Privacy Policy

Autothink Group Ltd (trading as AutoPostcode) is the controller of personal data about our customers, website visitors and prospects. Contact us about privacy at info@autopostcode.com or by post at Moss Bridge House, Moss Bridge Road, Rochdale, OL16 5EA.

• Account data: name, business email, company, phone, login details, role.
• Billing data: billing contacts, addresses, invoices and payment status (card details are held by Stripe, not us).
• Usage data: API requests, searches, postcodes queried, website/key used, IP address, browser/device and referrer.
• Website data: pages visited, campaign source, and interactions, collected with our own first-party analytics.
• Communications: emails, support requests, feedback and form submissions (e.g. demo, price-beat or cancellation feedback).

• To provide the Service, manage accounts and billing — contract.
• To meter credits, prevent fraud and abuse and keep the Service secure — legitimate interests.
• To keep tax and accounting records — legal obligation.
• To send service, billing and account emails — contract / legitimate interests.
• To improve the website and understand how it is used — legitimate interests, or consent where required for cookies.
• To send B2B marketing to business contacts, with an opt-out in every message — legitimate interests (PECR).

When people on your websites or apps search for an address, we process that data on your behalf as a processor, under our Data Processing Addendum. You are the controller and responsible for informing your end users.

We do not sell personal data. We use trusted suppliers who act on our instructions:

• Stripe (payments and invoicing);
• SendGrid / Twilio (email delivery);
• Our cloud hosting, database and address-data server providers;
• Validation providers used only when you call phone, email or bank checks;
• Professional advisers, and authorities where required by law.

Address data is licensed from Royal Mail Group Ltd; we do not send your customer data to Royal Mail.

Some suppliers process data outside the UK (for example in the EU or US). Where they do, we rely on UK adequacy regulations, the UK International Data Transfer Agreement/Addendum, or the UK–US Data Bridge.

• Account data: for the life of the account and up to 2 years after it closes.
• Billing and invoice records: 6 years after the end of the financial year, as required by UK law.
• Usage logs and analytics: up to 24 months, then deleted or anonymised.

Under UK GDPR you may request access to, correction, erasure, restriction or portability of your data, object to processing based on legitimate interests or direct marketing, and withdraw consent. Email info@autopostcode.com; we respond within one month.

You can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113), but please contact us first so we can help.

We use encryption in transit, hashed API keys, role-based access controls, audit logging and least-privilege access for staff. No system is completely secure; we will notify affected parties and the ICO of a reportable breach as the law requires.

The Service is for businesses and not directed at children under 18.

We may update this policy and will show the date of the latest version at the top of this page.