Privacy Policy
Effective date: Oct 21, 2026
This policy explains what personal data CarSpy collects, why, how long we keep it and what rights you have.
1. Controller
The controller of your personal data is [to be specified], [to be specified] (registration number [to be specified]). For any privacy question or request, write to [to be specified].
2. What data we collect
| Data | Where it comes from |
|---|---|
| Account data: email address, password (stored only as a secure hash), sign-in method (e.g. Google), interface language | You, when you register |
| Usage data: VINs you check, markets you choose, reports you obtain, report balance | Your use of the Service |
| Billing data: plan, payment status, country, transaction identifiers, receipts | Our payment provider. We never receive full card numbers |
| Technical data: IP address, browser and device type, timestamps, error logs | Automatically, when you use the website |
| Correspondence: messages you send to support | You |
We do not knowingly collect special categories of data and do not need your name, address or phone number.
About VINs. A VIN identifies a vehicle, not a person. When you request a report we send only the VIN to our data sources — never your email or other account details.
3. Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Create and run your account, generate and store reports, manage your subscription | Performance of a contract |
| Send service emails: confirmations, receipts, renewal reminders, important changes | Performance of a contract / legal obligation |
| Keep the Service secure, prevent fraud and abuse (e.g. multiple accounts, refund abuse) | Legitimate interests |
| Fix errors and improve the Service using aggregated statistics | Legitimate interests |
| Keep accounting and tax records | Legal obligation |
| Marketing emails (only if we introduce them) | Your consent, which you can withdraw at any time |
We do not sell your personal data and do not use it for automated decisions that have legal or similarly significant effects on you.
4. How long we keep data
- Account and reports: while your account exists. After you delete the account, we delete or anonymise it within 30 days.
- Billing and accounting records: as long as required by tax and accounting law (usually up to 10 years).
- Technical logs: up to 90 days, unless needed to investigate a security incident.
- Support correspondence: up to 2 years after the issue is closed.
5. Who receives your data
We share data only with service providers that help us run the Service, under data processing agreements:
| Recipient | What for | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | European Union (Frankfurt) |
| Vercel | Website hosting | Global network; may include the USA |
| Whop | Payments, taxes, invoices — may act as an independent controller for payment data | To be specified |
| Only if you choose "Sign in with Google" | USA / worldwide | |
| Email delivery provider | Sending service emails | To be specified |
| Licensed vehicle data providers (USA, Korea, EU) | Receive only the VIN to return vehicle records | USA, South Korea, EU |
We may also disclose data where required by law or to protect our rights, users or the public.
6. International transfers
Some recipients process data outside the EU/EEA (for example in the USA). In such cases we rely on an adequacy decision (such as the EU–US Data Privacy Framework) or on the European Commission's Standard Contractual Clauses.
7. Your rights
Depending on where you live, you have the right to:
- access your data and receive a copy;
- correct inaccurate data;
- delete your data ("right to be forgotten");
- restrict or object to processing based on legitimate interests;
- data portability — receive your data in a machine-readable format;
- withdraw consent at any time, where processing is based on consent.
To exercise your rights, write to [to be specified] from the email linked to your account. We reply within one month. Self-service export and account deletion will also be available in your account settings.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.
8. Cookies
We use only cookies that are necessary for the website to work (sign-in session and language choice). Details are in our Cookie Policy.
9. Security
Data is transmitted over encrypted connections (HTTPS). Passwords are stored only as hashes. Access to the database is limited by row-level security rules: each user can see only their own data. Staff access is limited to what is needed to provide support.
10. Children
The Service is not intended for persons under 18, and we do not knowingly collect their data.
11. Changes
We may update this policy. We will notify you about material changes by email or in your account before they apply.