Privacy Policy for Carvetka

Effective Date: October 10, 2024
Last Updated: October 10, 2024

1. Introduction

Welcome to Carvetka ("we," "our," or "us"). DEFIANT LLC operates the Carvetka platform at carvetka.com and through our mobile applications (collectively, the "Service"). We are committed to protecting your privacy and handling your personal information with care and respect.

This Privacy Policy explains how we collect, use, store, and protect your information when you use our vehicle maintenance tracking and management services. By using Carvetka, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Information You Provide Directly

Account Information:

• Email address
• Name (optional)
• Password (encrypted)
• Account preferences and settings

Vehicle Information:

• Vehicle Identification Numbers (VINs)
• Make, model, year, and specifications
• Odometer readings
• License plate numbers (optional)
• Purchase and ownership information

Maintenance Records:

• Service dates, descriptions, and costs
• Fuel purchases and consumption data
• Expense categories and notes
• Maintenance schedules and reminders
• Issue tracking and resolution notes

Documents and Media:

• Uploaded receipts, invoices, and warranties
• Photos of vehicles, service work, and documents
• Insurance and registration documents
• Any other files you choose to upload

Payment Information:

For Premium and Family plan subscribers, payment details are processed securely through our third-party payment processor (Stripe). We do not store complete credit card numbers on our servers.

2.2 Information Collected Automatically

Usage Data:

• Pages visited and features used
• Time spent on the platform
• Browser type and version
• Device information (type, operating system)
• IP address and general location data
• Referring website addresses

Mobile App Data:

• Device identifiers
• Mobile operating system version
• App version and settings
• Crash reports and performance data

Cookies and Similar Technologies:

We use cookies, web beacons, and similar tracking technologies to enhance your experience, remember your preferences, and analyze usage patterns.

2.3 Information from Third Parties

VIN Decoding Services:

When you enter a VIN, we query the NHTSA (National Highway Traffic Safety Administration) database to retrieve vehicle specifications. This data is publicly available government information.

Authentication Services:

If you choose to sign up using third-party services (such as Google or Apple Sign-In), we receive basic profile information as permitted by those services.

3. How We Use Your Information

We use your information for the following purposes:

3.1 Providing and Improving the Service

• Creating and managing your account
• Storing and organizing your vehicle maintenance records
• Generating maintenance reminders and notifications
• Providing vehicle specifications through VIN decoding
• Syncing data across your devices
• Analyzing usage patterns to improve features and user experience
• Developing new features and functionality

3.2 Communication

• Sending maintenance reminder notifications
• Responding to your support requests and inquiries
• Sending important service updates and security alerts
• Sharing product updates and new features (with your consent)
• Sending promotional emails about our services (you can opt out anytime)

3.3 Security and Legal Compliance

• Detecting and preventing fraud, abuse, and security threats
• Enforcing our Terms of Service
• Complying with legal obligations and responding to legal requests
• Protecting the rights, property, and safety of Carvetka, our users, and others

3.4 Analytics and Research

• Understanding how users interact with our platform
• Conducting aggregate statistical analysis (anonymized data only)
• Improving our algorithms and recommendation systems
• Testing new features and improvements

4. How We Share Your Information

We only share your information in the following limited circumstances:

4.1 Service Providers

We work with trusted third-party service providers who help us operate our platform:

• Supabase: Database hosting and backend infrastructure
• Cloud storage providers: Secure storage for your documents and photos
• Stripe: Payment processing for Premium and Family plans
• Email service providers: Sending maintenance reminders and notifications
• Analytics services: Understanding platform usage (using anonymized data)

These providers are contractually obligated to protect your information and use it only for the services they provide to us.

4.2 Family Plan Sharing

If you subscribe to our Family Plan, designated family members will have access to shared vehicle information according to the permissions you set. You control what information is shared with family members.

4.3 Legal Requirements

We may disclose your information if required by law or in response to:

• Valid legal processes (subpoenas, court orders)
• Government or regulatory requests
• Enforcement of our Terms of Service
• Protection of rights, property, or safety of Carvetka, users, or the public

4.4 Business Transfers

If Carvetka is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on our platform before your information is transferred and becomes subject to a different privacy policy.

4.5 With Your Consent

We may share your information for other purposes with your explicit consent.

5. Data Security

We take the security of your information seriously and implement industry-standard measures to protect it:

5.1 Security Measures

• Encryption: All data transmitted between your device and our servers is encrypted using SSL/TLS protocols (bank-level encryption)
• Secure Storage: Your data is stored on secure servers with restricted access
• Password Protection: Passwords are hashed and encrypted, never stored in plain text
• Regular Security Audits: We conduct periodic security assessments
• Access Controls: Limited employee access to personal data on a need-to-know basis

5.2 Your Responsibility

• Keep your password secure and confidential
• Use a strong, unique password
• Log out of shared or public devices
• Enable two-factor authentication when available
• Report suspicious activity immediately

6. Data Retention

6.1 Active Accounts

We retain your information for as long as your account is active or as needed to provide you services. Your vehicle maintenance records, documents, and photos remain in your account until you choose to delete them.

6.2 Account Deletion

If you delete your account:

• Your personal information and vehicle records will be permanently deleted within 30 days
• Some information may be retained in backups for up to 90 days for security and legal compliance purposes
• Anonymized, aggregated data may be retained for analytics

6.3 Legal and Business Requirements

We may retain certain information longer if required by law, regulation, or to:

• Resolve disputes
• Enforce our agreements
• Comply with legal obligations
• Prevent fraud and abuse

7. Your Rights and Choices

7.1 Access and Control

You have the right to:

• Access: View all personal information we hold about you
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your account and personal data
• Export: Download your data in a portable format
• Restriction: Limit how we process your information

To exercise these rights, contact us at privacy@carvetka.com

7.2 Communication Preferences

You can control communications from us:

• Maintenance Reminders: Manage notification preferences in your account settings
• Marketing Emails: Unsubscribe using the link in any promotional email
• Push Notifications: Disable through your device settings

Note: You cannot opt out of essential service communications (security alerts, account changes, legal notices).

7.3 Cookie Preferences

You can control cookies through your browser settings. Note that disabling cookies may affect platform functionality.

7.4 Do Not Track

Some browsers include Do Not Track features. Our platform does not currently respond to Do Not Track signals.

8. International Data Transfers

DEFIANT LLC is incorporated in Belarus. If you access our services from outside Belarus, your information may be transferred to, stored, and processed in Belarus and other countries where our service providers operate.

We ensure appropriate safeguards are in place for international data transfers through:

• Standard contractual clauses
• Secure data transfer protocols
• Compliance with applicable data protection laws

By using our Service, you consent to the transfer of your information to Belarus and other countries.

9. Children's Privacy

Carvetka is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@carvetka.com. We will promptly delete such information from our systems.

Family Plan: While parents may track vehicles used by teenage drivers through our Family Plan, the parent or legal guardian must maintain control of the account and be responsible for all information.

10. Third-Party Links and Services

Our Service may contain links to third-party websites, services, or applications. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any information.

External Services We Integrate With:

• NHTSA VIN Decoder (U.S. Government database)
• Third-party authentication providers (if you choose to use them)
• Payment processors (Stripe)

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors.

How We Notify You:

• Email notification to your registered email address for material changes
• Prominent notice on our website and mobile app
• Updated "Last Updated" date at the top of this policy

Your Continued Use: By continuing to use Carvetka after changes take effect, you accept the updated Privacy Policy.

We encourage you to review this Privacy Policy regularly to stay informed about how we protect your information.

12. Regional Privacy Rights

12.1 European Economic Area (EEA) and UK Users

If you are located in the EEA or UK, you have additional rights under GDPR:

• Right to data portability
• Right to object to processing
• Right to restrict processing
• Right to lodge a complaint with a supervisory authority

Legal Basis for Processing:

• Performance of contract (providing the Service)
• Legitimate interests (improving our services, security)
• Consent (marketing communications)

12.2 California Residents (CCPA)

California residents have the right to:

• Know what personal information is collected
• Know whether personal information is sold or disclosed
• Say no to the sale of personal information (we do not sell data)
• Access personal information
• Request deletion of personal information
• Equal service and price (no discrimination for exercising rights)

12.3 Other Jurisdictions

We respect privacy rights under applicable laws in all jurisdictions where we operate. Contact us to learn about your specific rights.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

14. Consent

By using Carvetka, you acknowledge that you have read, understood, and agree to this Privacy Policy and our Terms of Service.

For users in jurisdictions requiring explicit consent, your continued use of the Service after the effective date constitutes your consent to this Privacy Policy.