Privacy policy

Openauto (openauto.co.nz) is run by DMEGA Limited, trading as Openauto, in Auckland, New Zealand. This policy explains what personal information we collect, why, who else handles it and what your rights are under the New Zealand Privacy Act 2020. We keep it short and plain.

What we collect

• Your account: your email address and, if you sign in with Google, the first and last name Google shares with us.
• How you sign in: the sign-in methods you set up. That can include passkeys, an authenticator app and recovery codes. We store these securely and never show them to anyone.
• Your sessions: when you sign in we record the device details your browser sends (such as its IP address and browser type), to keep your session secure and let you see where you are signed in.
• Your searches: the words you type into search, any follow-up answers you give and the filters that come out of them. We keep these for 30 days to improve our search (for example, to spot where it misunderstood people), then delete them.
• Your search history: if you are signed in, we also keep a history of your searches so you can look back at them and run them again. Each one also remembers which cars it showed (up to 100), so you can see them again while they are still for sale. It is private to you and stays until you delete a search, clear your history or delete your account.
• Your lists and saved searches: if you are signed in, we keep the cars you save to your lists (including Favourites), the names you give your lists and the searches you save. Only you can see them, unless you choose to share a list. A car that stops being listed stays on your list, marked as expired, for 30 days and is then removed.
• Email alerts: if you switch on alerts for a saved search, we keep a copy of your account email address so we can send them. Each morning at 7am New Zealand time we check that search for cars listed since the last check and, only if there are new ones, send you one email with them. Every alert email has a link to stop alerts for that search and a link to stop them all, which work without signing in. We do not track whether you open the email or click its links. If you switch off all your alerts, we stop using the copy of your email address, and we delete it when you delete your account.
• Shared links and reports: if you share a list, we create a private web link to it. Anyone who has the link can see the list's name and the cars on it, but not your name or email address, and search engines are told not to index it. You can switch the link off or replace it at any time. If someone reports a shared list, we keep the reason they chose, any details they type and a scrambled (hashed) form of their IP address that changes every day, so we can review the list and stop repeat reports. We may switch off a link, or sharing on an account, if a list breaks our terms.
• Reports and corrections about cars: to report a car or suggest a correction you need to be signed in. We keep what you choose and type, the car and your account, and we email a copy to our compliance team with your account email address, so we can look into it and spot misuse. We don't show who reported a car to the seller or anyone else. We don't remove or change a listing just because it was reported. They are deleted with your account.
• Search counts: to keep search fair and stop abuse, we count how many searches each person makes per day. If you are not signed in, we count by a random visitor cookie and a scrambled (hashed) form of your IP address. We store the scrambled form, not your address, and the scrambling changes every day. We delete these counts after a week.
• Cars you look at: we count each time a car's page is opened and each time someone taps through to the dealer, once per car per day, using the same scrambled form of your IP address. We use the counts to show popular cars higher in the results. We don't link them to your name or account, and we delete them after 90 days.
• Technical logs: our servers keep short-lived logs of requests and errors so we can find and fix problems. We keep these for 30 days. They don't include what you search for.

What we do with it

We use your information to create and secure your account, run your searches, keep your search history, keep your lists and saved searches, let you share lists, review reports about shared lists and cars, send you sign-in and account recovery emails and the search alerts you ask for, improve our search, keep the service running and protect it from misuse. We do not sell your information, we do not show ads and we do not use third-party advertising or analytics trackers on this website. We only send emails you need to use your account, and search alerts you switch on yourself. If we ever want to send marketing, we will ask you first.

Cookies

We use only the cookies the site needs to work: one that keeps you signed in (for up to 30 days), short-lived ones that protect sign-in forms from forgery, and a random visitor cookie that counts your free searches each day (it holds nothing else and lasts a year). You can clear them in your browser at any time, which signs you out and resets the visitor cookie.

Who else handles your information

These companies process information for us so the site can run:

• Microsoft Azure hosts our database and servers in New Zealand. Our email service stores its data in Australia.
• Cloudflare delivers and protects the website, so it sees your requests, including your IP address, as they pass through its network, which is global.
• Google, only if you choose "Sign in with Google". Google's own privacy policy applies to that sign-in.
• Groq, in the United States, runs the AI that reads the words you type into search and turns them into filters. We only send the words of your search, never your name, email address or account details. Groq is not allowed to use them to train AI models, and we have set it not to keep them.
• OpenRouter, in the United States, is our backup when Groq is unavailable. It passes the words of your search to a similar AI service, and we tell it to use only services that don't keep them or train on them.

Because some of these services operate outside New Zealand, your information may be processed overseas. We only use providers that protect personal information to a standard we consider comparable to New Zealand's.

How long we keep it

We keep your account information, search history, lists and saved searches while your account is open. If you delete a list, its shared link stops working and the list is deleted. The words of searches are deleted after 30 days, and daily search counts after a week. If you ask us to delete your account, we delete your information, including your search history, lists and saved searches, except what we must keep by law. Backups are cleared on their normal schedule.

Security

We protect information with encryption in transit, strict access controls and optional second-factor sign-in. If a privacy breach is likely to cause serious harm, we will tell the people affected and the Privacy Commissioner as the Privacy Act requires.

Your rights

You can ask us for a copy of the personal information we hold about you, ask us to correct it or ask us to delete your account. Email compliance@openauto.co.nz. We will reply within 20 working days. If you are not happy with how we handle your information, you can complain to the Office of the Privacy Commissioner.

Age

You must be 13 or over to create an Openauto account, and we do not knowingly collect information from anyone younger. If you are under 16, you need a parent or guardian's permission to use Openauto. Some features, such as finance, are for people aged 18 and over and will say so where they appear.

Changes

We may update this policy as Openauto grows. The date at the top shows when it last changed, and we will tell account holders about important changes.

Contact

DMEGA Limited, trading as Openauto, Auckland, New Zealand.
Privacy and legal: compliance@openauto.co.nz
General questions: hello@openauto.co.nz