Mycarro ("we", "us") is committed to protecting your personal data and respecting your privacy. This policy explains what we collect, why, how we use it, and the rights you have under the EU General Data Protection Regulation (GDPR) and the data-protection law of Portugal.
Who we are
The data controller is Mycarro, operator of the Mycarro platform. For any privacy question or to exercise your rights, contact us at [email protected].
What we collect
- Account data — when you create an account we use our authentication provider (Clerk) to store your email address, name, and basic profile details, and to keep you signed in.
- Usage data — the searches you save, vehicles you favourite, and valuations you request, so we can show them back to you across sessions.
- Enquiry data — when you contact us or a dealer through the site, the name, email, phone number, and message you submit.
- Technical and log data — IP address, device and browser type, and pages viewed, collected automatically to run and secure the service.
- Listing data — details of vehicles on sale that we index from public websites, which can include a business seller's published contact details. A private seller's name and contact details are kept only as a pseudonymous code. Our data removal page, listed under Help, explains how and why we do this and how to ask us to remove it.
- Crash diagnostics — if the site errors, we send a technical crash report to our error-monitoring provider (Sentry). This is crash-only: we do not attach your identity, do not record your session, and do not send personal details in these reports.
- Analytics — we measure aggregate, anonymous usage with a privacy-friendly, cookieless analytics tool (Plausible). It does not track you across sites and does not build a personal profile.
Cookies and third-party content
We use only strictly necessary cookies to sign you in and keep the site working; our analytics is cookieless. Some pages can embed videos from YouTube (Google), which are loaded only after you consent. Until you consent, they are not requested and Google sets nothing on your device. Maps are drawn from OpenStreetMap data served by OpenFreeMap, which sets no cookies and keeps no IP addresses in its logs. You can change your choice at any time from the privacy controls in the site footer.
Why we use your data (legal bases)
- Performance of a contract — to provide your account and the services you ask for (GDPR Art. 6(1)(b)).
- Legitimate interests — to secure the service, prevent fraud and abuse, and improve the product, balanced against your rights (Art. 6(1)(f)).
- Consent — to load optional third-party embeds and any other non-essential feature; you may withdraw consent at any time (Art. 6(1)(a)).
- Legal obligation — where we must retain or disclose data to comply with the law (Art. 6(1)(c)).
Who we share it with
We do not sell your personal data. We share it only with service providers acting on our behalf under data-processing agreements: our authentication provider (Clerk), error-monitoring provider (Sentry), analytics provider (Plausible), consent-gated content providers (Google), and our hosting and content-delivery providers (Cloudflare, Hetzner, hosted in the EU). We may also disclose data where required by law.
International transfers
Some providers may process data outside the European Economic Area. Where they do, the transfer is protected by an adequacy decision or the European Commission's Standard Contractual Clauses.
How long we keep it
We keep personal data only as long as needed for the purpose it was collected: account data for as long as your account is active, enquiry data for as long as needed to handle your request, and technical logs for a limited period. When no longer needed, data is deleted or anonymised.
Your rights
Under the GDPR you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time (without affecting processing already carried out). To exercise any of these, contact us at [email protected].
If you believe we have not handled your data lawfully, you have the right to lodge a complaint with the supervisory authority in Portugal, Comissão Nacional de Proteção de Dados (CNPD).
Children
Mycarro is not directed at children and is not intended for anyone under 18. We do not knowingly collect their data.
Changes to this policy
We may update this policy from time to time. Material changes will be reflected here with a new "last updated" date.
Contact
For any question about this policy or your personal data, contact [email protected].