Privacy Policy

What we collect and why

We collect only what we need to run the wholesale marketplace:

• Account details: name, email, password (held by Supabase Auth), phone, seller type (dealer or private), role, region, Motor Vehicle Trader / MVTR number, and dealership name, town, region, and optional street.
• Terms acceptance: which version you accepted, when, your IP address, and browser user-agent.
• WhatsApp alert consent: when you turned alerts on or off, and whether that was at signup, in settings, or by texting START or STOP.
• Listings: vehicle details, photos (these may show number plates or people), town and region, and your seller declaration that you have the right to sell.
• Offers, transactions, invoices, saved filters, watchlists, and notification preferences.
• Plate lookups through Carjam, so we can fill make, model, and other vehicle facts from a registration number.
• Messages you send us on WhatsApp, including photos, so we can run Quick list.
• Payment details for the platform fee, handled by Stripe — we do not store full card numbers.

Who we share it with

We use other companies to provide the service. Some of them store or process information outside New Zealand:

• Supabase — account login and the database (hosted in Australia for the current production project).
• Vercel — website hosting and logs.
• Twilio — WhatsApp and SMS delivery.
• Resend — transactional email.
• Stripe — card payment for the platform fee.
• Inngest — background jobs (offer windows, matching alerts, invoices).
• Carjam — official New Zealand plate lookup.
• Firebase Cloud Messaging — optional push notifications on your phone.

We share listing and offer details with the other party to a deal so they can complete the sale. We do not sell personal information.

How long we keep it

• Account data: kept while the account is open, and deleted 12 months after the account is closed.
• Listings and offers: kept for up to 7 years, for tax and dispute purposes.
• Invoices and transaction records: kept for 7 years, because NZ tax law requires financial records to be kept that long.
• WhatsApp message logs: kept for 12 months.
• Plate-lookup (Carjam) cache: kept for 90 days.
• Terms acceptance records (version, time, IP, user agent): kept for as long as the account exists plus 7 years, as evidence of what was agreed.
• Consent records (WhatsApp opt-in/opt-out): kept for as long as the account exists plus 7 years.

You can ask us to close your account by emailing privacy@cartrader.nz. After that we keep only what the periods above still require, then delete or de-identify the rest.

Access and correction

You can view and update your name, phone, yard, and notification settings in Settings. To see or correct other personal information we hold, email privacy@cartrader.nz.

Information about someone else

Sometimes one person gives us details about another person — for example a seller listing a vehicle, or a dealer naming a buyer on a deal. If you give us someone else's information, you must be allowed to do so. That person can ask us for access or correction in the same way you can.

Privacy Officer and complaints

Privacy Officer: Paul Kerr, privacy@cartrader.nz.

If you are not satisfied, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.