Privacy Policy

Last updated: 23 October 2026

This policy explains what personal data Going Once Cars collects, why we collect it and what your rights are. We collect only what we need to run safe car auctions.

1. Who is responsible

The controller of your personal data is Going Once Cars, 66 Paul Street, London EC2A 4NA, United Kingdom (company number to be added). For anything about your personal data, write to legal@goingoncecars.com. We follow the UK GDPR and, for users in Albania and Kosovo, their data protection laws.

2. What we collect

• Account: your name (as on your ID), email address, mobile number, date of birth, country, city and language and, for dealers, the business details.
• Apple or Google sign-in (if you choose it): the name and email address they share with us and an account identifier. We never see your Apple or Google password.
• Waitlist (if you joined it before sign-ups opened): your email address, whether you want to buy or sell, your country and your language.
• Facebook and Instagram lead forms, and the “I want to sell my car” form on our website: Going Once Cars may receive the name, phone, email, city and car details that people submit through our Facebook/Instagram lead forms or our website’s form (with the page and the ad link that brought them there), uses them only to contact them about listing a car, and deletes or anonymises unconverted leads after 12 months.
• Ad measurement (only if you accept it): the Meta Pixel on our website and web marketplace, described under “Cookies and storage” below.
• ID checks with Didit: photos of your ID document and a short live selfie, which Didit takes and holds; the result, including the liveness check and the comparison of your face with the document photo (biometric data, used only with your explicit consent), and the name and date of birth on the document. If you choose a manual check: the photos you upload and our reviewer’s notes.
• Registration document (sellers who scan it): photos of the vehicle registration certificate and what is read from them, including the owner’s name, so we can fill in the listing and check that the car is yours.
• Plans and payments: processed by Stripe. We never see or store your full card number; we keep your plan, its status and renewal date, your card’s brand and last four digits and, for bank transfers, the payer’s name and IBAN. For payouts we keep the seller’s bank account details.
• Activity: your bids, maximum bids, watchlist, purchases, sales, listings, pickups, handover times and messages with GOC Support, including GOC Assistant’s replies.
• Price guide: the vehicle details you enter to get an estimate.
• Technical data: device, browser, app version, push notification token and log data that we need to keep the service secure.

3. Why we use it

To create your account and run plans, auctions, Buy Now, payments, pickups, payouts and GOC Support (to perform our contract with you). To verify your identity: the biometric comparison only with your explicit consent, otherwise a manual check. To prevent fraud, check registration documents and keep Going Once Cars safe (our legitimate interest). To send you service emails and notifications (our contract with you) and, only if you agree, news and offers (your consent). To measure our Facebook and Instagram ads with the Meta Pixel, only if you accept it (your consent). To meet legal duties such as tax, accounting, sanctions and anti-money-laundering rules (legal obligation).

4. Who we share it with

Only with providers who help us run Going Once Cars: Supabase (database, sign-in and file storage, on servers in the EU), Stripe (payments and plans), Didit (ID checks), Anthropic (the AI model behind GOC Assistant, the price guide and the registration document check), Resend (emails), Netlify (website hosting), Meta Platforms Ireland (the Meta Pixel, only if you accept it, and our Facebook and Instagram lead forms), Expo, Apple and Google (app updates and push notifications), Apple and Google if you sign in with them, and our banks; and with authorities when the law requires it. On the day of a pickup, we send the seller the name on the buyer's ID so they can check it. Buyers and sellers never see each other's contact details. We never sell your data.

5. Emails and notifications

We send emails through Resend and push notifications through Expo, Apple and Google. Emails about payments, sales, pickups, payouts, your ID check and your plan are part of the service and are always sent. Optional emails, such as outbid alerts, price drops and listing reviews, can be turned off in the app under Profile → Notifications → Email notifications. We send news and offers only if you agreed, and every such email has an unsubscribe link.

6. AI: GOC Assistant, price guide and document check

GOC Assistant, our price guide and the registration document check use Claude, an AI model made by Anthropic, which acts as our processor and does not use this data to train its models. GOC Assistant sees your messages and, when it needs to, the account information you can see yourself (such as your bids, purchases or listings); it never receives your handover code, card details, IBAN or other users' details, and it can't make decisions about you. On our website, questions from visitors who aren't signed in are sent to Anthropic but not stored by us. The price guide sends only the vehicle details you enter.

If you scan your registration certificate when you list a car, the photos are stored privately and read by the same AI service. We compare the owner’s name with the name on your verified ID. Only you and authorised GOC staff can see the document and the owner’s name; buyers only see the “Registration document checked” badge, and only a person can reject a document. The scan is optional.

7. Transfers abroad

Our database is hosted in the EU. Several providers, including Stripe, Anthropic, Resend, Netlify, Meta, Expo, Apple and Google, process data in the United States, and Didit may process ID-check data outside your country. When data moves between countries, we use the safeguards the law requires, such as adequacy decisions, the EU-US Data Privacy Framework or standard contractual clauses. Write to legal@goingoncecars.com for a copy.

8. How long we keep it

Account details while your account is open, then 6 years. Transaction records (plans, bids, purchases, sales, payments, payouts) for 6 years from the end of the financial year. ID images and selfies are deleted by Didit after the check; we keep the result and the verified details with your account. Registration document photos and the owner's name: 90 days after the listing ends. Messages with GOC Support: 3 years, or 6 years if they relate to a transaction or dispute. Price-guide results: 7 days. Waitlist data until 6 months after launch, or until you ask us to remove you. When you delete your account in the app, we delete your personal data except what the law requires us to keep, which we keep without your contact details.

9. Your rights

You can ask us to access, correct or delete your data, to restrict or object to its use, and to send you a copy of it. You can withdraw your consent at any time, for example by leaving the waitlist or, for the Meta Pixel, under “Cookie settings” at the bottom of every page. Write to legal@goingoncecars.com. You can also complain to the data protection authority in your country, such as the Information and Data Protection Commissioner in Albania or the Commissioner for Information of Public Importance and Personal Data Protection in Serbia.

10. Cookies and storage

Our website and web marketplace remember your language and your cookie choice in your browser and, when you sign in, keep a login token there so you stay signed in. Only with your consent, they also use the Meta Pixel of Meta Platforms Ireland Limited to measure our ads: it sets the _fbp and _fbc cookies and tells Meta which of our pages you visit and when you view a car, create an account, start a free trial or a plan, submit a listing or open the chat, together with your IP address and browser details, but never your name, email address or phone number. Meta uses this data under its own privacy policy. It is optional: if you decline, it doesn't load. You can withdraw your consent at any time under “Cookie settings” at the bottom of every page (in the web marketplace: Profile → Cookie settings). Our iPhone and Android apps don't use the Meta Pixel.

The website loads fonts from Google Fonts and our sign-in library from the jsDelivr network, which receive your IP address to deliver them. Stripe's checkout and billing pages and Google's sign-in page use their own cookies, covered by their own privacy policies.

11. Visitor statistics

To see how many people use our website, web marketplace and apps, and which pages and screens they open, we count visits ourselves, without cookies and without storing anything on your device. We record the page or screen (without anything that identifies you: car and account numbers are removed from addresses), the site that sent you there (its name only) and the ad campaign in the link, your type of device (phone, tablet or computer), your language, your country and, in the apps, the app version. We never store your IP address: our server combines it with your browser or app details and a random value that changes every day, and keeps only the resulting code, so we can't recognise you on another day or link these statistics to you or your account. Visits by our staff aren't counted. Our legal basis is our legitimate interest in understanding and improving our service. We keep the single records for 90 days, then only daily totals.

12. Security

We protect your data with encrypted connections, access controls and carefully chosen providers.

13. Children

Going Once Cars is for people aged 18 and over.

14. Changes

We will publish any changes on this page and, if they are important, tell you by email or in the app.

Questions about this document? Write to us at legal@goingoncecars.com.