Privacy Policy
Last updated: 6 October 2026 · Version 1.0
On this page
1. Data controller
The controller of your personal data is to be completed, with its registered office at to be completed, Trade Register no. to be completed, tax ID to be completed (“CronCar”, “we”). For any question or request about your data, write to privacy@croncar.com.
2. What data we process and why
| What data | Where from | Purpose | Legal basis (Art. 6 GDPR) |
|---|---|---|---|
| Email, password (stored only as an irreversible hash), display name, username, profile and cover photo | From you, or from your Google account if you choose “Continue with Google” | Creating and managing your account, signing in | Performance of a contract — Art. 6(1)(b) |
| Date and version of the Terms you accepted | Generated at sign-up | Proof of acceptance | Legal obligation and legitimate interest — Art. 6(1)(c) and (f) |
| Car data: make, model, year, engine, mileage, photos, VIN | From you | Virtual garage, car history, transfer to a new owner | Art. 6(1)(b) |
| Expiry dates for RCA insurance, ITP, road vignette and other deadlines | From you | Sending reminders in the app and by email | Art. 6(1)(b) |
| Posts, comments, likes, follows, communities, the location named in a post | From you | The Platform's social features | Art. 6(1)(b) |
| Uploaded service invoices and history reports | From you | Keeping your car's history privately | Art. 6(1)(b) |
| Marketplace listings: phone number, town, county, price, description, photos | From you | Publishing the listing and letting buyers contact you | Art. 6(1)(b) |
| Listing statistics: views, saves, phone reveals (aggregated, without identifying visitors) | Generated automatically | Statistics for sellers, preventing artificial inflation | Legitimate interest — Art. 6(1)(f); the visitor cookie only with consent |
| Business data: name, email, phone, address, team members | From you | The business profile | Art. 6(1)(b) |
| Content reports, feedback messages, moderation log | From you or generated | Moderation, user safety, improving the Platform, obligations under Regulation (EU) 2022/2065 | Art. 6(1)(c) and (f) |
| IP address, browser type, technical logs | Automatically | Security, abuse prevention, running the service | Art. 6(1)(f) |
| Cookie preferences, language, theme | From you | Respecting your choices | Art. 6(1)(c) and (f) |
We do not use your data for personalised advertising, we do not sell it and we do not make automated decisions with legal effects on you. We do not process special categories of data (Art. 9 GDPR).
3. Extra safeguards
- Your VIN is stored encrypted (AES-256); the app shows only its last 4 characters, and only if you choose so.
- Invoices and history reports are private and accessible only to you, through temporary links.
- Passwords are stored only as hashes (bcrypt).
- The IP address of signed-out visitors is used only in server memory, for at most 30 minutes, and is never saved to the database.
4. What is public
Your display name, username, profile photo, the cars in your garage (without the full VIN), public posts, comments and active listings are visible to anyone visiting the Platform. Posts marked “Followers” are visible only to people who follow you. The phone number in a listing is shown to anyone who taps “Show phone”. Photos and videos may contain metadata, including GPS location; please check them before uploading.
5. Who we share data with
We use the following providers (processors), who process data only on our instructions and under data processing agreements:
| Provider | Service | Location | Transfer safeguard |
|---|---|---|---|
| Vercel Inc. | Application hosting | to be completed | EU-US Data Privacy Framework and standard contractual clauses |
| to be completed | Database | to be completed | Standard contractual clauses, if data leaves the EEA |
| Cloudflare Inc. (R2) | Storage for photos and files | EU / USA | Data Privacy Framework and standard contractual clauses |
| Resend Inc. | Sending emails (reminders, password reset) | USA | Data Privacy Framework and standard contractual clauses |
| Usercentrics A/S (Cookiebot) | Cookie consent management | EU (Denmark) | Not applicable |
| OpenFreeMap | Maps in the Marketplace | EU | Not applicable |
| Google Ireland Ltd. | Sign in with Google, only if you choose it | EU / USA | Data Privacy Framework and standard contractual clauses |
We disclose data to public authorities only when the law requires it. We also share data with other users of the Platform, within the limits described in section 4, and with the new owner of a car you transfer to them.
6. How long we keep data
- Account and garage data, posts and files: until you delete them or your account. When you delete your account, we permanently remove your data from the database and your files from storage, usually immediately and within 30 days for backups.
- Cars transferred to another owner stay in their garage; the link to you and your posts are deleted.
- Content published on behalf of a business that has other members stays with the business.
- Password reset links expire automatically and are deleted within 24 hours of expiry.
- Expired or sold listings: until you or your account delete them.
- Content reports: 12 months. Moderation log: 3 years, to defend against challenges.
- Feedback messages: 24 months.
- Cookies: as set out in the Cookie Policy.
7. Your rights
Under Regulation (EU) 2016/679 (GDPR) you have the right:
- to access your data and receive a copy of it;
- to correct inaccurate data — you can edit most of it directly in Settings;
- to erasure, including deleting your whole account from Settings;
- to restrict processing;
- to data portability, in a structured, commonly used format;
- to object to processing based on legitimate interest;
- to withdraw your consent at any time (for example, from “Cookie settings”), without affecting earlier processing;
- to lodge a complaint with the Romanian data protection authority, ANSPDCP, B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, Bucharest, www.dataprotection.ro.
To exercise your rights, write to privacy@croncar.com from the address linked to your account. We reply within one month; for complex requests this can be extended by two more months, and we will tell you if so.
8. Minimum age
The Platform is not intended for people under 16. If we learn that an account belongs to someone under 16, we will delete it.
9. Security
We use encrypted connections (HTTPS), encryption of sensitive data, restricted admin access and logging of administrative actions. If a security breach is likely to affect your rights, we will notify ANSPDCP within 72 hours and inform you without undue delay, as the law requires.
10. Changes
We publish any change on this page with its update date. We notify you of significant changes by email or in the app.