Privacy policy
Last updated: August 10, 2026
This policy explains what data we collect, why and how we protect it. We keep it plain, no legalese for its own sake. If anything is unclear, write to us at
1. Data controller
Carvix is operated from Romania. For any data-related question or to exercise your rights, write to us at contact@carvix.ro.
2. What we collect
Account data, data about your cars, and technical data.
3. Legal basis
Performance of contract (GDPR art. 6.1.b) for the data in the app, legitimate interest (art. 6.1.f) for technical security logs and anonymous traffic measurement, and your consent (art. 6.1.a) for notifications.
4. Who we share data with
We do not sell your data and do not share it for marketing. We only use the providers needed to run the service: Supabase (Frankfurt, EU) for database and authentication, Vercel (US) for hosting — transfers covered by Standard Contractual Clauses — and Brevo (EU) for emails.
5. How long we keep your data
For as long as your account is active. When you delete your account the data is removed immediately from active storage and backups are purged within 30 days. Technical logs and items in the trash are kept for 30 days as well.
6. Your rights under GDPR
- •Access, rectification, erasure, portability and objection — most of it directly in the app, the rest by email
- •Object to anonymous measurement, and withdraw consent for notifications, at any time
- •Complaint to ANSPDCP (www.dataprotection.ro) or your local DPA, without contacting us first
7. Cookies and measurement
The only cookies we set are strictly necessary: authentication and language preference. We separately measure how the app is used, with Vercel Analytics and Speed Insights — these set no cookies, keep no identifier between visits and cannot recognise you. That is why they run on legitimate interest (GDPR art. 6.1.f) rather than consent. You may object at any time, and a refusal takes effect immediately and stays in force.
8. Security
Data is transmitted encrypted, passwords are stored hashed, and access is isolated so no other user can see your records.
9. Changes
We may update this policy when we ship new features. For significant changes we email you and bump the date above.