Privacy Policy

Privacy Policy

This policy explains what personal data Trade Scale Plus Ltd collects, how we use it, who we share it with, and the rights you have over it. It applies to dealers who use TradeScale Plus, and to the customers whose data dealers process through our platform.

Version 1.5 · Effective 12 May 2026 · Last updated 21 October 2026 (connecting your Google Tag Manager)

1. Who we are

Trade Scale Plus Ltd (Company No. 17142290), registered in England & Wales with its registered office at 12 Randell Square, Porth Tywyn, SA16 0TY, United Kingdom, is the data controller for the personal data you provide to us as a dealer using the TradeScale Plus platform.

The brand name "TradeScale Plus" is a trading style of Trade Scale Plus Ltd. Throughout this policy, "we", "us", and "our" refer to Trade Scale Plus Ltd.

2. What data we collect

From you as a dealer

• Account data: your name, business name, email address, phone number, billing address, password (hashed).
• Business data: your vehicle stock, prices, costs, prep records, sales records, communications history, dealership branding.
• Payment data: billing email and subscription metadata. We do not store card details — those are held by Stripe under their own privacy policy.
• Usage data: log entries showing which pages you visit, which actions you take, timestamps, IP addresses, browser type — used for security monitoring and product improvement.
• Communications: any messages you send us by email, support chat, or phone.

About your customers (which you upload or generate via use of the platform)

• Name, contact phone, email, address, postcode
• Vehicle of interest, finance status, part-exchange details (including a photo of the V5C if uploaded)
• Pipeline stage and history
• Emails and AI-drafted messages
• Website chat: what a visitor types to the chat assistant on your website, including any name, phone number or email address they choose to give it. Each chat is kept as a transcript, together with a short written summary of what was discussed and a reference number. After a limited time the name, phone number and email address in the transcript and summary are removed and replaced with markers (see Section 7); the rest of the conversation is kept. With each message the assistant also receives the page the visitor is on and the car pages they have opened on the dealer's website since they started the chat, so it can help with the cars they have been looking at.
• Speaking instead of typing: where the chat assistant shows a microphone button, a visitor can speak their message instead of typing it. Their own browser turns the speech into text in the message box, using the browser's speech service (Google in Chrome, Microsoft in Edge, Apple in Safari). We never receive or keep the recording. Only the text reaches us, and only if the visitor sends it.
• Notes and tags you add

For this customer data, you are the data controller and we are the data processor. See Section 10 below and our Data Processing Agreement.

3. Lawful basis

We process your dealer-account data on the following lawful bases under UK GDPR Article 6:

• Contract (Article 6(1)(b)) — to provide the service you've subscribed to.
• Legitimate interest (Article 6(1)(f)) — to operate, secure, and improve the platform; to respond to your queries; to send service-related communications.
• Legal obligation (Article 6(1)(c)) — to comply with tax, accounting, and other statutory record-keeping requirements (HMRC requires 6 years of business records).
• Consent (Article 6(1)(a)) — only where you've explicitly opted in (e.g. marketing emails about new features).

4. How we use your data

• Service delivery — running the dealership management platform you subscribed to.
• AI features — drafting follow-up messages, summarising conversations, suggesting pipeline actions. The AI sees customer names, conversation context, and vehicle interest. See Section 5.
• Account management — billing, authentication, support.
• Security monitoring — detecting abuse, debugging errors, preventing unauthorised access.
• Product improvement — understanding how the platform is used in aggregate. We do not sell behavioural data or build profiles for advertising.
• Communications — sending you service updates, billing notices, and (with consent) feature announcements.

5. Who we share data with (sub-processors)

We share data only with the sub-processors listed below, each under a written contract with appropriate data protection obligations:

Sub-processor	Purpose	Location
Supabase	Database hosting and authentication	Ireland (EU)
Stripe	Payment processing	Ireland (EU)
Anthropic	AI for the website assistant's replies and message drafting (Claude)	United States
Railway	Application server hosting	United States
Cloudflare	CDN, DDoS protection, storage for photos dealers take for buyers	Global edge
Resend	Email delivery (enquiry, booking and alert emails to dealers)	United States

Full details (purposes, data shared, contractual obligations) are on our security page. We update this list when sub-processors change and notify customers at least 14 days in advance.

We do not sell personal data. We do not share personal data with advertisers. We do not use customer data to train AI models. Anthropic's commercial terms do not allow it to use our data to train its models.

6. International transfers

Most of your data is stored in Ireland (within the EU/UK adequacy framework). Some sub-processors are in the United States (Anthropic, Railway and Resend). For transfers to the US, we rely on:

• The UK International Data Transfer Agreement (IDTA), where signed with the sub-processor.
• The EU-US Data Privacy Framework, where the sub-processor is certified under it.
• Standard Contractual Clauses approved by the European Commission and recognised by the UK.

7. How long we keep your data

Data type	Retention
Dealer account & business data	For the duration of your subscription, then deleted within 90 days of termination (subject to legal retention requirements)
Customer records (PII)	Until you delete them or we terminate the service (whichever first)
Communications (email, AI drafts)	12 months from sending
Website chat transcripts (the chat assistant on a dealer's website)	90 days after the last message in the chat, any name, phone number and email address in the transcript and in its written summary are removed and replaced with markers ("[name removed]", "[number removed]", "[email removed]"), unless the dealer has agreed a different period for their own website, in which case that period applies. The rest of the conversation - what was asked and answered, which vehicle was discussed - together with the summary, the chat's reference number, its date and message count is kept for up to 18 months, after which the whole record is deleted. The name is removed on the basis of the details the visitor gave the assistant when leaving a contact request; a name mentioned in passing without leaving contact details may remain in the text. Any contact details the visitor left for the dealer are held as a customer record (row above), which the dealer controls - so for as long as the dealer keeps that record, the dealer can still tell which customer a chat was with.
Sales records	6 years (HMRC requirement under the Companies Act 2006)
Server logs & security events	90 days
Backups	Daily database backups kept for 7 days, switched on before any dealer's live data is stored

8. Your rights under UK GDPR

You have the following rights over personal data we hold about you. You can exercise them by emailing privacy@tradescaleplus.com. We respond within 30 days.

• Right to be informed — this policy is part of fulfilling that.
• Right of access — you can request a copy of the personal data we hold about you (a "subject access request" or SAR).
• Right to rectification — if any data we hold is inaccurate, you can ask us to correct it.
• Right to erasure ("right to be forgotten") — you can ask us to delete personal data, subject to lawful retention requirements (e.g. HMRC).
• Right to restrict processing — you can ask us to limit how we use your data in certain circumstances.
• Right to data portability — you can ask for your data in a machine-readable format (we provide JSON or CSV).
• Right to object — you can object to processing based on legitimate interest.
• Rights relating to automated decision-making — we don't use solely automated decision-making that produces legal or significant effects. AI features generate drafts that you review before sending.

9. Cookies and tracking

We do not set cookies. The dealer dashboard keeps your login in your browser's local storage so you stay signed in. The chat assistant on dealers' websites keeps the conversation, and the car pages opened since the visitor started it, in that browser tab's session storage, so it follows the visitor from page to page, and clears it after two hours. Nothing is kept before the visitor starts the chat. We do not use advertising, tracking or analytics cookies. If we add analytics in future, we will ask for your consent first.

10. Where the dealer is the controller (customer data)

When you use TradeScale Plus to manage your own customers, you are the data controller of those customers' personal data. You decide what to collect, how to use it, and how long to keep it. Trade Scale Plus Ltd acts as the data processor on your behalf.

Our processor obligations are set out in our Data Processing Agreement (DPA), which forms part of your subscription terms. Key points:

• We only process customer data on your documented instructions.
• We don't use your customers' data for our own purposes.
• We notify you of any personal data breach without undue delay, and within 48 hours of becoming aware of it.
• We will return or delete your customers' data on termination of your subscription, per your instructions.
• We require all sub-processors to provide equivalent protections.

11. Google user data (connecting your Google Tag Manager)

If you choose to switch on the website sales admin by connecting your Google Tag Manager, Google asks you to allow TradeScale Plus to see your email address and to manage, version and publish your Google Tag Manager containers. You decide whether to allow it, on Google’s own screen.

What we do with it. We use this access once, for one purpose: to find the Tag Manager container that runs on your website, add one tag named “TradeScale Plus website sales admin” (the two lines that load the assistant) in a new workspace of its own, create a version and publish it. We do not read, change or publish anything else in your account, and we never publish in a container that your website platform shares with other businesses.

What we keep. A record of what we published: the container ID, the tag and version, the date, and the email address of the Google account that allowed it. We do not keep your Google password or any Google access token; the access ends when the install is done.

What we never do. We do not sell Google user data, transfer it to anyone, use it for advertising, let anyone read it except to keep the service secure or to help you when you ask, or use it to develop, improve or train AI models.

Taking it off. Pause or delete the tag in Google Tag Manager and publish, and you can remove TradeScale Plus from your Google account at myaccount.google.com/permissions.

TradeScale Plus’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

12. Children

The TradeScale Plus platform is a B2B service intended for businesses and is not directed at children under 16. We do not knowingly collect personal data from anyone under 16.

13. Changes to this policy

We will update this policy from time to time. For material changes — for example, a new sub-processor or a change in retention periods — we will notify dealers by email at least 14 days before the change takes effect. The "Last updated" date at the top of this page indicates the most recent revision.

14. Contact us & complaints

Data protection contact: privacy@tradescaleplus.com
Postal address: Trade Scale Plus Ltd, 12 Randell Square, Porth Tywyn, SA16 0TY, United Kingdom

If you are not satisfied with how we handle your data or your concerns, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Postal: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We'd appreciate the chance to address your concerns first, so please consider contacting us before contacting the ICO.