Privacy Notice

Cartref is operated by Blue Dog Digital, a sole-trader business registered in Wales. Our trading address is in South Wales. You can reach us at hello@cartref.app for any privacy question.

For the purpose of UK GDPR, Cartref is the data controller for the personal data described in this notice.

Account data: email, optional display name, marketing preferences.

Enquiry data: the property you enquired on, your name, email, phone (optional), message body.

Search activity: free-text search queries, parsed filter values, the listings shown to you. We store these to improve relevance and to surface trending searches — but we never link them to your identity. IPs are HMAC-hashed against a daily rotating salt before storage, not stored in raw form.

Saved searches: your search criteria, alert frequency, last-alerted timestamp.

Cookies: a session cookie for sign-in and a consent cookie. No third-party advertising or analytics cookies are set without your explicit consent through our cookie banner.

We use account data to give you access to the service and send you the alerts you've asked for. Legal basis: performance of a contract.

We use enquiry data to route your message to the agent listing the property, and to provide dispute-resolution evidence if a lead is contested. Legal basis: legitimate interest.

We use search activity to improve the search experience and to make sure the homepage reflects what people in your region are looking for. Legal basis: legitimate interest.

Marketing emails only go out if you explicitly opt in.

Agents you enquire with see your enquiry. They are independent data controllers from that point on for the purpose of fulfilling your request. We have a data-sharing agreement with every agency before they go live on the platform.

Our infrastructure providers (Hetzner for hosting, Resend for transactional email, Stripe for payments where relevant) act as data processors and are bound by GDPR-compliant data-processing terms.

We never sell your data. We never share with advertising networks.

Account data: until you delete your account, plus 30 days for backup recovery.

Enquiry data: 7 years from the date of enquiry, to support the e-Commerce Regulations 2002 record-keeping requirements and any agent-lead-dispute resolution.

Search activity: 24 months in identifiable form, then aggregated into anonymised trend data only.

You have the right to access, correct, delete, restrict, port, or object to our processing of your personal data. Email hello@cartref.app and we will respond within 30 days.

You can also complain to the Information Commissioner's Office (ico.org.uk) if you believe we've mishandled your data, though we'd appreciate the chance to fix it first.

Note: search activity that has already been aggregated into anonymised trend data cannot be deleted retrospectively because it is no longer linked to you.

We only set strictly necessary cookies by default (session, consent, CSRF). Any additional cookies — for analytics, A/B testing, or improvement of the AI search parser — require your active opt-in through our cookie banner.

You can change your cookie preferences at any time via the link in the footer.

Your data is stored on servers in the European Union (Hetzner, Falkenstein and Helsinki). We do not transfer your personal data outside the UK or EU without GDPR-compliant safeguards in place.

We'll update this notice if our practices change. Material changes will be notified by email to active users. The 'last updated' date at the top of this page always reflects the current version.