Privacy policy

MyPrepCentre (myprepcentre.com) is operated by Nexus Point ("we", "us"), a company registered in England and Wales (company number 07566006, VAT number 109958281). We provide a vehicle-preparation platform for car dealerships. This policy explains what personal data we collect, why, and the rights you have over it. We act as the data controller for account and billing data, and as a data processor for the working data your dealership enters into the platform.

What we collect

• Account details — your name, work email address, role and site assignment, set up by your administrator or by you when registering. Passwords are stored only as salted one-way hashes; we cannot read them.
• Registration details — if you register a dealership, the business name, contact name, email, phone number and anything you add to the message box, so we can review and set up your account.
• Working data your business enters — vehicle registrations and descriptions, prep and valet requests, handover dates, order notes and similar. This may occasionally include personal data about your customers (for example a customer name on a handover). Your dealership controls this data; we process it only to run the service.
• Billing details — your subscription status, active site count and an invoice email address if you set one. We never see or store card numbers — payments are handled by Stripe on their secure pages.
• Security records — sign-in and administrative events (with IP address) kept to protect accounts and investigate misuse.

How we use it

• To provide and operate the platform (performance of our contract with your dealership).
• To email you the things the service needs — invites, password set/reset links, two-step sign-in codes, request notifications, trial reminders, invoices and receipts.
• To keep the platform secure and prevent abuse (our legitimate interest).
• To meet legal obligations such as VAT invoicing and accounting.

We do not sell personal data, use it for advertising, or send marketing emails you haven't asked for.

Who we share it with

We use a small number of service providers to run MyPrepCentre, each acting under their own data-protection commitments:

• Cloudflare — hosts the application and database and provides security services (including the anti-spam check on the registration page).
• Stripe — processes subscription payments and stores payment details.
• Resend — delivers our transactional emails.

Some of these providers may process data outside the UK; where they do, transfers are protected by recognised safeguards such as the UK Addendum to the EU Standard Contractual Clauses. We do not share your data with anyone else unless the law requires it.

How long we keep it

• Working data (jobs, orders, activity history, attachments) is kept for as long as your dealership chooses in Admin → General settings (36 months by default) and is then deleted automatically.
• Account details are kept while the account is active and removed when your administrator deletes the user or the dealership account is closed.
• Billing records are kept for as long as UK tax law requires (normally six years).

Your rights

Under UK data-protection law you can ask us for a copy of your personal data, ask us to correct or delete it, object to or restrict our use of it, and ask for it in a portable format. If your data was entered by your dealership, we may direct your request to them as the controller. To exercise any right, contact us at support@nexuspoint.co.uk. You can also complain to the Information Commissioner's Office (ico.org.uk) if you're unhappy with how we've handled your data.

Security

All traffic is encrypted in transit (HTTPS). Passwords are hashed, sessions are signed, sign-ins are protected by emailed two-step codes, and each dealership's data is separated from every other's. Access to production systems is limited to Nexus Point administrators.

Changes

If we make material changes to this policy we'll update this page and note the new date at the top. Questions? Email support@nexuspoint.co.uk.