Privacy Policy

1. Who is responsible for your data

No Data Protection Officer has been appointed. Contact the operator using the email above.

2. How we collect your data

You provide information when creating an account, updating a profile, listing a vehicle or builder business, sending a seller enquiry, or using the Wanted, Sourcing, Customisation, Lead Generation, Feature Request, Advertise with Us, Website Design and Contact forms.

We also receive newsletter signups, chosen interests, saved searches, alert requests, shortlists and saved Finder AI briefs. Finder AI receives the text you submit for interpretation. Our hosting receives technical request information automatically.

Guided forms save unfinished answers on your device. Other enquiry forms save drafts in the database. Do not enter passwords, bank details, identity documents or sensitive personal information into these forms.

3. What we process, why, and the lawful basis

Account data

Name, email, a securely hashed password, session details, IP address, browser information and optional profile and contact preferences support sign in and account management. The basis is performance of our service contract. Security checks also rely on legitimate interests in preventing abuse.

Listing data

Vehicle specifications, description, price, currency, location, photographs, seller identity and selected contact preferences support review and publication. The basis is performance of a contract or steps you request before a contract. Submissions are private pending review. Approved listing details and the seller contact details the seller chooses to show are published publicly and may be indexed by search engines.

Enquiries sent to sellers

Name, email, listing reference and enquiry text are saved and emailed to Overland Finds for review. The form does not currently send an email directly to the seller. Requests to arrange contact rely on steps taken at your request before a contract.

Wanted, Sourcing and Customisation requests

Contact details, preferred vehicle, budget, location, timing and project requirements let us review your request and arrange relevant responses. The basis is steps at your request before a contract. Requests are private, not a public wanted board.

Lead Generation and Website Design enquiries

Contact and business details, website, goals, markets, budget and project scope help us prepare a proposal. The basis is steps at your request before a contract. General contact, reports and feature suggestions rely on legitimate interests in responding to enquiries and improving and protecting the service.

Builder listings

Business identity, contact details, specialisations, location, website, logo and photographs support a reviewed directory profile. The basis is performance of a contract or steps before a contract. Approved directory details are public. Submission alone does not publish a profile or collect payment.

Newsletter data

Email address, chosen interests, optional interest description, currency, search filters, signup date, consent wording and version, and email confirmation status support The Weekly Find and requested alerts. The basis is consent. Signup sends an email confirmation link valid for seven days. Regular newsletters and search alerts are not sending yet. Creating an account does not subscribe you. Withdraw consent by emailing us.

Saved searches and alerts

Account linked search names, filters and notification choices let you return to searches. Shortlists and saved briefs are linked to your account or a browser visitor identifier. The basis for saving these is performance of the requested service. Email marketing and requested newsletter alerts require separate consent.

Finder AI

Your entered text and any submitted conversation context are processed through Vercel AI Gateway using a Google Gemini model to interpret requirements and suggest listings. The basis is performance of the service you request. Do not enter sensitive personal information. A brief is stored in our collection database only when you choose to save it.

Approximate location

The hosting supplied country and continent derived from your IP address are used to select a regional site on your first page request and choose a default currency. You can choose United Kingdom or International in the footer to stop automatic region redirects, and change currency manually. Cookie consent is saved separately on each domain, so each site asks for its own choice. We do not request GPS or precise location. This default relies on legitimate interests in displaying useful prices. IP addresses also support separate hosting and security functions described here.

Payment data

No online checkout, payment provider or automatic billing is currently implemented. Listing forms record the selected pricing offer and pending review status, not card or bank details. If payment processing is introduced, the provider and its data handling will be disclosed before payment.

Offer and affiliate link clicks

There is no dedicated affiliate click tracking database or conversion pixel in this application. Links take you to partner websites, which receive normal browser request information and may track referrals under their own policies. Consented site analytics may record general page usage.

Usage and error data

Hosting logs, errors and hashed network identifiers with daily request counters protect the service and help investigate failures. The basis is legitimate interests in security and reliability. Optional Vercel Web Analytics runs only in production and only with your consent. Optional Google page translation also requires consent and an explicit request to load languages.

4. Who we share data with

We never sell your personal data. Sourcing and Customisation requests are passed to selected specialist partners so they can respond. Lead Generation enquiries are passed to our marketing partner so we can prepare your proposal. Forms first reach the operator for review. This sharing is arranged separately, not through automatic partner forwarding in the application. Partners handle resulting services independently.

Public listing and directory details are available to visitors. We may disclose information when required by law or necessary to address fraud or protect legal rights.

• Vercel, United States based: hosting, technical logs, private Blob upload storage, consented Web Analytics and AI Gateway routing. Its infrastructure and subprocessors may operate internationally.
• Neon, part of Databricks, United States based: database storage for accounts, sessions, listings, enquiries, subscriptions, shortlists, searches and database form drafts. The selected database region is not specified in the application source.
• Better Auth: authentication software running on our server with account and session records in Neon. It is not a separate hosted authentication recipient.
• Resend, United States: delivery of enquiry notifications and newsletter confirmation emails, including email addresses and message content.
• Google, with international processing: Gemini AI processing through Vercel AI Gateway, optional Google Translate, and the operator's Gmail inbox for received enquiries. Translation may send displayed page content and technical request information to Google. Do not enable it on pages containing sensitive details.

Provider location above identifies the provider, not a guarantee that every record stays in that country. Frankfurter supplies reference exchange rates through a server request containing currency codes, not your brief, contact details or browser IP address. Its processing location is not specified in the application. External photograph or profile image URLs you provide can also disclose normal request information to their hosts.

5. International transfers and safeguards

These services may process data outside the United Kingdom and EEA, including in the United States. Provider terms describe safeguards such as data processing agreements, EU Standard Contractual Clauses and the UK International Data Transfer Addendum. Resend also describes the EU US Data Privacy Framework and its UK extension.

The applicable mechanism depends on the provider, service and agreement. The source code cannot establish which agreements have been accepted, the chosen storage regions or the location of manual specialist partners. We do not promise that all data stays in the UK or EEA. Email us for the applicable transfer information and safeguards.

Published provider terms: Vercel, Neon, Resend and Google.

6. How long we keep data

The following reflects the current implementation. Expiry of browser access does not automatically delete database records. Most server records do not yet have a scheduled deletion process. You can request deletion by email.

• Accounts and profiles: kept while the account is used, or until a deletion request is handled. There is no automatic inactivity deletion or self service account deletion.
• Sessions: valid for seven days, with renewal during activity. Expired database records are not covered by a separate scheduled purge.
• Listing and builder submissions, enquiries, Wanted, Sourcing, Customisation, commercial briefs, reports and feature requests: retained for operator review and follow up. No fixed automatic deletion period is configured.
• Newsletter signup and consent records: retained until a withdrawal or deletion request is handled. Confirmation links expire after seven days, but expiry does not delete the signup.
• Saved searches: retained until you remove them or request deletion. Saved vehicle IDs and Finder briefs remain until replaced, removed or deleted on request. Guest cookie access lasts up to 90 days, not a database retention limit.
• Guided form drafts: restored for 30 days after the latest save and removed after a successful submission. Browser storage has no automatic expiry; an older draft may remain on your device until removed or overwritten.
• Database form drafts: restored only within 30 days of the latest update and deleted after successful submission. Older database drafts are not automatically purged.
• Uploaded photographs and logos: no automatic deletion schedule is configured, including for abandoned uploads. Contact us for removal.
• Request limit counters: new buckets are used each day, but old counters are not automatically deleted. Hosting, email delivery, AI and analytics logs follow the relevant provider's configured retention, which is not set in this application.
• Payment records and dedicated affiliate click records: not collected by the current application.

Information needed for a legal obligation or a dispute may have to be retained after a request. Deletion from public pages does not guarantee immediate removal from search engine caches or provider backups.

7. Automated decisions

No decisions with legal or similarly significant effects are made by automated means. Finder AI only suggests listings and filters. It does not approve credit, certify a vehicle or decide whether you can travel, import or register it.

8. Age

The service is for adults aged 18 and over. Do not create an account or submit personal information if you are under 18. Contact us if you believe a child has provided information.

9. Security measures

The application uses password hashing, server managed sessions, secure visitor cookies, account scoped queries, encrypted database connections, input validation, origin checks and request limits. Uploaded form images use private file storage with access checks. No system is completely secure. Keep your credentials private and avoid shared devices for saved drafts.

10. Your rights

Subject to the law and relevant exceptions, you can request access, rectification, erasure, restriction, portability, or object to processing. You can withdraw consent at any time without affecting processing that was lawful before withdrawal.

Email overlandfinds@gmail.com with your request. We may need proportionate information to confirm your identity. Please do not send identity documents unless requested through an agreed secure method. We normally respond within one month, subject to lawful extensions.

You can complain to the Information Commissioner's Office at ico.org.uk. Visitors in the EEA can also complain to their local data protection authority.

11. Cookies

See the Cookie Policy for the actual cookies and local storage used. Change optional services through Cookie settings.

12. Changes to this policy

We update this policy when the service or data handling changes and show the updated date above. Material changes will be brought to your attention where required. New consent based uses require an appropriate new choice.