1. Who We Are

Motorly is run by John Fox, a sole trader based in Ireland. John Fox is the data controller for the personal data described in this policy. “We”, “us” and “our” mean John Fox, who operates the motorly.ie website and app, a used car marketplace with buyer research tools.

Contact: John Fox, The Old Court, Kilbride Manor, Wicklow, Ireland, or privacy@motorly.ie

2. Data We Collect

2.1 Adverts Collected From Other Websites

We automatically collect car adverts that are publicly available on Irish and UK car marketplaces. The site each advert came from is shown on its Motorly page. If you advertised a car on one of those sites, you did not give this data to us directly, and we do not contact each seller individually. This section is how we tell you.

For each advert we store the complete page data the source site returned, every time we saw the advert, as well as the details we use. Depending on the site and the advert, that can include:

Vehicle and advert details: Make, model, year, mileage, price and price changes, county or town, how long the car was advertised, the link to the original advert and the seller’s description
Registration numbers: Where the source page includes one
Photos: Links to the advert’s photos and, for many adverts, our own copies. Photos can show number plates, people and homes
Dealer details: Business name, which can be a person’s name, plus county or town, website, map location, ratings and contact details the source site provides
Private seller details: On some sites, the seller’s display name, account number, the date they joined and their county or town
Phone numbers and email addresses: Where a seller wrote them in the advert text, or where the source site included them in its page data, in some cases in encrypted form

We do not show private sellers’ names, phone numbers or email addresses on Motorly, and we do not show the description text of collected adverts. We show a name only where we treat the seller as a dealer, and on some UK sites that name can be a username. Registrations, photos, prices, price history and county are shown on public pages, and anyone can enter a registration in our free vehicle check to see advert details we hold for that car. An automatic check hides displayed text that looks like a phone number or email address, along with that advert’s photos. It can miss things, including anything visible in a photo, so please tell us if you see your details.

2.2 Data You Provide

If you use our services, we may collect:

Account: Your email address and how you sign in (email, Google or Apple)
Sell My Car form: Email address, phone number (optional), vehicle details and the IP address you submitted from. Your advert is stored with collected adverts and is included in the same statistics; your email address and phone number are not
Messages to sellers: Your name, email address and message
Dealer applications and subscriptions: Business and contact name, business email, optional phone and public website, county, approximate stock range, current stock-management method, plan interest, application status, and the business email used for checkout
Dealer stock import permission: Dealership name, business email, website address, the permission wording and version agreed to, and when it was given, confirmed or withdrawn
Payments and subscriptions: Product, amount, currency, payment/subscription status and Stripe transaction references; Motorly does not receive or store your full card details
Takedown requests: Email address, listing details, reason for removal and the IP address you submitted from
Email preferences: The purpose you explicitly opted into or withdrew, the consent wording/version, source, and timestamp
Saved Searches: Your confirmed account, search name and Irish vehicle filters, whether you requested daily or weekly email alerts, evaluation times, and a bounded snapshot of up to eight public matches when an alert is prepared
App Notifications: If you turn on alerts in the Motorly app, the push token Apple or Google gives that phone, linked to your account, so we can notify that phone when a saved search has new matches or price drops, or a car you saved drops in price. Signing out or turning off notifications stops them.
Saved Cars: A private account preference containing the car reference, market, price when first saved, and time saved; signed-out saves remain only in this browser until you sign in
Seller performance: Daily aggregate counts of first-party listing-page opens, account saves and enquiry delivery attempts; the page-open counter stores no visitor identity, IP, device, URL or message content
Sale price (optional): If you choose to tell us what you sold your car for when you mark it sold, we store that price with the listing reference and its final asking price, not with your email or account

2.3 Automatically Collected

Consented analytics: Page views, tool usage, and privacy-filtered conversion events via Google Analytics 4 and PostHog
Technical: IP address, browser type, device type (standard web server logs)
Abuse prevention: Before a rate-limit key is stored in Supabase, Motorly replaces its IP-based identifier with a server-keyed HMAC token; the database does not receive the raw IP in that key

3. How We Use Your Data

Marketplace operation: Displaying listings, connecting buyers and sellers
Buyer research tools: Generating pricing analytics, market trends, vehicle checks, and insights
Dealer pages: Showing each dealer’s stock, ratings and a trust score worked out from its ratings and advert history
Services for the motor trade: John Fox also uses collected adverts and adverts placed on Motorly for market research and statistics in a separate service for motor-trade businesses
Saved Cars: Keeping a private shortlist and showing price movement or availability since you saved a car. Saving does not opt you into email or marketing.
Saved Searches: Keeping reusable Irish search filters and, only when you request it, checking for newly observed matches or price reductions of at least €250 and 2%. You can save a search without email and pause any alert.
Seller performance: Showing a seller aggregate activity for their own advert without exposing buyer identities or using advertising profiles
Market price statistics: Optional reported sale prices are used in anonymous statistics about what cars sell for, combined in groups of at least five sales, and are never shown on an advert. When you report your own sale price, we also show you, privately, how it compares with your asking price and with similar adverts
Communication: Responding to enquiries, processing takedown requests
Dealer onboarding: Reviewing a dealer’s identity, proposed stock route and activation requirements before anything is published
Optional seller updates: Only for the specific purpose the seller actively selected; free listings and essential emails do not depend on this choice. A dealer application does not grant marketing permission.
Platform improvement: Understanding usage patterns, improving features

4. Legal Basis for Processing

Under GDPR, we process personal data on the following bases:

Contract steps: Providing listings, accounts, purchases and enquiries you request
Consent: Optional analytics and purpose-specific seller updates, using an unchecked choice you can withdraw. Dealer marketing requires a separate mailbox-confirmed choice and is not enabled by an application.
Unfinished checkout reminder: If a checkout expires unpaid, we may send one reminder email with a link back to it, but only if you ticked the optional, unticked-by-default “Email me one reminder if I don’t finish this purchase” box on our page before going to payment, whether or not you were signed in. We record when you ticked it and the wording you saw. You can withdraw at any time: use the one-click unsubscribe link in the email, or email privacy@motorly.ie before it arrives.
Requested service: Saved Search email alerts are sent only for a confirmed account and an explicit per-search request; saving filters alone does not enable email.
Legitimate interest: We rely on this for collecting, storing and showing adverts from other websites and using them for market research and statistics. Our interests are running a car search and price comparison service, and earning a business income from it and from the motor-trade service described above. You can object at any time (see section 7)
Legal obligation: Responding to requests to use your data protection rights, and keeping accounting and tax records

5. Data Sharing

We do not sell lists of people’s details and we do not sell data to marketers. Motor-trade businesses that pay for the separate service described in section 3 can see market data built from adverts, including individual adverts with their price, price history and a link to the original advert, and dealer-level information.

We may also share data with:

Supabase: Database hosting (EU region). The same database also serves the separate service described in section 3
Netcup and Hetzner: Hosting of the server that collects adverts, the stored adverts and their backups
Google Drive: A further encrypted backup copy of the database
Vercel: Website hosting
Cloudflare R2: Storage and delivery of seller-uploaded vehicle photos and our copies of photos from collected adverts
Google Gemini: If you use “Generate with AI” when writing an advert, the vehicle details you entered are sent to Google to draft the text
Expo, Apple and Google: Delivery of app notifications you turned on. They receive the phone’s push token and the notification text (your saved search’s name and a count of new cars or price drops, or a saved car’s year, make, model and new price)
YouTube: If you press play on a seller’s video, YouTube (Google) receives your request and applies its own privacy terms. Nothing loads from YouTube until you do
Resend: Delivery of verification, enquiry, application acknowledgement, requested Saved Search alerts, other requested service emails and seller tips you explicitly chose to receive
Stripe: Secure checkout, payment and subscription processing; Stripe receives the checkout email and payment details under its own privacy terms
Google Analytics 4: Consented website usage and aggregate conversion analytics
Sentry: Error and performance monitoring, so we can find and fix faults. It is set not to collect IP addresses, location, cookies or request bodies, and tokens are removed from page addresses; a small share of error sessions are replayed with all text masked and media blocked
PostHog EU: Consented, privacy-filtered product analytics; sensitive routes are excluded from session replay

Separately, we count page views with Vercel Web Analytics, which is built into our hosting. It sets no cookies and stores nothing on your device, so it runs whether or not you accept analytics cookies. It records the page address without any query string, the referring site, and your broad location, device and browser type. Vercel does not store your IP address; it uses a daily-changing hash that cannot identify you or follow you across sites. We use these aggregate counts under our legitimate interest in knowing which pages are read, and never combine them with your account, enquiries or searches.

With the same tool we also count a few steps on the site and in the app, such as starting a listing, starting a checkout or completing a purchase, tagged only with the type of link that brought the visit (for example a Google or Facebook ad). These counts carry no identifier and store nothing on your device.

We configure EU collection where supported and limit each provider to the data needed for its purpose. Some providers may process data outside the EEA under their data-processing terms and recognised transfer safeguards, such as adequacy decisions, the EU-US Data Privacy Framework where applicable, and Standard Contractual Clauses.

6. Data Retention

Collected adverts: Kept with no deletion date, including every version we collected, the complete page data and any seller details in it. This data is not anonymised, and it stays stored after an advert ends or leaves our public pages. Copies are held in backups, some of which also have no deletion date.
Copies of advert photos: Kept with no automatic deletion date, including after the advert ends.
Seller contact information: We aim to delete your email address, phone number and IP address 90 days after your advert ends. This deletion is not automatic yet, so email us if you want it done sooner.
Messages to sellers: We aim to delete these 12 months after they are sent. This deletion is not automatic yet.
Takedown requests: We aim to delete these after 12 months. This deletion is not automatic yet.
Dealer applications: Reviewed after 24 months if onboarding was not activated; active customer records are retained while needed to provide and administer the service.
Dealer stock import permission: Kept while the import is active as the record of permission; reviewed 24 months after it was given if withdrawn or never confirmed.
Payment and subscription records: Retained while needed to administer the service, resolve payment disputes, and meet applicable accounting and tax obligations. Full card details are retained by Stripe, not Motorly.
Email preferences: Retained while active. A minimal suppression record may be kept to honour an opt-out; inactive consent evidence is reviewed after 24 months.
Saved Searches: Retained while you keep the search in your account. Muted searches are reviewed after 12 months. Unsent alert jobs expire within 24 hours and their terminal delivery metadata is reviewed after 90 days; the alert snapshot contains no registration or seller contact details.
App Notifications: A phone’s push token is kept while alerts are on for it and is switched off when you sign out or the phone stops accepting notifications.
Seller check-in schedule: Contains no email address or message content. Unsent check-ins expire within 120 hours of first publication, and terminal scheduling metadata is reviewed after 90 days.
Saved Cars: Account saves remain until you remove them or delete your account. Signed-out browser saves expire after one year and can be cleared from Saved Cars.
Listing performance counters: Aggregate daily counters are retained for marketplace performance reporting; they contain no visitor identifiers or message content.
Analytics data: Retained according to the configured Google Analytics 4 and PostHog EU retention settings.
Rate-limit tokens: Short-lived pseudonymous counters expire with their abuse-prevention window and are cleaned up approximately one day later.

7. Your Rights

Under GDPR, you have the right to:

Access your personal data (Article 15)
Rectification of inaccurate data (Article 16)
Erasure of your data (Article 17) — if you have an account, use Delete my account on your account page or in the Motorly app; for anything else, submit a takedown request
Restrict processing (Article 18)
Data portability (Article 20)
Object to processing (Article 21)
Lodge a complaint with the Data Protection Commission (Ireland)

To exercise any of these rights, email privacy@motorly.ie or use our takedown request form. You do not need an account. We will reply within one month.

Deleting your account: When you are signed in, you can delete your account yourself from your account page or the Motorly app, or email us and we will do it. This ends any live or paused advert, deletes your saved cars, saved searches, alerts, app notification devices and email preferences, removes your contact details from your adverts and from messages you sent to sellers, and deletes your sign-in. We keep payment and receipt records needed for accounting and tax, takedown and legal request records, proof of email consent or withdrawal, and any do-not-email suppression record.

What a takedown does: Requests are handled by hand. We aim to stop showing the advert on Motorly within 24 hours, but it can take longer. While an advert stays on the original site, we may collect it again, so please remove it there too.

A takedown does not delete our stored copy of a collected advert. Those stored records are built not to be changed or deleted, so deleting one is a separate manual step. If you ask us to erase your data or object to our use of it, we will consider your request and tell you what we did and why.

8. Cookies

We use essential storage for site functionality, including a versioned Saved Cars shortlist on this device when you are signed out. Google Analytics 4 and PostHog remain denied until you actively accept analytics. Advertising storage, ad user data, and ad personalization remain denied; Motorly does not currently install Meta, TikTok, Reddit, or Google Ads pixels. You can withdraw or restore analytics consent at any time below.

9. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated “last updated” date. A policy update does not override your recorded analytics choice.

10. Contact

Privacy contact: John Fox, The Old Court, Kilbride Manor, Wicklow, Ireland, or privacy@motorly.ie. We have not appointed a Data Protection Officer.

You may also contact the Irish Data Protection Commission: www.dataprotection.ie