Last updated: August 2026
This Privacy Policy explains how FlipTrack UK, operated as a sole trader trading as FlipTrack UK based in Leeds, United Kingdom, collects, uses and protects your personal data. We handle data in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018.
1. Data We Collect
Account data: When you register, we collect your email address and create a unique account identifier.
Activation and reminders: We record essential in-product milestones, such as completing onboarding or adding a first vehicle, to operate and improve the service. If you enable browser notifications, we store the device subscription needed to deliver reminders. You can disable notifications in Settings or through your browser.
Vehicle and financial data: We store the vehicle details, transaction records, profit data, cash-flow assumptions and VAT Margin Scheme records you enter so the service can operate.
After-sales data: If you use the Pro after-sales workspace, we store the customer contact details, case notes, deadlines, communications, supplier updates and resolution costs you record against a sold vehicle.
Payment data: Payments are processed by Stripe. We do not store card details. We receive the payment status and identifiers needed to manage your subscription.
Usage data: If you consent to optional analytics, we collect basic page and feature usage information to improve the service. Analytics remain disabled unless you accept them.
Technical diagnostics: When FlipTrack fails to load or complete a request, we record a redacted error category, affected route and technical fingerprint. We do not intentionally include passwords, payment details, uploaded files or full browser stack traces.
DVLA and DVSA data: Registration and MOT lookups retrieve vehicle data from DVLA and DVSA. We cache available vehicle data to reduce provider usage. We do not request or store keeper names or addresses.
2. How We Use Your Data
We use your data to provide and improve FlipTrack UK, calculate the operational views you request, maintain your after-sales and compliance records, process subscription payments, send essential service communications and respond to support requests. We do not sell personal or operating data to third parties.
3. Legal Basis for Processing
We process data on the following bases under UK GDPR: performance of a contract, legitimate interests in improving and securing the service, consent for optional analytics and legal obligation where required by law.
4. Data Storage and Security
Your account and operating data uses Supabase-managed infrastructure. We use technical and organisational controls designed to protect it against unauthorised access, loss or disclosure. Database row-level security restricts account-owned records to the relevant signed-in user.
Uploaded vehicle photos, receipts and documents are processed for security. Raw files enter private quarantine, their format is checked, images are decoded and re-encoded, and PDFs containing active scripts, launches or embedded files are rejected. Quarantined copies are deleted after processing.
5. Service Providers
Supabase: managed database, private file storage and authentication infrastructure.
Stripe: secure payment and subscription processing.
Vercel: application hosting and consent-based analytics.
DVLA and DVSA: vehicle and MOT information.
MarketCheck: comparable advertised vehicle data used for asking-price estimates.
Each provider operates under its own privacy terms and our applicable data-processing arrangements.
6. Data Retention
Active accounts: We retain account, vehicle, transaction, cash-planning, after-sales, VAT, uploaded-file and service data while your account is active and for as long as it is needed to provide FlipTrack UK.
Account deletion: You can permanently delete your account from Settings. A completed deletion removes your authentication account, active profile, vehicle and transaction records, uploaded photos, receipts and documents, reminders, operational records and identifiable product-journey events. We do not keep a deleted account in an inactive state.
Deletion processing: When you request deletion, we create a private temporary deletion-progress record so interrupted steps can be retried safely. It contains your account identifier and, until the payment stage finishes, the email address and subscription reference needed to remove the Stripe customer. Those billing identifiers are cleared as soon as that stage succeeds, and the progress record is deleted when the full process completes.
Paid subscription records: Deleting your account does not require us or our payment processor to erase records that must be retained for tax, accounting or payment-compliance purposes. For paid subscriptions, this may include invoice and payment dates, amounts, refunds, payment status, transaction references and the customer information shown on the relevant financial record. As FlipTrack UK is currently operated as a sole trader, records needed for Self Assessment are normally retained for at least five years after the 31 January submission deadline for the relevant tax year. If VAT record-keeping rules apply, relevant records are normally retained for at least six years, or for the longer period required by an applicable VAT scheme. These records are not used to recreate your account or for product marketing.
Legal claims and objections: We may retain the minimum information reasonably necessary to establish, exercise or defend a legal claim for the applicable limitation period. If you object to direct marketing, we may retain a minimal suppression record solely to make sure we respect that objection.
Free accounts: If you have not made a payment, we do not retain a billing record merely because you previously held a Free account. A limited record may still be retained where another legal obligation, security investigation, marketing objection or active dispute requires it.
Backups and provider records: Deleted information may remain temporarily in encrypted recovery backups or provider-managed security and financial records. Backup copies are isolated from normal product use and retained only for recovery until the applicable backup is securely retired. Providers may retain limited records for their own legal obligations under their published retention terms.
Technical diagnostics: Runtime error events are retained for up to 90 days so recurring failures can be investigated and confirmed as resolved.
7. Your Rights
Under UK GDPR, you may request access, correction, deletion, restriction or portability of personal data, and may object to certain processing. You can delete the account directly from Settings. For another request, contact support@fliptrackuk.com.
8. Cookies
We use essential cookies for authentication and session management. Optional analytics operate only with consent. Read the Cookie Policy for details and to change your preference.
9. Changes to This Policy
We may update this policy when the service or legal requirements change. Significant changes will be communicated by email or through an in-product notice where appropriate.
10. Contact and Complaints
For privacy questions or to exercise your rights, contact support@fliptrackuk.com. If you are not satisfied with our response, you may complain to the Information Commissioner's Office at ico.org.uk.