1. Who we are

DealStack is operated by A&H Automotive Solutions Limited, trading as DealStack.

Registered address:
69 Bourne Terrace, W26PA

Email: info@dealstack.uk
Phone: 07565 767993

This policy covers our website, CRM, document links and connected email features.

2. Who is responsible for your information?

We decide how to use information for our own accounts, billing, support, enquiries and service security. For these purposes, we are the data controller.

When a brokerage uses DealStack to manage an application, the brokerage normally decides why your information is used and is the controller of that record. We provide the software and process those records on its instructions. Dealers and lenders may also be controllers for their own work. Their privacy notices explain their decisions.

If your question concerns a finance application, contact the brokerage handling it. You can also contact us and we will help direct your request.

3. Information we handle

• Account and business details: names, contact details, company and trading names, addresses, company numbers, business permissions, profile images and team membership.
• Customer and deal records: identity and contact details, address history where supplied, vehicle details, application and agreement information, financial figures, commissions, costs and payments entered by an authorised business.
• Documents and communications: uploaded files, generated invoices and contracts, signatures and signing records, messages, emails, handover arrangements, document checks, complaints and activity history.
• Service information: login and session details, device and browser information, IP addresses where recorded by our website or hosting, usage and error records, and saved display preferences.
• Connected Gmail data: the information described in section 5, only when an account is connected.

Information comes from you, your employer or account administrator, the brokerage, connected dealers or lenders, uploads through document links, and integrations used for the deal. Vehicle and address lookups return information from the configured providers, including Vehicle Data Global or Google address services where enabled.

A document or complaint may contain sensitive information, such as health or vulnerability details. The business supplying it is responsible for having an appropriate lawful basis and any additional condition needed for that information. Only information relevant to the task should be supplied.

4. Why we use it

We use information to provide accounts and support, keep DealStack secure, manage subscriptions and usage, and operate the features requested by authorised users. These include managing deals, preparing documents, requesting checks, arranging handovers, handling complaints and sending communications.

For our own processing, we rely on:

• Contract: to deliver services you contract with us for.
• Legitimate interests: to run and protect the platform, support business users, answer enquiries and maintain necessary records, while considering your rights.
• Legal obligations: where we must retain or disclose information.
• Consent: where required for an optional use, such as non-essential tracking or certain marketing.

For customer records held on behalf of a brokerage, the brokerage determines the lawful basis. Required account or deal details are needed to provide the relevant service; without them, that service or application may not be able to proceed.

5. Connected email

Gmail

Connecting Gmail lets you read and send work email inside DealStack. Google asks you to authorise access; DealStack does not receive your Google password.

The connection accesses your mailbox address, message headers and bodies, recipients, attachments, folders and labels, drafts, read status and sending identities or signatures. This supports the inbox, sent folder, composing and sending, draft saving, marking messages read or unread, and moving messages to or from the bin. Actions you take in DealStack can change the same items in Gmail.

Email data passes through DealStack’s servers. We store encrypted connection credentials and temporarily cache some mailbox information. Emails or attachments saved into a deal, and records of emails sent from DealStack, can remain with that deal.

An inbox can be private to its connected user or made available for brokerage sharing. Authorised managers can assign a shared inbox to individual employees or make it available to all current and future active broker employees in the company. Users with Inbox permission can read and send from shared Gmail inboxes. A manager connecting an inbox for an employee must be authorised to grant that access. Sending an email shares its contents and attachments with the recipients you choose.

We use Google data only for these visible communication features. We do not sell it, use it for advertising, assess creditworthiness or lending eligibility with it, or train general-purpose AI models with it. Staff access to Google data is limited to your specific authorisation, security investigations, legal requirements, or permitted internal use of aggregated, anonymised information.

DealStack follows the Google API Services User Data Policy, including its Limited Use requirements, when using or transferring information received from Google APIs. Google data is not covered by any broader sharing permission elsewhere in this notice.

Disconnect through the connected inbox settings, or ask your brokerage administrator. You can also remove DealStack’s access in your Google Account connections. Disconnecting removes the stored connection from DealStack; it does not delete your Gmail messages or copies already saved as business records. For deletion of DealStack-held data, email info@dealstack.uk. Where a brokerage controls the record, we handle the request with that brokerage.

Microsoft 365 and SMTP email

When you connect Microsoft 365, DealStack uses the account name and email address and sends authorised messages through Microsoft. You can separately opt into Outlook inbox viewing. With your consent, DealStack retrieves messages and attachments from your own mailbox when you open them. Sending assignments alone do not grant reading access. Company settings can explicitly share an inbox-enabled Microsoft connection with all active broker employees who have Inbox permission. Remote message images are blocked in the embedded viewer. SMTP connections send through the email provider you configure. SMTP credentials and OAuth connection tokens are encrypted in storage. Sending connections can be shared with assigned employees or made available to the entire company, whose active broker employees can send from them.

Brokerage default email documents remain stored until they are removed or deleted. Uploaded email files are restricted to their brokerage. Outgoing email is stored encrypted while awaiting submission, including recipients, message content and attachments. Background workers submit it through the selected provider and retry definite temporary failures. Uncertain results are paused for review. Disconnecting a connection prevents further submissions through it; it does not recall messages already accepted by the provider.

6. Who can receive information?

Depending on the task, information is available to authorised brokerage users and the dealers, lenders, customers or other recipients involved in that task. Access permissions and company relationships control what platform users can see. Keep document links private: someone with a valid link may be able to view or complete the documents it exposes.

We use service providers for website hosting, storage, backups, security and email delivery. Google processes data for connected Gmail and Google-powered lookups; Microsoft and configured SMTP providers process email submitted through those connections; vehicle-data providers receive the details needed for requested vehicle checks. Providers only receive information needed for their role. We may also disclose information to professional advisers, regulators or authorities when required for a legal obligation or to establish or defend legal rights.

We do not sell personal information. Google data remains subject to the narrower rules in section 5.

7. Where information is handled

DealStack serves UK businesses. Some service providers may handle information outside the UK. Before a restricted international transfer, we require a lawful transfer arrangement, such as UK adequacy recognition or appropriate contractual safeguards. Contact us for information about the providers, locations and safeguards relevant to your data, or a copy of applicable safeguards.

8. How long we keep it

We keep information for as long as it is needed for its purpose. The period depends on the active service, the brokerage’s instructions, applicable record-keeping obligations, unresolved complaints or disputes, and security needs.

• Account, billing and support records: while needed to provide the service and meet relevant legal or business-record obligations.
• Customer, deal and document records: according to the responsible brokerage’s retention instructions and applicable obligations. Closing a deal or expiring a document does not automatically delete its history or evidence.
• Outgoing mail: queue attachments and account-access message bodies are removed after confirmed provider submission. Unsent payloads expire after 24 hours, or 30 minutes for account-access emails, and are removed by scheduled cleanup. Other outgoing previews are kept for up to 7 days and delivery metadata for up to 90 days. Deal activity snapshots and documents saved separately follow the brokerage’s business-record retention rules.
• Email connections: connection credentials remain until disconnected or removed. Temporary caches expire separately; saved correspondence remains subject to the relevant business-record rules.
• Logs and backups: according to their security, recovery and legal purpose. Removing a live record does not immediately remove copies from backups; these remain subject to the backup retention process.

Contact us or the responsible brokerage to ask about a particular record or request deletion. A legal reason to retain information may limit what can be deleted.

9. Security

DealStack uses authentication, permissions, company-based access controls and activity records to help protect information. Email connection credentials and outgoing queue payloads are encrypted in storage. Users should protect passwords, check recipients and permissions, and avoid sharing document links more widely than intended. No online service can guarantee absolute security.

10. Cookies and browser storage

DealStack uses cookies and browser storage for sign-in, sessions, security, login redirects and interface preferences such as theme and list or grid views. Blocking essential storage can prevent these features working. Optional analytics or advertising technologies, if added to the website, need separate information and consent where required; this policy is not consent to that tracking.

Emails displayed in the inbox may contain externally hosted images. Loading them can disclose technical information to the image host or sender.

11. Automation and your choices

DealStack can calculate figures, flag risks, update document states and request checks using information supplied for a deal. These tools support the business handling your application. DealStack does not itself decide whether you receive finance. Ask your brokerage or lender about any assessment or decision it makes, and how to request human review where applicable. Gmail information is not used for credit or lending decisions.

12. Your rights

Depending on the circumstances, you can ask to access, correct or delete your information, restrict its use, or receive a portable copy. You can withdraw consent for consent-based processing at any time; this does not affect earlier lawful use.

You can object to processing based on legitimate interests, and you can object to direct marketing at any time.

Email info@dealstack.uk to make a request. We may need to verify your identity. We normally respond within one month, subject to lawful extensions or clarification. When a brokerage controls the information, we will assist it in handling the request.

You can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint. You can contact us first, but you do not have to.

13. Changes to this policy

We will update this page when the service or our practices change. The date above shows the latest revision. Where a change requires a new notice or consent, we will provide it before the new use begins.