only store a one-way scrambled (hashed) version, never the password itself	Contract
Two-factor sign-in details (emailed codes, or an authenticator-app secret for older accounts) and “remembered” devices	To keep your account secure	Contract and legitimate interests (security)
Your saved searches, including any postcode and radius you enter	To run the searches and show you matching cars	Contract
The car adverts found for your searches, and when you last viewed each search	To show results, spot new listings and price drops, and send your alert emails	Contract
Your IP address	Held in memory for up to an hour to limit repeated sign-in attempts and searches. It is never saved to our database	Legitimate interests (preventing abuse)

If you try a search without an account, we only use what you type into the search form to run that search. Nothing about it is stored against you.

We do not sell your data, use it for advertising, or profile you. We don't use analytics or tracking tools.

Information from car adverts

To run your searches, Car Watcher reads public car adverts on UK marketplaces and manufacturer approved-used sites. For each matching advert we keep the link, title, price, mileage, year, fuel, gearbox, general location, photo link and, where shown, the description. Where an advert is placed by a private seller, some of this (for example their town, or anything they wrote in the description) may be personal data about them.

Why: to show matching adverts to the user who saved the search, and to spot new listings and price drops. Our lawful basis is legitimate interests: helping buyers find cars that sellers have chosen to advertise publicly. We don't contact sellers, combine adverts to build profiles of them, or use the data for anything else.
Where it comes from: the public advert on the marketplace where the seller listed it.
Who sees it: only the user whose search found the advert.
How long: deleted 90 days after the advert is no longer listed.

We can't tell sellers individually, because we have no way of contacting them and doing so would mean collecting more data about them. This policy is published instead. If you're a seller and want an advert removed from Car Watcher, or want to exercise any other data right, contact us at the address above with the advert's link.

Emails

We send emails you need for your account (verification links, sign-in codes, password resets) and, for searches where email alerts are on, a digest of new cars and price drops. You can turn alerts off for any search by editing it.

Cookies

We use only two cookies, both strictly necessary, so we don't ask for consent:

carwatcher_session: keeps you signed in (up to 30 days, or until you sign out).
carwatcher_trusted: set only if you tick “remember this device”, so you can skip the sign-in code on that device for 30 days.

Our network provider Cloudflare may also set a security cookie to protect the site from attacks.

Who else handles your data

We use a small number of service providers, under contracts that require them to protect your data:

Microsoft (Azure) sends our emails, and stores our encrypted database backups in the UK.
Cloudflare carries traffic between your browser and our servers, and protects the site from attacks.

These providers may process data outside the UK. Where they do, the transfer is covered by UK adequacy regulations or the UK International Data Transfer Agreement / Addendum. Our servers and database are in the UK.

When you open an advert, you go to the marketplace that listed it (for example AutoTrader or eBay). Their own privacy policies apply there.

How long we keep it

Your account and searches: until you delete them. Deleting your account removes everything straight away.
Accounts that never verify their email: deleted after 30 days.
A new email address you asked to switch to but never confirmed: forgotten within a day of its 48-hour link expiring.
Adverts that are no longer listed: deleted 90 days after we last saw them.
Scan history (when each marketplace was checked): 30 days.
Sign-in records: 90 days after they expire. Used or expired email links and codes: 7 days.
Backups: we keep a daily backup of the database for 14 days, on our server and as an encrypted copy stored with Microsoft Azure in the UK. Deleted data is gone from backups within 14 days too.

Your rights

You can:

See and download your data: go to Account and choose “Download my data”.
Delete your account and data: go to Account and choose “Delete my account”.
Correct your data: change your name or email on the Account page, and edit your searches in the app. A new email address is only used once you've clicked the link we send to it.
Object to or restrict our use of your data, or ask any other question about it: contact us at the address above.

We'll reply within one month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). We'd appreciate the chance to put it right first.

Security

Sign-in requires two-factor authentication. Passwords are stored as salted hashes, and sign-in sessions, emailed links and codes are stored only as hashes. All traffic is encrypted (HTTPS).

Children

Car Watcher is for adults. You must be 18 or over to create an account.

Changes

If we change this policy we'll update the date at the top. If a change is significant we'll email account holders.