Legal
Privacy Policy
Effective date: 22 June 2026
1. Who we are
AutoIndex is a collector car market intelligence platform. References to “we”, “us”, or “our” in this policy refer to AutoIndex. We are the data controller for personal data collected through this website.
Contact: hello@auto-index.co
2. What data we collect
Account data
When you create a free Enthusiast account: your name, email address, and password (stored as a secure hash). We use this to provide the Service and communicate with you.
Collector interest registration
When you register interest in the Collector tier: your name, email address, and any feature preferences you select. We use this to notify you of early access and launch updates.
Guide interest
When you register interest in a collector guide: your email address and the guide slug. We use this to notify you when that guide goes on sale.
Usage data
Standard server logs (IP address, browser type, pages visited) are retained for security and performance monitoring. We do not use third-party tracking pixels or advertising cookies.
Watchlist & portfolio data
Cars you add to your watchlist or portfolio are stored in association with your account and are visible only to you.
3. Legal basis for processing
- Contract: processing your account and delivering purchased guides.
- Legitimate interests: improving the Service, fraud prevention, security.
- Consent: sending marketing emails (newsletter, launch updates). You can withdraw consent at any time by unsubscribing.
4. How we share your data
We do not sell your personal data. We share data only with:
- Supabase — our database and authentication provider (EU data residency).
- Stripe — payment processing for guide purchases (when available). Stripe is PCI-DSS compliant; we do not store card details.
- Vercel — hosting and edge network.
Each provider is bound by a Data Processing Agreement and GDPR-compliant data handling terms.
5. Data retention
Account data is retained for as long as your account is active. If you close your account, personal data is deleted within 30 days, except where retention is required by law (e.g. purchase records for tax purposes, retained for 7 years). Interest registration data is retained until you unsubscribe or request deletion.
6. Your rights (UK GDPR)
You have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request deletion of your data (“right to be forgotten”)
- Object to or restrict processing
- Data portability (receive your data in a machine-readable format)
- Withdraw consent for marketing at any time
To exercise any of these rights, email hello@auto-index.co. We will respond within 30 days. You also have the right to lodge a complaint with the ICO (ico.org.uk) if you believe your data has been handled unlawfully.
7. Cookies
AutoIndex uses only essential cookies required for authentication (session tokens). We do not use analytics, advertising, or tracking cookies. No consent banner is therefore required under UK GDPR for the current functionality.
8. Changes to this policy
We may update this policy as the Service evolves. Material changes will be notified to registered users by email. The effective date at the top of this page reflects the most recent revision.