1. Data Controller

The data controller for your personal data is:

Capsule Consulting
Drvarska 12, Bačka Palanka, Serbia
Company registration number (matični broj): 67790120
Tax ID (PIB): 114705122
Email: [email protected]

2. What Data We Collect

2.1 Data you provide directly

• Account data: When you register, we collect your email address, chosen username/display name, and password (stored in hashed form).
• Communications: If you contact us via email or a contact form, we retain the content of your messages and your contact details.

2.2 Data collected automatically

• Usage data: Pages visited, features used, searches performed, listings unlocked or tracked, token usage.
• Device and technical data: IP address, browser type and version, operating system, screen resolution, referring URL.
• Cookies and similar technologies: See Section 7 (Cookie Policy) below.

2.3 Payment data

When you buy a subscription or token pack, payment is processed by Dodo Payments (our payment provider and Merchant of Record). Your card number never touches CarRadar's servers. We receive and store from Dodo Payments: your customer and transaction identifiers, the product purchased, amount and currency, billing country, and subscription status, needed to credit your wallet, manage your plan and meet bookkeeping obligations. Dodo Payments processes your payment data under its own privacy policy (dodopayments.com). Financial transaction records are retained for up to 7 years as required by accounting law, even after account deletion (in anonymized form where possible).

3. How We Use Your Data

We use the collected data for the following purposes:

• Providing the service: Creating and managing your account, tracking token usage, delivering analytics features.
• Improving the platform: Understanding how users interact with CarRadar to improve features, performance, and user experience.
• Communication: Sending service-related notifications (e.g., terms updates, account alerts). We will not send marketing emails without your explicit consent.
• Security: Detecting and preventing abuse, fraud, and unauthorized access.
• Legal compliance: Fulfilling legal obligations under applicable laws of the Republic of Serbia.

4. Legal Basis for Processing

We process your personal data on the following legal bases:

• Contract performance: Processing necessary to provide you with CarRadar's services (account management, token system, analytics access).
• Legitimate interest: Improving our platform, ensuring security, and conducting internal analytics.
• Consent: Where required, such as for optional marketing communications or non-essential cookies.
• Legal obligation: Where processing is required by law.

5. Data Sharing

We do not sell your personal data. We may share your data only in the following circumstances:

• Service providers: Trusted third-party services that help us operate the platform (e.g., hosting providers, analytics tools). These providers are contractually obligated to protect your data.
• Payment processing: Dodo Payments (Merchant of Record) receives the data needed to charge you and issue receipts/invoices.
• Analytics & advertising (with your consent): Google LLC (Google Analytics, Google Ads conversion tracking). Google may transfer data to the US under the EU-US Data Privacy Framework.
• Legal requirements: If required by law, court order, or governmental authority.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy, or as required by law. Specifically:

• Account data: Retained while your account is active; when you request deletion, personal data is removed after the 30-day cooling-off period, except financial transaction records kept up to 7 years as required by accounting law.
• Usage data: Retained in aggregated/anonymized form for analytics. Identifiable usage data is retained for a limited period.
• Communications: Retained for a reasonable period after the last exchange.
• Vehicle Analytics API: Computed results are readable for 7 days and then deleted. The billing ledger, which records how many requests a key used and when, is kept for as long as accounting law requires. See section 13.

7. Cookie Policy

CarRadar uses cookies and similar technologies to provide and improve our services.

7.1 What are cookies?

Cookies are small text files stored on your device when you visit a website. They help the site remember your preferences and understand how you use it.

7.2 Types of cookies we use

7.3 Managing cookies

You choose whether to allow analytics and advertising cookies in the consent banner shown on your first visit, and you can change your mind at any time via the "Cookie settings" link in the footer. Declining them does not limit CarRadar in any way. Essential cookies cannot be disabled because the platform cannot function without them; you can still delete them via your browser settings.

8. Your Rights

Under the Law on Personal Data Protection of the Republic of Serbia (which is aligned with the EU GDPR), you have the following rights:

• Right of access: Request a copy of your personal data.
• Right to rectification: Request correction of inaccurate data.
• Right to erasure: Request deletion of your personal data ("right to be forgotten").
• Right to restriction: Request restriction of processing in certain circumstances.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interest.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within the timeframes required by applicable law.

You also have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia (poverenik.rs).

9. International Data Transfers

Your personal account data is stored on servers within the European Union (Germany, Nuremberg). If data is transferred outside of Serbia or the EU/EEA, we ensure appropriate safeguards are in place in accordance with applicable law.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include encrypted data transmission (HTTPS/TLS), hashed passwords, access controls, and regular security reviews.

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

11. Children's Privacy

CarRadar is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will take steps to delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. For material changes affecting how we process your data, we will make reasonable efforts to notify you in advance.

13. Vehicle Analytics API

This section applies if your organisation uses our Vehicle Analytics API. It covers data sent to the API by a business customer, which is separate from the personal data we process for account holders on the website.

Our position. The vehicle descriptions you send us are not intended to contain personal data, and our Terms ask you not to include any. Provided you follow that, there is no personal data in your requests and no controller or processor relationship arises over their contents. If you nonetheless send personal data through the API, you are the controller of it and we process it on your behalf, solely to compute and return the analytics you asked for and to record the request for billing. We remain the controller of the account and billing data attached to your key.

What we store. For each request we store the vehicle attributes you sent, the resulting analytics, your own reference for the vehicle, the identifier of the key used, and the time and price of the request. We do not use the contents of your requests to profile you, to advertise to you, or to train models.

How long. Computed results are readable for 7 days and are then deleted. The billing ledger, which records how many requests a key used and when, is kept for as long as accounting law requires. API keys are stored only as a cryptographic hash and cannot be recovered by us.

Webhooks. If you supply a webhook address, we send results to it and store the address alongside the request. That address is yours to control and we only use it to deliver results for your own jobs.

AI assistants. If you connect the API to an AI assistant such as Claude, the assistant sends the requests and receives the results. Whatever you type into that assistant is also processed by the assistant's own provider under their terms and privacy policy, which we do not control. Only the vehicle data the assistant sends to our endpoint reaches us.

Where it is processed. API requests are handled on the same European infrastructure described in section 9, and are not transferred outside it by us.

If you need a data processing agreement for your own compliance, write to [email protected] and we will put one in place.

14. Contact

For any privacy-related questions or requests, please contact us at:

Capsule Consulting (CarRadar)
Drvarska 12, Bačka Palanka, Serbia
Company registration number (matični broj): 67790120
Tax ID (PIB): 114705122
Email: [email protected]
Website: carradar.app