Privacy policy

1. Data controller

Carvix is operated from Romania. For any data-related question or to exercise your rights, write to us at contact@carvix.ro.

2. What we collect

Account data, data about your cars, and technical data.

3. Legal basis

Performance of contract (GDPR art. 6.1.b) for the data in the app, legitimate interest (art. 6.1.f) for technical security logs, and your consent (art. 6.1.a) for optional cookies and notifications.

4. Who we share data with

We do not sell your data and do not share it for marketing. We only use the providers needed to run the service: Supabase (Frankfurt, EU) for database and authentication, Vercel (US) for hosting — transfers covered by Standard Contractual Clauses — and Brevo (EU) for emails.

5. How long we keep your data

For as long as your account is active. When you delete your account the data is removed immediately from active storage and backups are purged within 30 days. Technical logs and items in the trash are kept for 30 days as well.

6. Your rights under GDPR

• •Access, rectification, erasure, portability and objection — most of it directly in the app, the rest by email
• •Withdraw consent for optional cookies and notifications, anytime
• •Complaint to ANSPDCP (www.dataprotection.ro) or your local DPA, without contacting us first

7. Cookies

By default we only set strictly necessary cookies — authentication and language preference. Optional ones (Vercel Analytics and Speed Insights, anonymous) load only after you click "Accept all" in the banner.

8. Security

Data is transmitted encrypted, passwords are stored hashed, and access is isolated so no other user can see your records.

9. Changes

We may update this policy when we ship new features. For significant changes we email you and bump the date above.