Privacy Policy
Last updated: 8 June 2026
1. Who we are
AutoGenie.ie (“AutoGenie”, “we”, “our”, “us”) is a trading name of OhTooWon Limited, a company registered in Ireland (No. 817254) with its registered office at The Oaks, Maryborough Ridge, Douglas, Cork.
We are the data controller for the personal information described in this policy. If you have any questions, contact us at info@otwoone.ie.
2. What this policy covers
This policy explains how we collect, use, share, and protect personal information when you use autogenie.ie (the “Service”), whether you're a buyer browsing listings, a dealer managing your account, or a visitor.
3. Information we collect
Information you give us:
- Buyer enquiries: name, email address, phone number (optional), and the message you send to a dealer about a specific listing.
- Dealer accounts: business name, business address, Eircode, contact phone, contact email, dealership description, SIMI membership status, the identity of the staff member creating the account.
- Account credentials: if you sign in with Microsoft or Google, we receive your name and email address from that provider. We never receive or store your password for the identity provider.
- Payment details: if you subscribe to a paid dealer tier, your card details are collected directly by Stripe and never touch our servers. We store Stripe's customer and subscription identifiers, plus billing status.
- Listings content: vehicle details, photos, descriptions, and pricing you upload as a dealer.
Information we collect automatically:
- Technical data: IP address, browser type and version, device type, operating system, referring page, and timestamps.
- Usage data: which listings you view, search filters you apply, and links you click.
- Cookies and similar technologies: see our Cookie Policy for details.
Information from third parties:
- Identity providers: Microsoft Entra and Google share your verified email address and name when you sign in via OAuth.
- Vehicle data providers: in the future we may integrate Cartell.ie to retrieve NCT and vehicle history records using a vehicle registration plate. This will be disclosed at the point of lookup.
4. Why we use your information (legal basis)
| What we do | Why | Legal basis under GDPR |
|---|---|---|
| Create and manage dealer accounts | To provide the Service you've signed up for | Performance of a contract (Art. 6(1)(b)) |
| Process buyer enquiries and forward them to dealers | To deliver the marketplace function | Legitimate interest (Art. 6(1)(f)) |
| Take payments and manage subscriptions | To bill you for paid services | Performance of a contract (Art. 6(1)(b)) |
| Send service emails (billing receipts, lead notifications, dealer account updates) | To operate the Service | Performance of a contract (Art. 6(1)(b)) |
| Monitor for errors and security incidents | To keep the Service safe and working | Legitimate interest (Art. 6(1)(f)) |
| Comply with tax, accounting, and other legal duties | Because we have to | Legal obligation (Art. 6(1)(c)) |
| Respond to your queries | To help you | Legitimate interest (Art. 6(1)(f)) |
We do not currently process any special categories of personal data (Art. 9 GDPR) and we do not engage in automated decision-making with legal effects (Art. 22 GDPR).
5. Who we share your information with
We share personal information only with the following categories of recipient, and only as needed to operate the Service:
| Recipient | Purpose | Location |
|---|---|---|
| Stripe, Inc. | Payment processing for dealer subscriptions | USA (EU-US Data Privacy Framework certified) |
| Resend, Inc. | Sending transactional emails (lead notifications, dealer account & billing emails) | USA (SCCs in place) |
| Microsoft Ireland Operations Ltd | OAuth sign-in (Microsoft Entra) | Ireland / EU |
| Google Ireland Limited | OAuth sign-in (Google) | Ireland / EU |
| Vercel Inc. | Application hosting and content delivery | USA / EU edge network (SCCs in place) |
| Neon Inc. | Database hosting | UK region (London) |
| Functional Software, Inc. (Sentry) | Application error monitoring (technical telemetry only — no buyer enquiries or dealer content) | USA (EU-US Data Privacy Framework certified) |
| Cartell.ie (Cartell Business Services Ltd) | Planned: vehicle history lookups | Ireland |
| Dealers listed on the marketplace | We forward buyer enquiry messages, including the buyer's name, email, and phone, to the dealer whose listing the buyer contacted | Ireland (primarily) |
| Tax, legal, or regulatory authorities | Where required by law | Ireland and EU |
We do not sell your personal information to anyone, and we do not share it for any third party's direct-marketing purposes.
6. International transfers
Some of our sub-processors (Stripe, Resend, Vercel, Sentry) are based in the United States. Transfers outside the European Economic Area are protected by either the EU-US Data Privacy Framework, by Standard Contractual Clauses approved by the European Commission, or both.
Our database is hosted in the United Kingdom; transfers to the UK are covered by the European Commission's UK adequacy decision.
7. How long we keep your information
| Category | Retention period |
|---|---|
| Dealer account data | For as long as the account is active; deleted within 90 days of account closure unless we must retain it for legal reasons |
| Buyer enquiries | 24 months from the date of the enquiry, then deleted |
| Listings | While published; archived for 12 months after withdrawal then deleted |
| Payment records | 7 years (Irish Revenue requirement) |
| Server logs and security telemetry | 30 days |
| Sentry error events | 90 days (Sentry's default retention) |
| Cookies | See Cookie Policy for per-cookie lifespans |
8. Your rights
Under the GDPR you have the right to:
- Access the personal information we hold about you (Art. 15).
- Correct inaccurate or incomplete information (Art. 16).
- Erase your information in certain circumstances (“right to be forgotten”) (Art. 17).
- Restrict processing of your information (Art. 18).
- Receive a copy of your information in a portable format (Art. 20).
- Object to processing based on legitimate interest (Art. 21).
- Withdraw consent at any time where we rely on consent (this does not affect prior processing).
To exercise any of these rights, email info@otwoone.ie. We will respond within 30 days. There is no charge for a reasonable request.
You also have the right to lodge a complaint with the Data Protection Commission (the Irish supervisory authority): https://www.dataprotection.ie/ — though we'd appreciate the chance to address your concern first.
9. Security
We use industry-standard measures to protect your information, including TLS encryption for all data in transit, encrypted database storage, OAuth and multi-factor sign-in via Microsoft and Google, hashed session tokens, and access controls limiting who on our team can see what.
No system is perfectly secure. If we ever discover a breach affecting your personal data we will notify you and the Data Protection Commission within the timescales required by GDPR (Articles 33 and 34).
10. Children
AutoGenie is not intended for users under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with information, contact info@otwoone.ie and we will delete it.
11. Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top will always reflect the latest version. For material changes affecting how we use your data, we will notify dealers by email and post a notice on the Service.
12. Contact
OhTooWon Limited
The Oaks, Maryborough Ridge, Douglas, Cork
Email: info@otwoone.ie
Company Registration Number: 817254