caro.cy — Privacy Policy
STATUS: DRAFT — NOT LEGAL ADVICE — REQUIRES REVIEW BY A CYPRUS/EU-QUALIFIED LAWYER (IDEALLY WITH GDPR EXPERIENCE) BEFORE PUBLICATION
This draft was prepared to accelerate legal review, not to replace it. Bracketed items marked [PLACEHOLDER] need real business/legal/technical details confirmed. Do not publish or rely on this document as-is.
Effective date: [PLACEHOLDER] Last updated: [PLACEHOLDER]
1. Who We Are
[PLACEHOLDER — legal entity name], registered in the Republic of Cyprus ("caro.cy", "we", "us"), is the data controller responsible for your personal data as described in this Privacy Policy. Contact for privacy matters: [PLACEHOLDER — dedicated privacy/DPO email if one exists, otherwise your support address].
2. What Personal Data We Collect
- Account data: name, email address, phone number (optional, kept private until you choose to share it), profile photo, business name (for shop accounts).
- Listing data: vehicle details, photos, price, location (district/town), and — for buyers who have messaged about a listing — access to the vehicle's VIN.
- Messages: content of conversations between buyers, sellers, and our support team.
- Usage data: pages viewed, listings viewed/saved, approximate activity timestamps, and similar analytics used to power seller statistics.
- Support/contact data: information you submit through contact forms (e.g., the dealer inquiry form).
We do not currently collect sensitive categories of personal data (such as government ID numbers, precise location/GPS, or demographic data like age or gender) beyond what is listed above. [PLACEHOLDER — update this section immediately if that changes.]
3. How We Use Your Data, and Our Legal Basis
| Purpose | Example | Legal basis (GDPR Art. 6) |
|---|---|---|
| Operating your account and listings | Creating/displaying your listing | Performance of a contract |
| Enabling buyer-seller and support messaging | In-app chat | Performance of a contract |
| Showing you your own listing performance | Seller Stats dashboard | Legitimate interest |
| Sending account-related emails | Password reset, dealer inquiry response | Performance of a contract / legitimate interest |
| Preventing fraud and abuse | Moderation, suspension | Legitimate interest |
| [PLACEHOLDER] | Marketing communications, if ever introduced | Consent (would require opt-in) |
[PLACEHOLDER — a lawyer should confirm each legal basis is correctly assigned before publication.]
4. Who We Share Data With
We share personal data with a limited number of service providers who process it on our behalf, strictly to operate the Platform:
- Supabase (database, authentication, file storage) — hosted in the EU (Ireland).
- Resend (transactional email delivery — e.g., password resets, dealer inquiry notifications).
- Anthropic (AI processing for specific features). [PLACEHOLDER — confirm precisely: the Regulatory Watch feature processes public government/EU webpage text, not personal user data. Confirm no personal data is ever sent to this provider before finalizing this section; if that changes in future features, this section must be updated.]
- Vercel (website hosting).
- [PLACEHOLDER — add a payment processor here once one is integrated, e.g. Stripe, along with what data it receives.]
We do not sell personal data to third parties.
5. International Data Transfers
[PLACEHOLDER — a lawyer needs to confirm the data-transfer status of each provider above (e.g., whether Anthropic, Resend, or Vercel process data outside the EU/EEA, and whether Standard Contractual Clauses or another valid transfer mechanism applies). This is a compliance-critical section and should not be left as a placeholder in the published version.]
6. How Long We Keep Your Data
[PLACEHOLDER — define retention periods, e.g.: active account data retained while the account is active; data associated with a deleted/removed listing retained for [X] for legal/audit purposes; message data retention approach.]
7. Your Rights
Under the GDPR, you have the right to:
- Access the personal data we hold about you;
- Correct inaccurate data;
- Request deletion of your data ("right to be forgotten"), subject to legal exceptions;
- Object to or restrict certain processing;
- Request a copy of your data in a portable format;
- Lodge a complaint with the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus. [PLACEHOLDER — confirm current official name/contact details of this authority before publishing.]
To exercise these rights, contact us at [PLACEHOLDER].
8. Cookies and Similar Technologies
[PLACEHOLDER — this section needs to be written based on what the site actually stores client-side (e.g., authentication session cookies, theme preference, language preference) and whether any of it requires cookie-consent-banner disclosure under the ePrivacy rules. Confirm with the engineering team exactly what is stored before drafting this section.]
9. Children's Privacy
The Platform is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. [PLACEHOLDER — confirm no age-verification gap exists at signup.]
10. How We Protect Your Data
Access to sensitive information (such as a listing's VIN, or another user's private messages) is restricted at the database level using row-level security rules, not only through the website interface — meaning access controls are enforced even if a request bypasses the visible website. [PLACEHOLDER — a lawyer/security reviewer may want additional detail here depending on what level of technical disclosure is desired.]
11. Changes to This Policy
[PLACEHOLDER — confirm the notice mechanism for material changes.]
12. Contact
Questions about this Privacy Policy or your data can be sent to [PLACEHOLDER].