Privacy policy

1. Data controller

The controller of your personal data is [Operator legal name], [ЕИК / UIC], [Registered address, Bulgaria]. For any question or request about your personal data, write to [contact@your-domain].

2. What we collect

• Account: email, password (we store only a cryptographic hash), name; with Google sign-in, the name and email from your Google account.
• Contact details and public page (optional): phone, place, address, a short description; details of the businesses you add.
• Listings: vehicle details, description, price, location and photos. Photos are resized in your browser before upload, which strips their metadata (such as GPS coordinates).
• Activity: comments, ratings, saved listings, and reports you file (with your email as the reporter).
• Technical data: IP address, browser and request times in server logs; sign-in cookies (see section 8).

3. Why, and on what legal basis

• Contract (GDPR art. 6(1)(b)): your account, posting listings, comments and ratings, saved listings.
• Legal obligation (art. 6(1)(c)): handling reports and moderation under the Digital Services Act, answering requests from public authorities.
• Legitimate interest (art. 6(1)(f)): keeping the site secure, preventing fraud and abuse, fixing errors.

We don’t sell your personal data and don’t use it for advertising or profiling.

4. What is public

Your listings, name (or business name), phone, location and comments are visible to every visitor, and so is your public page (address and description, if you filled them in). Ratings are shown only as an average. Your email, saved listings and reports are not public.

5. Who processes data on our behalf

• Supabase (database, sign-in, photo storage), servers in Frankfurt, Germany.
• Vercel (site hosting and anonymous visit statistics without cookies), primary region Frankfurt, Germany.
• Sentry (technical error reports: which page, browser, a technical description of the error; no IP address, cookies or content you entered), servers in the EU (Germany).
• Google, only if you sign in with your Google account.

Some of these providers are US companies. Where data leaves the EEA, this is based on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses. We may disclose data to public authorities where the law requires it.

6. How long we keep data

• Your account and content: until you delete them. When you delete your account we immediately delete your listings, photos, businesses, comments, ratings and saved listings too.
• Database backups are overwritten within 30 days, after which deleted data is gone from them as well.
• Reports and moderation decisions are kept for up to 3 years for Digital Services Act accountability; once you delete your account they are no longer linked to it.
• Server logs: up to 30 days.

7. Your rights

You have the right to access, rectify and erase your data, to restrict or object to its processing, and to data portability. You can do most of this yourself in your profile: edit your details, download all your data (a JSON file) and delete your account. For anything else, write to [contact@your-domain]; we reply within one month.

You have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, www.cpdp.bg) or the data protection authority where you live.

8. Cookies

We use only strictly necessary cookies: to keep you signed in (Supabase Auth) and to remember the language you chose. We don’t use analytics or advertising cookies, so we don’t ask for consent. We count visits with Vercel Web Analytics, which sets no cookies and doesn’t recognise you from one day to the next. If that changes, we will ask for your consent first.

9. Security

The connection to the site is encrypted (HTTPS). Access to the data in the database is limited by row-level rules, so every user can change only their own data.

10. Changes

We will announce material changes to this policy on the site or by email. The date of the last change is shown at the top.