Carspectocarspecto
Legal documents

Privacy Policy

This Privacy Policy explains how Carspecto collects, uses, stores, and protects your personal data in compliance with the General Data Protection Regulation (GDPR) and applicable EU law.

Effective date: May 2026

1

Data Controller

The data controller responsible for processing your personal data is:

Contact for data protection inquiries:: Contact for data protection inquiries:

2

Personal Data We Collect

We collect the following categories of personal data:

accountAccount data
  • Email address (used as your login identifier)
  • Password (stored exclusively as a salted bcrypt hash — never in plain text)
  • Display name (optional, set by you)
  • Account creation timestamp
usageUsage data
  • Browser type and version (for compatibility purposes)
  • IP address at the time of login (logged by infrastructure for security)
  • Timestamps of login sessions
listingsVehicle & listing data
  • Car listing URLs you submit or save
  • Vehicle attributes of listings you save or analyse (make, model, price, mileage, VIN where available, photos)
  • AI-generated analysis reports produced for listings you submit
  • Timestamps of user-triggered save and analysis actions
aiAI assistant interactions
  • Messages you send to our AI assistant about a saved listing
  • The assistant's responses, stored as part of your listing history
billingBilling & subscription data
  • Stripe customer and subscription identifiers, selected plan, and credit balance
  • Invoice and payment-event references
  • Your card details are entered directly into Stripe's own checkout and are never received or stored by the Company

We do not collect payment card data, government-issued IDs, or any special categories of personal data as defined under Article 9 GDPR.

3

Legal Basis for Processing

Contract performance (Art. 6(1)(b) GDPR): Processing your account, listing, AI-assistant, and billing data is necessary to provide the Service — authentication, dashboard access, vehicle analysis, and subscription management.
Legitimate interests (Art. 6(1)(f) GDPR): Basic security logging (IP, login timestamps) is processed on the basis of the Company's legitimate interest in preventing unauthorised access and abuse.
Consent (Art. 6(1)(a) GDPR): Where applicable (e.g., optional cookies), processing is based on your freely given, specific, and informed consent which you may withdraw at any time.
Legal obligation (Art. 6(1)(c) GDPR): Invoices and subscription/payment records are retained for the period required under Slovak accounting law, regardless of account deletion.
4
🇪🇺 EU Data Storage

Where Your Data is Stored

4.1 Infrastructure Provider — Supabase

All user account data, saved listings, and associated usage records are stored using Supabase (Supabase Inc., 970 Toa Payoh North, Singapore), a managed PostgreSQL database platform. The Company has configured the Supabase project to use European Union data centres (Dublin, Ireland — AWS eu-west-1 region).

Your personal data is therefore stored exclusively within the European Economic Area (EEA) and does not leave the EEA under normal operating conditions.

4.2 Data Processing Agreements

Supabase, and each of the sub-processors listed below, act as data processors on behalf of the Company. Data Processing Agreements (DPAs) are in place with each processor in accordance with Article 28 GDPR, obliging them to process personal data only on the Company's documented instructions and to implement appropriate technical and organisational security measures.

4.3 Security Measures

  • Data in transit is encrypted using TLS 1.2+.
  • Data at rest is encrypted using AES-256.
  • Passwords are stored exclusively as salted bcrypt hashes — plaintext passwords are never stored or logged.
  • Database access is restricted to the application layer via Row Level Security (RLS) policies enforced by Supabase.
  • Access to the production database is limited to authorised personnel only.

4.4 Sub-processors We Use

  • Stripe (Stripe Payments Europe, Ltd., Ireland) — payment processing, subscription billing, and invoicing.
  • Google (Google Ireland Ltd.) — AI-powered vehicle analysis and chat via Gemini models; listing details and chat messages you submit are sent to Google for processing.
  • Tavily — web search used to research vehicle listings; search queries derived from listing data are sent to Tavily.
  • Langfuse — AI observability; logs prompts, model responses, and related vehicle/chat data for quality monitoring and cost tracking.
  • Resend, Inc. (USA) — delivery of transactional emails (welcome, password reset, billing notifications).
  • SMTP email delivery — delivery of messages you submit through our contact form to our support inbox.
  • ScrapingBee, Browserless, and Apify — web scraping infrastructure used to retrieve publicly available listing data from third-party car marketplaces; these providers do not receive your account credentials.
  • Vercel Inc. (USA) — application hosting and infrastructure for our website and web application, and cookieless website analytics (Vercel Web Analytics) that measures aggregate site traffic without setting cookies or tracking individual users across sites.

4.5 International Data Transfers

Some of the sub-processors listed above may process data outside the European Economic Area (EEA), including in the United States. Where this occurs, the transfer is safeguarded by the European Commission's Standard Contractual Clauses (SCCs) or another legally recognised transfer mechanism, together with additional contractual and technical safeguards.

4.6 No Sale of Personal Data

The Company does not sell your personal data and does not share it with data brokers or advertising networks. Personal data is shared only with the sub-processors listed above, strictly to the extent necessary to provide the Service.

5

Data Retention

Personal data is retained for as long as your account exists and for a period of up to 12 months following account deletion, to comply with legal obligations and to resolve potential disputes.

Saved car listing data, including any AI-generated analysis reports and chat messages associated with a listing, is retained for the lifetime of your account and deleted within 30 days of a verified account-deletion request.

Security logs (IP address, login timestamps) are retained for a maximum of 90 days and then automatically purged.

Billing and accounting records — including invoices and subscription/payment history processed via Stripe — are retained for 10 years from the date of issuance, as required under Slovak accounting law (Act No. 431/2002 Coll. on Accounting), regardless of any account-deletion request.

6

Your Rights Under GDPR

As a data subject under the GDPR, you have the following rights, which you may exercise at any time by submitting a request through our contact form:

Right of access (Art. 15)
Request a copy of all personal data we hold about you.
Right to rectification (Art. 16)
Request correction of inaccurate or incomplete personal data.
Right to erasure (Art. 17)
Request deletion of your personal data ("right to be forgotten") via our contact form; billing records we are legally required to retain (see Data Retention) cannot be deleted before the statutory retention period expires.
Right to restriction (Art. 18)
Request that we limit processing of your data in certain circumstances.
Right to portability (Art. 20)
Receive your data in a structured, machine-readable format.
Right to object (Art. 21)
Object to processing based on legitimate interests.
Right to withdraw consent
Withdraw any previously given consent at any time without affecting prior processing.
Right to lodge a complaint
Lodge a complaint with the Slovak Data Protection Authority (Úrad na ochranu osobných údajov SR).

We will respond to all verified requests within 30 days in accordance with Article 12 GDPR.

7

US State Privacy Rights (California and Other States)

If you are a resident of the United States, the following applies in addition to the rights described above.

The Company does not sell or share your personal information, as those terms are defined under the California Consumer Privacy Act (CCPA), as amended by the CPRA, and does not engage in cross-context behavioral advertising. Our infrastructure and AI service providers process data solely as service providers under contract and are prohibited from using it for their own purposes.

Right to know / access
Request disclosure of the categories and specific pieces of personal information we have collected about you.
Right to delete
Request deletion of personal information we have collected from you, subject to certain exceptions.
Right to correct
Request correction of inaccurate personal information we maintain about you.
Right to opt out of sale/sharing
Not applicable — we do not sell or share personal information, so there is nothing to opt out of.
Right to non-discrimination
We will not deny you goods or services, charge different prices, or provide a different level of service because you exercised a privacy right.

Residents of other US states with comprehensive privacy laws (e.g., Virginia, Colorado, Connecticut, Utah, and others) have similar rights, which we will honour upon a verifiable request even where not strictly required by the law of your state.

To exercise any of these rights, contact us at support@carspecto.com or via our contact form. We may need to verify your identity before completing your request.

8

Cookies & Local Storage

For detailed information about cookies and local storage used on this website, please refer to our

Cookie Policy

9

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users or via a prominent notice within the Service. The date at the top of this page reflects the most recent revision.

Data Protection Contact

To exercise any of your rights or for any data protection enquiry, please contact us:

Company
Tradetime s.r.o.
IČO
55350542
DIČ
2121962183
Website
carspecto.com
Supervisory authority:: Úrad na ochranu osobných údajov SR — dataprotection.gov.sk

carspecto.com/#contact