Privacy Policy

CarMazium Ltd is the controller of personal data processed through CarMazium unless another party is clearly identified as the controller for a particular service.

Company number: 17053307. Registered in England and Wales. Contact: info@carmazium.com.

CarMazium accounts are for people aged 18 or over who are legally capable of entering into contracts. Business users must be authorised to act for the relevant business.

Depending on how you use CarMazium, we may process:

• account and contact information such as name, email address, telephone number, profile image and authentication identifiers;
• location information such as town, postcode and, only when you choose the “Locate Me” feature, device location used to determine a nearby postcode;
• vehicle and listing information including registration, mileage, specification, condition, photographs, videos, pricing, bids, offers, handover evidence and transaction history;
• business and verification information for Partner Accounts, including company or sole-trader details, address, identity evidence and documents submitted for KYC or service-provider verification;
• service, finance, warranty and insurance enquiry information that you choose to submit;
• payment and payout information. Card payments are processed by Stripe. CarMazium does not receive or store full card numbers. Bank or payout details may be stored where needed to make or administer a payout;
• messages, chat attachments, reports, disputes and customer-support communications;
• push-notification tokens and notification preferences;
• technical and usage information such as session identifiers, device/browser information, page or screen activity, referral information and analytics events; and
• MaziuM AI prompts and recent conversation context when you use the AI assistant.

On iPhone and Android, CarMazium uses the system picker when you choose a photo or document, requests foreground location only when you tap “Locate Me”, and requests notification permission for push alerts. The production app does not require camera, microphone, contacts, call-log, SMS, broad photo/video-library access or background-location permission for its current functionality.

We use personal data to operate the marketplace, create and secure accounts, publish listings, run auctions, connect buyers and sellers, administer Partner services, process CarMazium fees and incentives, provide customer support, detect fraud and misuse, verify users and businesses, send service notifications, improve the platform and comply with legal obligations.

Our legal bases may include performance of a contract, steps taken at your request before entering a contract, compliance with legal obligations, our legitimate interests in operating and protecting the marketplace, and consent where consent is required.

CarMazium uses service providers to operate the platform. These may include Supabase for authentication and data services, Stripe for payments and payouts, Vercel and Fly.io for hosting/infrastructure, Expo for mobile push-notification infrastructure, Apple and Google for sign-in where you choose those options, and OpenAI for MaziuM AI functionality.

CarMazium uses OpenAI for optional AI features including MaziuM chat, native AI Search, AI-assisted listing descriptions and, where you have consented, live vehicle-specification enrichment. Before an interactive AI prompt or seller vehicle data is sent to OpenAI, the website or native app requires an explicit acknowledgement. Core DVLA/MOT vehicle lookup remains available without AI enrichment. Do not include unnecessary sensitive personal information, passwords, payment credentials or authentication codes in AI prompts.

If you use the in-app “Report AI response” feature, CarMazium stores the reported AI response, the associated prompt where available, your selected reason and any optional details so an administrator can review the report and improve safety controls. You can stop sending new prompts to OpenAI at any time through the MaziuM AI privacy controls; the assistant will ask for acknowledgement again before another prompt is sent.

We may also use vehicle-data, verification, email, analytics and communications providers where needed to deliver a feature. Providers receive only the information reasonably necessary for their role and are subject to contractual or platform safeguards as applicable.

The website uses necessary cookies for functions such as keeping you signed in. Analytics and marketing technologies, including Google, Meta and TikTok tools where configured, are loaded only in accordance with the website consent controls.

You can review or change website cookie choices through Cookie Preferences. See our Cookie Policy for more detail.

Information you intentionally publish in a vehicle listing or public profile may be visible to other users or visitors. Contact details and documents are disclosed only where the relevant product flow permits it.

Private member-to-member chats are intended for the participants. A specific message and attachment may be shared with CarMazium moderators when a participant reports it, and relevant records may be reviewed when needed for a dispute, safety, fraud or legal issue.

Some service providers may process data outside the United Kingdom. Where UK data-protection law requires safeguards for an international transfer, we use an appropriate transfer mechanism or rely on another lawful transfer basis.

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected and for legal, tax, accounting, fraud-prevention, security, dispute or regulatory requirements.

Successful account deletion removes the sign-in identity, sensitive KYC documents, account-owned files and transient personal records, withdraws unfinished listings and irreversibly anonymises the application account used as a reference by shared marketplace records.

Completed transaction, payment, bid, offer, sale, dispute, moderation, service and transactional-chat records may be retained in pseudonymous form where they remain necessary to protect other users, administer refunds or payouts, establish or defend legal claims, prevent fraud, meet financial-record obligations or comply with law. Private chat attachments are removed. When a retention purpose expires, the remaining record should be deleted or further anonymised.

You can start account deletion in the CarMazium app or website settings. You can also use the public Delete Account page without relying on the mobile app.

If an account has a live auction or active bid, deletion may be delayed until that live commitment ends so deletion cannot be used to evade an active transaction. Once deletion completes, CarMazium removes the Supabase sign-in identity and the backend also blocks stale sessions or access tokens from restoring the deleted account. If you cannot sign in, contact info@carmazium.com from the email address connected to the account.

Subject to applicable law and exemptions, you may have rights to access personal data, correct inaccurate data, request deletion, restrict or object to certain processing, receive portable data and withdraw consent where processing relies on consent.

To exercise a privacy right, email info@carmazium.com. We may need to verify your identity before acting on a request.

You may also raise a concern with the UK Information Commissioner’s Office if you believe your data-protection rights have been infringed.

We use technical and organisational safeguards intended to protect personal data, including access controls, authenticated application routes, private storage for sensitive verification evidence where implemented, and encrypted network transport. No internet service can guarantee absolute security.

We may update this Privacy Policy when the platform, our providers or legal requirements change. Material changes will be communicated where appropriate. The current version will always be published on this page.