Privacy policy

• Account data — name, business email, dealership or company, role, and the teammates you invite.
• Billing data — billing name and address, tax details, plan and payment history. Card details are collected and held by Stripe; we never see full card numbers.
• Vehicle Content — photos you capture, upload or import, listing URLs, VINs, vehicle labels and stock numbers, logos and photos of your premises. Photos can incidentally include people, number plates and embedded metadata such as the time or location they were taken.
• Outputs — the images, films, voiceovers and scripts we generate for you.
• Usage data — which features you use, generation jobs, usage by vehicle and user, and errors.
• Technical data — IP address, browser and device type, and server logs created when you use the website or API.
• API data — for API customers, hashed API keys, webhook endpoints and delivery logs.
• Communications — emails, support requests, demo bookings and messages sent through our contact forms (name, email, company, topic and message).

Under UK and EU data protection law we must have a legal basis for each use of personal data:

We never sell personal data, and we don't use it for third-party advertising.

To generate Outputs, we send the relevant photos, instructions and — if you add one — the VIN to the AI providers listed below. Each provider receives only what that job needs. Photos are also analysed automatically to sort them by angle and to skip window stickers and spec cards.

• No training on your content. We do not use your Content or Outputs to train AI models, and we choose provider settings that exclude your data from model training wherever that option is offered.
• No automated decisions about people. Our AI makes decisions about photos, not about individuals, and nothing we do has legal or similarly significant effects on anyone.
• VIN decoding uses the US National Highway Traffic Safety Administration's public vPIC service, which receives only the VIN.

More on how we use AI is on our AI Act & transparency page.

We use the following service providers (sub-processors) to run Listwyse. Each is bound by a contract that limits how they use the data.

AI infrastructure providers are listed by category because the specific vendors behind our generation pipeline change as we improve it. Customers can request the current named list, with locations and safeguards, from support@getlistwyse.com and will be notified before a new sub-processor starts handling their Content.

We may also share data with professional advisers, with authorities where the law requires it, and with a buyer or successor if our business is sold or restructured.

Some of our providers process data outside the UK and EEA, including in the United States. Where data leaves the UK or EEA, we rely on adequacy decisions (including the EU–US Data Privacy Framework and UK Extension for certified providers) or on the European Commission's Standard Contractual Clauses with the UK Addendum. You can ask us for a copy of the relevant safeguards.

• Vehicle Content and Outputs — for as long as your account is open, so you can download them again. Ask us to delete a vehicle or all of your Content at any time.
• Account data — while your account is open, then deleted or anonymised once we no longer need it, unless we must keep it for legal, tax or dispute-resolution reasons.
• Billing and tax records — six years after the relevant financial year, as UK law requires.
• Logs and security data — for short periods, normally no longer than 12 months.
• Enquiries — messages sent through our contact forms, for as long as we need them to deal with your enquiry and any business relationship that follows.
• Marketing contacts — until you unsubscribe or ask us to stop.

We use encryption in transit (TLS), role-based access to accounts, hashed API keys, signed webhooks and restricted access to production systems for staff.

Links to your files. Outputs are stored at long, unguessable web addresses so they can be published on websites and marketplaces. Anyone who has a file's link can view that file, so treat links like the published images they are and don't share links to images you want kept private.

You can ask us to:

• give you a copy of your personal data;
• correct inaccurate data;
• delete your data;
• restrict or object to how we use it, including for direct marketing;
• send your data to you or another provider in a portable format; and
• withdraw consent where we rely on it.

Email support@getlistwyse.com. We reply within one month. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or the data protection authority where you live or work in the EU — though we'd appreciate the chance to fix things first.

Residents of California and other US states with privacy laws may have the right to know what personal information we collect, to access, correct or delete it, and to opt out of its sale or sharing for targeted advertising.

We collect the categories described in section 2 for the business purposes in section 3. We do not sell personal information or share it for cross-context behavioural advertising, and we don't knowingly collect data from anyone under 16. To make a request, email support@getlistwyse.com; we will verify your request and won't treat you differently for making it.

Listwyse is a business service and is not intended for anyone under 18. If you think a child has given us personal data, contact us and we will delete it.

We set cookies needed to sign you in, take payments and run the site, plus one PostHog analytics cookie that shows us how Listwyse is used. See our Cookie policy for the list.

We will update this page when our practices change and change the date at the top. For material changes we will also tell account owners by email or in the app.

Privacy questions and requests: support@getlistwyse.com, or write to Listwyse Ltd, [Registered office address].