AUTOSELECTA

Legal

Privacy policy

Last updated 11 October 2026

Who we are

Autoselecta is a trading name of Boxbox Life Ltd, a company registered in England and Wales (company number 12247285), whose registered office is at 3 Beale Road, Barrow, Bury St Edmunds, Suffolk, IP29 5ES, registered with the Information Commissioner’s Office under ZC258350. We buy cars at Japanese auctions for customers and import them, and we are the controller of the personal data described here. You can reach us on WhatsApp at +44 7908 911 247 or through our enquiry form.

What we collect and why

  • Your account. Your email address, and your name and phone number if you give them. We use them to sign you in (with a password you choose, stored only in a form that cannot be read back, or a one-time code we email you), to contact you about your bids and to meet our legal obligations.
  • Enquiries. What you tell us on the enquiry or trade form: name, email, phone, budget, timescale, the car you are after and your message. We also note the internet address you sent it from, only to stop automated spam. We use this to reply and to find you a car.
  • Bids. The car, your maximum bid, the exchange rate we fixed it at and the result. Deposits are taken by our payment provider, Stripe: we never see or store your card number. A deposit is authorised on your card and only taken if you win.
  • WhatsApp. If you message us on WhatsApp we receive your number, your WhatsApp name and your messages. Our WhatsApp assistant is automated: an AI model reads your messages to answer questions, suggest cars, and record the details you give (name, email, budget, timescale). A member of our team can read the conversation and take over at any time.
  • Messages. What you write to us from Messages in our app (and the car it is about, if any), and our replies, so our team can answer you. In the app, our assistant answers your messages first: the same AI model as our WhatsApp assistant (Claude, by Anthropic) reads them to answer questions, suggest cars and record what you tell it (budget, timescale, the car you want). Our team can read the conversation and take over at any time. To have only people read and answer your messages, turn the assistant off in the app’s Account settings.
  • Saved cars and alerts. The cars you save and the models you follow, so we can remind you before bidding closes and tell you when another is listed. You can turn each email off in your account or from the link in the email.
  • The cars you look at, only with your OK. If you choose “Accept all” in our cookie notice, we remember which cars you open, under a random id in your browser (and under your account once you sign in), with the cars you save. From these we work out the makes, models, kinds of car, age and price you seem to like, and show you other cars at auction under “Picked for you”. This is profiling, but it only chooses which cars to show you: it never affects your prices, your deposit or whether you can bid. We keep each car for six months after you last looked at it. Choose “Essential only” and we delete what we had, including, if you are signed in, what your account looked at on other devices.
  • “Cars you may like” emails, only if you ask. If you tick the box when you make an account, or turn them on in your account, we email you about once a week with cars picked the same way, importable to the country you chose. We record when and where you asked and the words you agreed to. Every email has a link that stops them at once, and your email app’s own unsubscribe button works too.
  • Our app. If you allow notifications, a token for your phone and its time zone, so we can send them at a sensible hour. If the app goes wrong, an anonymous report of what broke, on which screen and in which version, with nothing that identifies you.
  • Browsing. Our servers keep routine technical logs (such as internet address and pages requested) for security and to fix faults.

Our legal bases are: taking steps at your request before a contract and performing it (your account, enquiries, bids, buying and importing your car, and the saved-car emails you set up); our legitimate interests in running and securing the service and answering questions; your consent, for remembering the cars you look at and for “Cars you may like” emails, which you can withdraw at any time as easily as you gave it; and legal obligations, such as keeping financial records.

Automated decisions

No automated system decides whether you can bid: our team approves every bid by hand, after checking it and its deposit, before it’s placed in Japan. If you disagree with a decision about a bid, ask and one of our team will look at it again.

The cars picked for you (see above) are chosen automatically, but they only decide which cars we show you first. They have no legal or similarly significant effect on you.

Who processes data for us

We use these companies to run the service. Each processes data only on our instructions.

  • Stripe: card payments and deposit holds.
  • Meta (WhatsApp): delivering WhatsApp messages.
  • Anthropic: the AI model behind our assistant, on WhatsApp and in the app’s Messages (unless you turn it off there).
  • Klaviyo, Google Workspace and Resend: sending our emails, such as sign-in codes, alerts and, if you ask for them, cars you may like.
  • Expo, with Apple and Google: delivering our app’s notifications to your phone, such as alerts, news of your bids and replies to your messages, if you allow them.
  • Vercel, Hostinger and Neon: hosting the website and its database.
  • Cloudflare: encrypted backups.

Some of these companies are based in, or process data in, the United States. Where data leaves the UK, it is protected by the UK’s approved safeguards (such as the UK Extension to the EU–US Data Privacy Framework or the ICO’s international data transfer agreement).

We do not sell your data, and we do not use advertising cookies or share what you look at with advertisers. We count visits to our pages and measure how quickly they load anonymously (Vercel Web Analytics and Speed Insights), without cookies and without identifying you. If you choose “Accept all”, we also use Google Analytics to see how the site is used (which pages are read, roughly where visitors come from, which device they use); Google processes this for us, may handle it in the United States under the UK’s data transfer safeguards, and we do not use it for advertising.

Cookies

When you first visit we ask which cookies you are happy with. Apart from the essential ones and the free-car-pages count below, nothing is set until you say so, and you can change your answer at any time: .

Essential: always on, needed for the site to work

  • as_session: keeps you signed in. Removed when you sign out.
  • as_country (and an older as_market): the country you are importing to, so we only show cars you can legally import there. Up to a year. We may suggest one from your approximate location (your country only, from your internet address), which we do not store.
  • as_consent: your answer to the cookie question, so we don’t ask again. A year.
  • as_google_state: for our staff only, a security check while connecting Google Search Console. Ten minutes.

For every visitor: free car pages

  • as_seen: the numbers of the cars you have opened while signed out, so after a few we can ask you to make a free account to see more. Nothing else is in it, it is never used for advertising or shared, and it is removed after 90 days. We rely on our legitimate interest in asking regular visitors to make an account; if you would rather it were not set, make a free account and it is no longer used.

Only if you choose “Accept all”

  • as_visitor: a random id for your browser, so we can remember the cars you open and pick others you may like. A year, or until you choose “Essential only”.
  • _ga and _ga_…: Google Analytics, counting visits and how the site is used, without telling us who you are. Up to 14 months, or removed when you choose “Essential only”.

How long we keep it

We keep your account, enquiries and chats while they are useful to you, and delete them when you ask (see below). The cars you look at are kept for six months after you last looked at each, and a record of the cars we have emailed you for six months, so we never send one twice. Records of bids, payments and purchases are kept for six years, as UK tax law requires. Sign-in codes expire after ten minutes.

Children

Autoselecta is for adults buying cars. We don’t knowingly collect data from anyone under 18; if you think a child has given us theirs, tell us and we will delete it.

Your rights

Under UK data protection law you can ask for a copy of your data, have it corrected or deleted, object to how we use it, or ask us to restrict it. Where we rely on your consent you can withdraw it at any time (cookie settings, your account, or the link in any email), and you can always object to marketing emails: we will stop them. You can also complain to the Information Commissioner’s Office at ico.org.uk, though we would like the chance to put things right first.

Deleting your data

In the Autoselecta app you can delete your account yourself, in Account, then Delete my account. It happens straight away; only records the law makes us keep (bids and payments) stay, for the legal period. Or ask us:

  1. Message us on WhatsApp at +44 7908 911 247, or send an enquiry, saying you want your data deleted. Include the email address or phone number you used with us.
  2. We will confirm it is you, then delete your account, your messages to us, enquiries, WhatsApp conversations, saved cars and alerts, and the cars you looked at.
  3. We will confirm when it is done, within one month. Records we must keep by law (bids, payments and purchases) are kept for the legal period and then deleted.

To stop WhatsApp messages from us at any time, just tell us in the chat, or block the number in WhatsApp.