Privacy Policy

1. Data controller

• Controller: CarAI
• Tax ID: 45128313J
• Address: Calle Príncipe de Vergara 109, Madrid, Spain
• Privacy contact: support@joincarai.com
• DPO: No Data Protection Officer has been appointed, as one is not required under art. 37 GDPR for this processing activity.

We process your data in accordance with Regulation (EU) 2016/679 (GDPR) and applicable national data protection law.

2. Data we process

• Account data: name, email address, password (encrypted) and preferences.
• Collection content: vehicles, makes, models, values, notes and photos you add.
• CarAI Vision images: photos you capture or upload to identify vehicles (see section 4).
• Usage and device data: device identifiers, operating system, language, usage events, logs, IP address and diagnostic/performance data.
• Transaction data: payments are processed by Apple App Store or Google Play; we receive only subscription status confirmation, not your card number.
• Communications: messages you send us (support, contact forms).

3. Purposes and legal bases

• Providing the Service (account creation, portfolio management, alerts and dossiers) — legal basis: performance of a contract.
• Managing subscriptions and payments — legal basis: performance of a contract and legal obligation (invoicing).
• Support and communication — legal basis: performance of a contract and legitimate interest.
• Improving and securing the app (analytics, fraud prevention, error debugging) — legal basis: legitimate interest.
• Commercial communications about CarAI, if you opt in — legal basis: consent, withdrawable at any time.
• Complying with legal obligations — legal basis: legal obligation.

4. CarAI Vision and images

When you use CarAI Vision, the image is sent to the Google LLC (Gemini) API, acting as a data processor under a Data Processing Amendment. Google processes the image solely to identify the vehicle; the result is returned to CarAI and the image is stored linked to your vehicle in your garage within the Supabase platform while your account is active.

Unless you give explicit consent, we do not use your images to train our own models or share them for commercial purposes. Since photos may capture licence plates or other people in the background, we recommend framing the vehicle and minimising the capture of third-party data.

5. Recipients and data processors

We do not sell your personal data. We may share it with providers who deliver services to us under a data processing agreement (art. 28 GDPR), for example:

• Database, storage and authentication — Supabase Inc. (infrastructure on Amazon Web Services).
• Artificial intelligence (CarAI Vision) — Google LLC (Gemini API).
• Authentication emails — Supabase Auth (verification and password-recovery emails).
• Subscription and paywall management — RevenueCat Inc. (intermediary between the app and the stores; receives subscription status and identifiers needed to manage access).
• Payment processing — Apple Inc. (App Store) and Google LLC (Google Play); the actual charge is handled by the respective store.

We may also share data with authorities when required by law.

6. International transfers

Some providers operate or transfer data outside the European Economic Area, primarily to the United States. The safeguards applied are:

• Google LLC — Standard Contractual Clauses (SCCs) approved by the European Commission, pursuant to art. 46(2)(c) GDPR.
• Supabase Inc. / Amazon Web Services — SCCs together with additional technical measures (encryption and access controls).
• RevenueCat Inc. — SCCs pursuant to art. 46(2)(c) GDPR for the transfer of subscription data to its US servers.

You may request further information or a copy of the safeguards by writing to support@joincarai.com.

7. Retention periods

We keep your data while your account is active and, after closure, for the legally required periods (e.g. tax and accounting obligations) or the time needed to address potential liabilities. Data is then deleted or anonymised. Data processed on the basis of your consent is kept until you withdraw it.

8. Your rights

You may exercise at any time your rights of access, rectification, erasure, objection, restriction of processing and data portability, as well as withdraw any consent given, by writing to support@joincarai.com. We may ask you to verify your identity. You also have the right to lodge a complaint with your local supervisory authority or the Spanish Data Protection Agency (www.aepd.es) if you believe the processing does not comply with applicable law.

9. Security

We apply appropriate technical and organisational measures to protect your data (including encryption in transit, access controls and data minimisation). No system is infallible; in the event of a security breach affecting your rights, we will act in accordance with arts. 33 and 34 GDPR.

10. Minors

The Service is intended for persons aged 18 or over and we do not knowingly collect data from minors. If we discover that such data has been provided, we will delete it.

11. Cookies and similar technologies

This website uses only technically necessary cookies and similar technologies to function. It loads the Inter typeface from Google Fonts, which establishes a connection to Google's servers that may log your IP address. The mobile app may use identifiers for analytics and diagnostics as described above.

12. Changes to this policy

We may update this Policy to reflect legal or Service changes. We will publish the current version on this page with its date and, where changes are material, notify you by reasonable means.

13. Contact

For any privacy-related question, write to us at support@joincarai.com.