Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

Automotive Technology PR Limited
trading as Auto Press Hub
3 Grosvenor House, Chapel Street, Congleton, England, CW12 4AB
Registered in England and Wales, company number 13671308
Email: contact@autopresshub.co.uk

2. What Data We Collect

2.1 Information You Provide

• Newsletter subscription: your email address, optional name and outlet, and how often (daily or weekly) and when you want the briefing
• Account registration (submitters): your name, email address, organisation name, and requested brand association
• Press releases you submit: the press contact name, email address and (optionally) phone number attached to each release. These are published on the release — that is their purpose, so that journalists can verify the source and follow up — and we name the organisation that submitted it. Use a work address you are content to make public.
• Contact form enquiries: your name, email address, and message content
• Event submissions: event details you provide
• Press fleet requests: your name, email address, phone number (optional), the publication you write for and its website, up to three links to your recent work, the vehicle and specification requested from each of up to five manufacturers, a description of the piece, and your preferred dates
• Shared press fleet requests (if you choose to share a request with every manufacturer press office): what you are looking for, whether you are a staff journalist, freelance or a content creator, up to three links to your published work or channel, an optional professional profile link and, for content creators, the approximate audience you tell us. We keep the review details on your account so that we ask for them only once.
• Site feedback and suggestions: the message you write, and your name and email address if you choose to provide them. You may send feedback anonymously; the name and email fields are optional and exist only so that we can reply to you.
• Job listings: the details of the role you are advertising, and an application email address. The application address is published on the listing — that is its purpose, so please use an address you are content to make public, and do not use a personal address where a work one would do. We also use the email address on your account to tell you when your listing is published, is about to expire, and has been removed.

2.1a Information a Press Office Gives Us About You

A manufacturer's press office can ask us not to route any further press fleet requests to them from you. If one does, we record that it happened: which press office, the date, and any short note they add. We do this so that we stop sending them your requests, and because a pattern of several press offices independently declining is the only signal we have that something is wrong.

What follows from it. A refusal applies to that press office only — every other brand is unaffected, and the rest of your Auto Press Hub account is untouched. If five different press offices refuse, we pause press fleet requests on your account and a person reviews it; the number is a prompt for a human look, never an automatic verdict. We do not tell you which press office asked, because naming them would make Auto Press Hub the venue for that argument and expose the person who used a control we asked them to use. You can ask us what is recorded about you and ask us to review it — see Section 8, Your Rights.

2.2 Information Collected Automatically

• Article view and image counts — which release was viewed, the referring page and your approximate country — recorded only if you accept on the cookie banner, and never with your IP address (see Section 7)
• Referrer URL and approximate country (derived from IP address, which is not stored)
• Browser type and device information (via standard HTTP headers)
• When you submit site feedback or a message through our contact form: the page you were on, your browser type and screen size, and your approximate country. This is recorded so that we can reproduce and fix the problem you are describing. We also store a one-way cryptographic hash of your IP address, which cannot be reversed to identify you, solely to prevent abuse of these forms. The IP address itself is not stored.
• If a page fails in your browser, an error report: the page address, your browser and device type, and technical details of the fault. It is sent to our error-monitoring provider, Sentry, which is set up not to record your IP address or other personal data.
• Images from manufacturers' own sites. Images in press releases load directly from the media site of the manufacturer or company that published them, not from us. Your browser therefore sends that site your IP address and browser details, as it does for any web page. How that site uses them is governed by its own privacy notice.
• Cookies and similar technologies (see Section 7)

2.3 Information We Do Not Collect

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data. We do not store IP addresses in our analytics database.

2.4 Press Office Contacts

Our contacts directory lists the people who work in manufacturers' and suppliers' press offices, so that journalists can reach the right person. If you are listed, this section is for you: you have not given us your details yourself, and the law requires us to tell you where they came from and what we do with them.

• What we list: your name, job title, the brands you handle, and your work email address and telephone number.
• Where it comes from: for vehicle manufacturers, the contact details the manufacturer publishes on its own media site or press-office pages, and the media contacts printed in the press releases it issues. For suppliers, the details the company gives us for journalist use. Either way, also any corrections the company or you send us.
• Why, and our legal basis: our legitimate interests, and those of journalists and of your employer, in journalists being able to reach a press office (Article 6(1)(f) UK GDPR). We only list business contact details that your employer has already published, or given us, for that purpose.
• What else we use them for: if a journalist sends a press fleet request to your brand, we may email it to you (see Section 5).
• Keeping it accurate: we regularly check listings against the brand's own media site and its press releases, and each card shows how recently it was confirmed.
• How long: we remove a listing when we learn you have left the role or the brand no longer lists you, or when you or your employer ask us to.
• Your rights: you can object to being listed, or ask us to correct or remove your details, at any time — use the link on your contact card, or email contact@autopresshub.co.uk. The other rights in Section 8 apply to you too.

3. How We Use Your Data

• To send you the newsletter briefing, daily or weekly (with your consent)
• To process and manage submitter account registrations
• To administer the platform, including content moderation and security
• To improve our services through aggregated, anonymised analytics
• To respond to your enquiries
• To pass press fleet requests to the relevant manufacturer's press office, and to follow up once on your behalf if you ask us to
• If you choose to share a press fleet request with every registered manufacturer press office, to show it to verified manufacturer press offices, to check the first one you share before it goes up, and to email the users of those press office accounts when a new one is shared. That email is part of the service to manufacturer accounts, not marketing; any user can switch it off with the link in every email or on the Journalist requests page.
• To publish job listings you submit, and to email you when a listing is published, is about to expire, and has been removed
• To comply with legal obligations

4. Legal Basis for Processing

We process your personal data on the following legal bases under UK GDPR:

• Consent (Article 6(1)(a)): for newsletter subscriptions, email alerts, and passing your press fleet request to the relevant manufacturer's press office. You can withdraw consent at any time.
• Legitimate interests (Article 6(1)(f)): for operating and improving the platform, security, and fraud prevention, and for publishing the press office contacts directory (Section 2.4).
• Contractual necessity (Article 6(1)(b)): for managing submitter accounts and providing our services.
• Contract and legitimate interests, for job listings: we publish the listing you submit, including the application address you ask us to publish, in order to provide the service you have asked us for. Where that address belongs to a colleague rather than to you, our terms require you to have obtained their agreement before giving it to us. We rely on legitimate interests to email you about the status of your own listing, as you would expect us to.
• Legal obligation (Article 6(1)(c)): where we are required to retain data by law.

5. Data Sharing

We do not sell your personal data. We share data only with the following categories of recipients:

• Brevo (Sendinblue): our email delivery provider, used to send newsletters and transactional emails. Brevo processes data as a data processor on our behalf.
• Supabase: our database and authentication provider. Our database is hosted in the United Kingdom (London). Supabase processes data as a data processor.
• Vercel: our hosting provider, which may process server logs containing anonymised request data. Vercel also provides our cookieless site analytics (Section 7).
• Stripe: processes payments for paid plans and single releases — your name, email address, billing address and payment details. Card and bank details go directly to Stripe and never reach us. Stripe acts as a processor for us and, for the payment records financial regulation requires it to keep, as an independent controller.
• Microsoft 365: our email mailboxes, including the address press releases can be emailed to. Emails you send us, with your name and address, are held there.
• Upstash: rate limiting and protection against automated copying of the Site, and to stop abuse of our forms and sign-in. It holds short-lived counters keyed to your IP address, which expire automatically. If automated copying is detected, the IP address involved may be blocked for up to 24 hours and is included in a security alert sent to us.
• Inngest: runs background tasks such as sending emails and passing on press fleet requests. The details of the task, for example a request you have made, pass through it.
• Sentry: error monitoring, hosted in its EU data region. It receives the technical error reports described in Section 2.2.
• GitHub: runs the scheduled jobs that collect press releases, and the press office contact details they contain, from manufacturers' public media sites (Section 2.4).
• Manufacturer press offices: when you submit a press fleet request, we pass the details you provide (your name, contact details, the publication you write for and its website, any links to your recent work, and the vehicle and dates requested) to the relevant manufacturer's press office so they can respond to you directly. If your request covers more than one manufacturer, each press office receives only the vehicle you asked them for, and is told how many manufacturers the request covers and which ones — so they can see the shape of the piece before replying. The form tells you which press offices a request will reach, and names them, before you send it. We facilitate this introduction; each press office then handles your request and your data as an independent controller. If you choose to share a request openly, it is shown, with your name, contact details, publication or channel and links to your work, to every vehicle manufacturer press office registered on Auto Press Hub, and their users are emailed about it; they may use your details only to respond to that request. An open request stays up for at most 30 days, and you can close it at any time.
• Verified manufacturer press offices (shared requests): only if you tick “Share with every manufacturer press office registered on Auto Press Hub”. Your name, publication or channel and its website, email address, phone number if you gave one, links to your work, any profile link, the audience you stated (content creators), and the details of the request are shown on a page that only signed-in users of verified manufacturer press office accounts can see — including PR agency staff a press office has invited onto its account. It is not public, not in our feed and not in our newsletter. A press office that has declined requests from you does not see it. Those press offices may contact you directly and handle your data as independent controllers. The email we send them when a request is shared does not include your email address. The request stays up until your preferred start date or for 30 days, whichever comes first, and you can close it at any time from your account or the link in your confirmation email. We do not record which press offices looked at it.

Job listings are published openly. The application address on a job listing is displayed on a public web page, is visible to anyone, and may be included in the structured data we supply to search engines. That is the purpose of the listing, but it means the address is not shared with a limited set of recipients in the way the rest of this section describes — it is published. Please bear that in mind when choosing which address to give us.

We do not share your personal data with advertisers or any other third parties for marketing purposes.

6. Data Retention

• Newsletter subscriber data: retained until you unsubscribe, after which your email is marked as inactive. We retain the record for 12 months after unsubscription for audit purposes, then permanently delete it.
• Submitter account data: retained for the duration of your account and for 24 months after account closure.
• Analytics data: aggregated, non-personal analytics are retained indefinitely. No personal data is stored in analytics records.
• Enquiry data: retained for 12 months, then deleted.
• Press fleet request data: retained for 12 months from submission for audit and follow-up purposes, then deleted. This includes shared requests: a shared request leaves the press offices' page when you close it, when your preferred start date passes, or after 30 days, and the record is deleted with the rest of the request at 12 months. The review details saved on your account (your requester type, work links, profile link and stated audience) are kept for as long as your account, and you can change them from your account page.
• Press office refusals: a record that a press office declined further requests from you is deleted 24 months after it was made. If it is lifted before then, we keep it for 12 months from the date it was lifted — that record is the audit trail for the lift itself — and then delete it. Any pause on your press fleet access ends when the refusals behind it do. If your account is deleted, these records are deleted with it.
• Site feedback: retained for 24 months so that we can track which suggestions have been acted on and come back to the people who made them. Any name and email address you supplied are deleted at that point; the anonymised suggestion may be retained for longer as a product record.
• Job listings: a listing is published for three months and is then removed from public view. We keep the expired record so that you can repost it without retyping it, and so that we can report on hiring trends across the industry. Twelve months after a listing expires we delete the contact details attached to it, including the published application address; the remaining record is retained without personal data as an industry statistic.

7. Cookies

We use a limited number of cookies and similar technologies:

• Essential cookies: Supabase authentication session cookies, required for logged-in functionality. These cannot be disabled.
• Preference storage: we use browser localStorage (not cookies) to store your saved articles, cookie consent preference, and display preferences.
• Analytics: we use Vercel Web Analytics, which sets no cookies and stores nothing on your device, so it runs whatever you choose on the banner. We also count views of individual releases, but only if you accept on the banner; that count sets no cookie either. We do not use analytics or advertising cookies.

For full details, please see our Cookie Policy. You can manage your cookie preferences at any time via the cookie consent banner or your browser settings.

8. Your Rights

Under UK GDPR, you have the following rights:

• Right of access: you can request a copy of the personal data we hold about you.
• Right to rectification: you can ask us to correct inaccurate data.
• Right to erasure: you can ask us to delete your personal data (subject to legal retention requirements).
• Right to restrict processing: you can ask us to limit how we use your data.
• Right to data portability: you can request your data in a machine-readable format.
• Right to object: you can object to processing based on legitimate interests.
• Right to withdraw consent: you can withdraw consent for newsletter emails at any time by clicking the unsubscribe link or visiting our unsubscribe page.

To exercise any of these rights, please email us at contact@autopresshub.co.uk. We will respond within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. International Transfers

Your data is primarily processed within the United Kingdom and the European Economic Area (EEA): our database is in London and our error reports are held in the EU. Some of our providers (for example Vercel, Inngest, GitHub and Stripe) may process data in other countries, including the United States. Where they do, the transfer relies on UK adequacy regulations (including the UK–US data bridge) or on the safeguards UK law approves, such as the International Data Transfer Addendum to the European Commission's Standard Contractual Clauses.

10. Security

We take appropriate technical and organisational measures to protect your personal data, including encryption in transit (HTTPS/TLS), secure authentication, database access controls, and regular security reviews.

11. Children

Auto Press Hub is a professional platform for automotive journalists and industry professionals. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email. The “last updated” date at the top of this page indicates when the policy was last revised.

13. Contact Us

For any questions about this Privacy Policy or our data practices, please contact:

Auto Press Hub
Email: contact@autopresshub.co.uk