Privacy notice
Last updated 24 September 2026
In short: we collect what we need to run MotorPortal HQ for car dealerships, we don’t sell personal data, we don’t use advertising or analytics trackers, and you can ask us for a copy of your data or ask us to delete it at any time.
If you’re a customer of a dealership that uses MotorPortal HQ, the dealership is responsible for your data — see their privacy notice, and read section 2 below.
1. Who we are
MotorPortal HQ is operated by Anay Makwana, trading as MotorPortal HQ, of Glisson Road, Cambridge, CB1 2HA, United Kingdom, as a sole trader (“we”, “us”, “our”). MotorPortal HQ is software that independent used-car dealerships use to run their stock, sales, customers, finances and websites.
For any privacy question or request, email anaymakwana@icloud.com.
2. Our role: controller or processor
Data protection law treats us differently depending on whose data it is.
Where we are the controller
We decide how and why this data is used, and this notice covers it in full:
- dealership accounts and the staff logins that dealerships create
- subscriptions and billing
- keeping the platform secure and preventing fraud and abuse
- our waitlist, private invite page and tester feedback
- our own emails to dealers about MotorPortal HQ
Where we are a processor for a dealership
Dealerships use MotorPortal HQ to keep records about their own customers — customer details, website enquiries, sales, part exchanges, reservation deposits, suppliers and vehicle documents such as V5C logbooks. For this data the dealership is the controller and we only process it on their instructions, under our Data Processing Agreement.
If you’re a customer of a dealership that uses MotorPortal HQ, the dealership is responsible for your data — see their privacy notice (usually linked from their website), and send requests about your data to them. If you contact us instead, we’ll pass your request to the dealership and help them respond.
3. What we collect and why
This section covers data we control. For each type we say why we use it and the lawful basis we rely on under UK data protection law.
- What
- Name, email address, password (stored only as a one-way hash, never in readable form), role and permissions, last sign-in time. Dealership details such as trading name, address, phone number and VAT number — for sole traders and partnerships these can be personal data.
- Why
- To create and run your account, let you add staff, and provide the service you signed up for.
- Lawful basis
- Contract with the dealership. For staff members, our legitimate interest in letting the dealership give its team access.
- What
- Plan, subscription status, billing contact, invoices and payment records. Card details are entered on Stripe’s own pages — we never see or store full card numbers.
- Why
- To charge for the service and keep proper accounts.
- Lawful basis
- Contract, and legal obligation for the accounting records we must keep.
- What
- IP address (used to limit repeated attempts on sign-in and public forms), an activity log of important actions in each dealership account, and standard hosting logs (such as the pages requested, time and browser type).
- Why
- To keep the platform and your data secure, investigate problems and prevent fraud and abuse.
- Lawful basis
- Legitimate interests (security and fraud prevention).
- What
- Your email address and the details needed for the message — for example sign-in and password emails, billing notices, security alerts and new-enquiry notifications.
- Why
- To tell you things you need to know to use the service. These are always sent while you have an account.
- Lawful basis
- Contract and legitimate interests.
- What
- Your email address and a record of when and how you agreed (and if you later withdraw).
- Why
- To send occasional news about MotorPortal HQ. This is off unless you switch it on, and you can switch it off at any time.
- Lawful basis
- Consent.
- What
- Your VAT figures and, because HMRC requires it from software that connects to its systems, fraud-prevention information: your public IP address, a device identifier stored in your browser, browser and operating system details, screen and window size, and time zone.
- Why
- To prepare and send VAT information to HMRC when you ask us to, in the way HMRC requires.
- Lawful basis
- Contract, plus legitimate interests in meeting HMRC’s requirements for connected software.
- What
- Your email address, and your name and dealership name if you give them. Whether you asked for product updates.
- Why
- To email you once when MotorPortal HQ opens. If you ticked the box, to send occasional product updates as well.
- Lawful basis
- Legitimate interests for the opening email; consent for product updates.
- What
- On the invite page: your name, email address and browser details. For feedback sent from inside the app: your message, the page you were on, browser and screen size, and a screenshot if you choose to attach one.
- Why
- To set up test accounts, follow up with you, fix problems and improve the product.
- Lawful basis
- Legitimate interests (running the beta and improving the product).
Public vehicle pages. When someone views a dealership’s vehicle page, we count the view without cookies and without storing the visitor’s IP address — we only keep a count per vehicle per day.
AI descriptions. If a dealership asks MotorPortal HQ to draft a vehicle description, we send the vehicle’s details (such as make, model, mileage and features) to our AI provider. These drafts are about vehicles, not people, and the dealership checks and edits every draft before it is published. We don’t make decisions about anyone using automated means that have legal or similarly significant effects.
We don’t sell personal data and we don’t use it for advertising.
5. International transfers
Our main database and file storage are in London. Some of our providers — including Vercel (hosting), Stripe (payments), Resend (email) and Anthropic (AI descriptions) — are based in, or may process data in, the United States.
When personal data is transferred outside the UK, we rely on the UK’s approved transfer mechanisms, such as the UK International Data Transfer Addendum or the UK–US data bridge where the provider is certified. You can ask us for more information about the safeguards for a particular provider.
6. How long we keep data
We keep personal data only for as long as we need it. In summary:
- Kept
- While the account is open. When a dealership removes a staff member, their access ends straight away.
- Then
- Deleted or anonymised after the account is closed, following the closure process below.
- Kept
- For as long as the law requires us to keep accounting and VAT records (we’ll confirm the exact period).
- Then
- Deleted.
- Kept
- As the dealership decides while its account is open. Dealerships can export, anonymise or delete customer records and enquiries themselves.
- Then
- After an account closes, customer and enquiry data is deleted or anonymised. Sales and other financial records are kept only for as long as the law requires, then deleted.
- Kept
- Only as long as needed to keep the service secure and investigate problems (we’re confirming the exact periods with our providers).
- Then
- Deleted.
- Kept
- Waitlist details until we’ve sent the opening email, or longer if you asked for product updates. Invite and feedback details while the private beta runs.
- Then
- Deleted — or earlier if you ask us to remove you.
- Kept
- While we send you product news, and for a period afterwards so we can show you agreed (we’ll confirm the exact period).
- Then
- Deleted.
Closing an account. A dealership can ask to close its account from its settings. Nothing is deleted straight away: we offer a full export of the dealership’s data, the subscription ends at the end of the billing period, and we then delete or anonymise the data as described above, keeping only what the law requires.
7. How we protect data
- All connections use HTTPS, and browsers are told to always use a secure connection.
- Passwords are stored only as secure one-way hashes.
- Connections to HMRC, Xero and QuickBooks use access tokens that we encrypt before storing them.
- Each dealership’s data is kept separate from every other dealership’s, and staff permissions are checked on our servers, not just in the browser.
- Private documents (such as logbooks and invoices) are only available through short-lived, signed links.
- We limit repeated attempts on sign-in and public forms, keep an activity log, and use standard web security protections.
No system is completely secure. If a personal data breach happens that is likely to affect you, we’ll deal with it quickly and tell you and the regulator where the law requires.
8. Your rights
Under UK data protection law you have the right to:
- access — get a copy of the personal data we hold about you
- rectification — have inaccurate data corrected
- erasure — ask us to delete your data
- restriction — ask us to limit how we use your data
- objection — object to us using your data on the basis of legitimate interests
- portability — receive your data in a machine-readable format, or have it sent to another provider
- withdraw consent — at any time, where we rely on consent (for example, product news emails)
Some rights have limits — for example, we may need to keep financial records even if you ask us to delete them. If so, we’ll explain why.
To use any of these rights, email anaymakwana@icloud.com. We’ll respond within one month. If a request is complex we may need up to two further months, and we’ll tell you if so. We may ask you to confirm your identity first.
Dealerships can also export all of their data, or a single customer’s data, from inside MotorPortal HQ at any time.
10. Complaints
If you’re unhappy with how we’ve handled your data, please contact us first at anaymakwana@icloud.com and we’ll try to put it right.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator: ico.org.uk or 0303 123 1113.
11. Changes to this notice
We’ll update this notice when the way we handle data changes. The date at the top shows when it last changed. If we make an important change, we’ll tell dealerships by email or in the app before it takes effect.
12. Contact
Anay Makwana, trading as MotorPortal HQ, Glisson Road, Cambridge, CB1 2HA, United Kingdom. Email: anaymakwana@icloud.com.