This policy explains how Traction Automotive Ltd collects, uses, and protects your personal data when you use our products, Traction Demand and Traction Perform. We are committed to handling your data responsibly and in line with UK GDPR and the Data Protection Act 2018.
1. Who we are
Traction Automotive Ltd is the data controller for Traction Demand and Traction Perform. If you have any questions about how we handle your data, you can contact us at:
Traction Automotive Ltd
Email: sally@traction-automotive.com
Website: traction-automotive.com
2. Our products
Traction Demand is a virtual marketing assistant designed for independent UK automotive garages. It helps users create social media content, publish and schedule posts to Facebook and Instagram, send WhatsApp broadcasts to customers who have agreed to receive them, monitor competitor activity, and track marketing performance.
Traction Perform is a people development tool designed to support automotive businesses with staff management. It helps users create job descriptions, produce recruitment advertisements, manage under-performance, and support the development of their team. Traction Perform is currently in development and will be subject to this same policy when it launches.
3. What data we collect
The data we collect depends on which product you are using.
For Traction Demand, we may collect and store:
- Your name and email address, used to create and manage your account
- Business information you provide during onboarding, such as your garage name, website, and customer data
- Content you create within the app, including social media posts and marketing assets
- Facebook page connection details, including your page name, page ID, and access tokens required to publish content on your behalf. Where you have an Instagram professional account linked to your Facebook Page, we also store that account's ID and username, so we can publish to it and show it in the app
- Performance data related to your Facebook posts, such as reach, impressions, and engagement metrics retrieved via the Facebook Graph API
- Performance data related to your Instagram posts, such as reach, views, likes, comments, saves, and shares, retrieved via the Instagram Graph API
- Where you connect a WhatsApp Business Account, the account and phone number details, message templates, broadcast records and opt-out list described in section 6
- App usage data, including session timestamps and activity logs
For Traction Perform, we may collect and store:
- Your name and email address, used to create and manage your account
- Business information relevant to your people and recruitment activity, such as role descriptions, performance records, and recruitment content
- Facebook page connection details where used to publish recruitment advertisements
- App usage data, including session timestamps and activity logs
We do not collect sensitive personal data about your employees, such as health information, without a specific and lawful reason to do so. Where any such data is provided, it will be handled with additional care and in line with UK GDPR requirements for special category data.
4. How we use your data
We use your data only to provide and improve our products. Specifically:
- To authenticate your account and keep it secure
- To power the AI-assisted features within the app you are using
- To connect to your Facebook Page and publish content on your behalf after you have created and explicitly approved each post within the platform
- To retrieve post performance data from Facebook so you can monitor your results
- To send WhatsApp broadcasts you have approved to customers who have given WhatsApp consent, and to record opt-out requests so those customers are not messaged again
- To save your work so it persists between sessions
- To support people development workflows within Traction Perform
We do not sell your data. We do not use your data for advertising purposes. We do not share your data with third parties except as described in section 5.
5. Third-party services we use
Both products are built on a small number of trusted third-party platforms:
- Google Firebase, used to store your account data, app content, and uploaded files securely in the cloud. Firebase is operated by Google LLC and data is stored in accordance with Google's data processing terms.
- Meta (Facebook, Instagram and WhatsApp), used to connect your Facebook Page, publish posts and recruitment advertisements to Facebook and, where you have linked one, to Instagram, to retrieve performance data from both, and, where you have connected one, to send WhatsApp broadcasts from your own WhatsApp Business Account. When you connect your Facebook account, Meta's own privacy policy and platform terms also apply.
- Google Gemini, the AI model that powers the assistant features across both products. Content you share within the app may be processed by Gemini to generate responses. No personally identifying data is sent beyond what is necessary to generate a response.
6. Facebook, Instagram and WhatsApp data and permissions
When you connect your Facebook page to Traction Demand, we request limited permissions via the Facebook Graph API. These permissions are used only to provide core functionality within the platform and only after you have authorised access.
- pages_show_list, to allow you to select and connect the Facebook Pages you manage
- pages_read_engagement, to retrieve basic performance data such as reach and engagement for posts published via the platform
- pages_manage_posts, to publish content to your Facebook Page only after you have created and approved the post within the platform
- business_management, used as part of the Facebook Login for Business flow to establish the business context of your account, so we can identify Facebook Pages you manage through a Meta business portfolio (Business Manager) and complete the connection. We do not access ad accounts, create or manage ads, or change any Business Manager settings.
- instagram_basic, to identify the Instagram professional account linked to your Facebook Page and show its name in the app, so you can confirm which account your posts will be published to
- instagram_content_publish, to publish approved image posts to your Instagram professional account, alongside or instead of your Facebook Page, only after you have created and approved the post within the platform
- instagram_manage_insights, to retrieve post-level performance data such as reach, likes, comments, saves, and shares for content published to your Instagram account, so the app can show you how your posts performed and give informed marketing advice
We store your Facebook page access token securely in Firebase, along with the ID and username of any Instagram professional account you have linked to your Facebook Page. We use these only to publish content you have chosen to create or schedule, and to retrieve performance data for posts published to Facebook and Instagram through our products. We do not access your personal Facebook or Instagram profile, your friends or followers, or any data beyond what is needed to operate the service.
You can disconnect your Facebook page at any time from within the app. Doing so will remove your stored access token and any linked Instagram account details, and stop any scheduled content from publishing.
WhatsApp. If you connect a WhatsApp Business Account to Traction Demand we request the whatsapp_business_management and whatsapp_business_messaging permissions. We store your WhatsApp Business Account ID, the ID and display number of the phone number you connect, the names, wording and approval status of the message templates you create, and for each broadcast the number of messages sent, delivered, read and failed. Messages are sent only to customers you have recorded WhatsApp consent for. We receive and keep the WhatsApp message ID of each message we send so we can match delivery receipts to your broadcast. We receive inbound messages to your number only to detect opt-out requests; when a customer replies STOP, or a similar opt-out word such as UNSUBSCRIBE, we record their phone number as opted out and do not store the rest of the message. Meta bills you directly for messages sent from your WhatsApp Business Account. Your WhatsApp access token is held on our servers and never in your browser.
If you would like us to delete any Facebook, Instagram or WhatsApp related data associated with your account, you can request this at any time by emailing sally@traction-automotive.com. We will process all data deletion requests within 30 days.
7. Data security
We take reasonable steps to protect your data. Specifically:
- All data is stored in Google Firebase, which is protected by Google's enterprise-grade security infrastructure
- Authentication is handled by Firebase Authentication
- Sensitive credentials such as API secrets are stored in Google Cloud Secret Manager and are never exposed in the application code or to the browser
- All data is transmitted over encrypted HTTPS connections
8. How long we keep your data
We keep your data for as long as your account is active. If you ask us to delete your account, we will remove your data from our systems within 30 days. Some data may be retained for a short period in backup systems before being permanently deleted.
9. Your rights under UK GDPR
As a UK-based user, you have the following rights regarding your personal data:
- The right to access the data we hold about you
- The right to correct inaccurate data
- The right to request deletion of your data
- The right to restrict or object to how we process your data
- The right to data portability
To exercise any of these rights, contact us at sally@traction-automotive.com. We will respond within 30 days.
If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
10. Cookies
Our products use cookies set by Firebase Authentication to manage your login session. These are strictly necessary for the app to function and do not track you for advertising purposes.
The Facebook SDK, loaded when you connect your Facebook page, may also set cookies in line with Meta's own cookie policy.
Our website pages include an embedded demo video hosted on YouTube. We use YouTube's privacy-enhanced mode, so YouTube does not set tracking cookies unless you choose to play the video. If you do play it, YouTube may set cookies on your device in line with Google's privacy and cookie policies.
11. Changes to this policy
We may update this policy from time to time as our products develop. If we make significant changes, we will let you know via the app or by email. The date at the top of this page will always reflect when it was last updated.