Data & Privacy
Overview
CarBuddy processes customer data on behalf of our dealer clients. We act as a data processor under GDPR — your dealership is the data controller, and you retain ownership of all customer data you provide to us.
What data we process
| Data type | Purpose | Retention |
|---|---|---|
| Customer name and email | Campaign personalisation and delivery | Duration of your contract, then the period defined in our Data Retention Policy |
| Mobile number | SMS outreach (where provided) | Duration of your contract, then the period defined in our Data Retention Policy |
| Vehicle details | Message personalisation | Duration of your contract, then the period defined in our Data Retention Policy |
| Conversation transcripts | Lead qualification and handover | Duration of your contract, then the period defined in our Data Retention Policy |
| Portal user accounts | Product access | Until account is deleted |
We do not process special category data (health, financial, biometric, etc.).
Where data is stored
The CarBuddy platform, its databases and its file storage are hosted on AWS in the EU (eu-west-1, Ireland). Backups are kept in a second AWS EU region (eu-north-1, Stockholm).
To deliver the service we use the sub-processors below. Some of them are based in, or process data in, the United States.
| Sub-processor | Purpose | Processing location |
|---|---|---|
| AWS | Hosting, databases, file storage and backups | EU (Ireland; backups in Stockholm) |
| AWS (Amazon Bedrock) | Generating AI replies in CitNOW Conversations chats. Prompts and replies are not stored by AWS or used for training. | UK (London) |
| Twilio | Sending and receiving SMS | US |
| SendGrid (a Twilio company) | Sending email, including handover emails to your team | US |
| OpenAI | Generating AI replies in other customer conversations (web chat, SMS and email campaigns) | US |
| Vapi | Voice AI for phone calls. Vapi passes call audio and transcripts to the voice providers listed in the next row. | US |
| Voice providers, through Vapi: xAI, OpenAI and Google (AI models), Deepgram and Speechmatics (speech-to-text), ElevenLabs and Cartesia (text-to-speech), LiveKit (detecting when a caller has finished speaking) | Processing call audio and transcripts for AI phone calls. Which of these a call uses depends on how that phone line's voice assistant is set up. | US (Speechmatics: UK / EU) |
| Sentry | Error monitoring. Error reports can include details from the request that failed, which may contain customer data. | EU (Germany) |
| postcodes.io | Finding the nearest dealership to a postcode a customer gives the chatbot. Only the postcode is sent. | UK-based service |
| Google (Gmail API / Google Workspace) | Receiving and processing inbound customer emails | US / EU |
| Slack | Internal operations notifications. Some notifications include customer details or message content, for example customer SMS replies relayed into a monitoring channel. | US |
| Anthropic | AI for the portal help assistant and our internal operations tools | US |
| CitNOW / web1on1 | Conversation platform for dealers using CitNOW Conversations. Conversations with those dealers' customers pass through it. | UK / EU |
We update this list when our sub-processors change. Last updated: 28 October 2026.
International transfers
Because some of the sub-processors above are based in the United States, using them means some personal data is transferred outside the UK and the EU/EEA.
Where personal data goes to a country that does not have a UK or EU adequacy decision, the transfer relies on:
- the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, for transfers from the UK
- the EU Standard Contractual Clauses, for transfers from the EU/EEA
- the UK-US Data Bridge (the UK extension to the EU-US Data Privacy Framework), where the US vendor is certified under it
Lawful basis
CarBuddy sends outreach on your behalf. The lawful basis for processing is legitimate interests — reaching out to customers who have already had a commercial relationship with your dealership (showroom visit, service appointment, etc.).
All outreach includes a clear opt-out mechanism. Customers who unsubscribe are immediately and permanently suppressed.
Your obligations as data controller
As the data controller, your dealership is responsible for:
- Ensuring you have a lawful basis to share customer data with CarBuddy
- Providing appropriate privacy notices to customers (mentioning that you may contact them via third-party systems)
- Responding to data subject access requests (DSARs) — CarBuddy will provide exports to support these on request
- Notifying CarBuddy of any relevant data subject deletion requests
Your CarBuddy account manager can provide a Data Processing Agreement (DPA) and GDPR checklist on request.
Data subject rights
If a customer contacts you directly to exercise their rights under GDPR, here's how CarBuddy supports you:
| Right | How we help |
|---|---|
| Right of access | Full data export for any individual available via support ticket within 3 business days |
| Right to erasure | Individual record deletion actioned within 24 hours of request |
| Right to object | Equivalent to unsubscribe — suppressed immediately and permanently |
| Data portability | CSV export of all records and messages available on request |
Security
CarBuddy implements the following controls:
- Encryption in transit: All data transferred over TLS 1.2+
- Encryption at rest: AWS RDS and S3 with AES-256 encryption
- Access controls: Role-based access, principle of least privilege
- Audit logging: All data access and modifications are logged
- Penetration testing: Annual third-party pen test
- Incident response: Security incidents notified to affected clients within 72 hours
Data retention and deletion
On contract end:
- All customer records and conversation transcripts are removed within the period defined in our Data Retention Policy
- Portal user accounts are deactivated immediately and deleted within the period defined in our Data Retention Policy
- A deletion confirmation is provided on request
The exact retention period and the operation applied at expiry (anonymisation versus deletion) are set out in our Data Retention Policy, which your account manager can provide on request.
You can request deletion of individual customer records at any time via the portal support system.
Contact
For data protection queries, contact your CarBuddy account manager or email privacy@carbuddyai.com.
To request our Data Processing Agreement, GDPR checklist, or a copy of our information security policy, contact us.