Privacy Policy

Car Manager is a fleet management application that helps individuals and small businesses track vehicles, fuel and maintenance expenses, shifts, and service providers. The App is operated by Sergii Solonyna, a private entrepreneur (FOP) registered in Ukraine, acting as the data controller ("the Operator").

Contact: support@carmanager.cc

We use the information to:

• Operate the App, authenticate you, and keep your data in sync across devices.
• Generate reports on your expenses, maintenance schedule, and shift history.
• Send transactional emails (email verification, invitations, billing receipts).
• Send occasional service and plan-related emails about your organization's account — for example, when the organization reaches the limits of its current plan, and how to upgrade.
• Detect, prevent and debug technical issues and abuse.
• Process subscription payments via Paddle, or via Apple In-App Purchase for family plans bought in the iOS app.
• Comply with legal obligations.

We do not sell your personal data. We do not use your data for advertising.

• Contract: to provide the service you signed up for.
• Legitimate interest: to keep the service safe, debug issues, and prevent abuse — this covers crash and error reporting through Sentry, which does not depend on your consent.
• Legitimate interest (direct marketing to existing users): to send you occasional plan-related emails about the service you already use. Every such email contains a free unsubscribe link; the opt-out is recorded for your user account and stops these emails for every organization you belong to.
• Consent: for optional features such as Bluetooth OBD scanning, precise location, address suggestions (Google Maps) and usage analytics (Microsoft Clarity).
• Legal obligation: to retain billing records and respond to lawful requests.

We share information only with:

• Paddle — payment processing (Merchant of Record; calculates and remits sales tax/VAT/GST).
• Apple — In-App Purchase processing for family-plan subscriptions bought in the iOS app (Apple is the merchant; we receive App Store transaction identifiers and subscription status, never payment details).
• Authentication — handled by self-hosted Better Auth; credentials and session data are stored in our own database, not shared with a third-party authentication service.
• Sentry — crash and error reporting (always on; legitimate interest).
• Microsoft (Clarity) — session recordings and heatmaps that help us understand how the product is used. Microsoft is an independent controller of this data and may use it for its own purposes, including advertising, as described in the Microsoft Privacy Statement.
• Google — when you choose Google Sign-In, and, if you allow address suggestions, Google Maps Places autocomplete: what you type in an address field, a session identifier and your IP address are sent to Google, which is an independent controller of that data under the Google Privacy Policy.
• Geocoding services — when you tap “use my location”, your coordinates are sent to a mapping service solely to convert them into an address: Google Geocoding on the web, your device's own map provider on mobile (Apple on iOS, Google on Android), only if you allow address suggestions, and OpenStreetMap's Nominatim for the coarse country lookup. Neither we nor they keep them as part of your account.
• DeepL — when you publish a service or maintenance template, its name and description are sent for automatic translation into the languages we support.
• Cloud hosting — our database, backend and web application are hosted on cloud infrastructure located in the European Union. Our network edge derives your country from your IP address (nothing else is sent anywhere for this) so we can preselect it when you sign up and decide whether to show you the consent banner.
• Law enforcement — when required by valid legal process.

We do not sell your data. Except for Microsoft Clarity as described above, we do not share data with advertisers, data brokers, or analytics resellers.

Your data is hosted on servers located in the European Union. Because the Operator is established in Ukraine, your personal data is accessed from Ukraine for the purpose of operating and maintaining the App, under appropriate safeguards (Standard Contractual Clauses).

Certain service providers may process limited data outside the EU: Paddle (payment processing), Apple (In-App Purchase) and Google (Sign-In and Maps Places) may process data in the United States under Standard Contractual Clauses and/or the EU–US Data Privacy Framework; Sentry (crash reporting) may process data outside the EU under equivalent safeguards. Microsoft (Clarity) processes data in the United States; for users in the EU the contracting entity is Microsoft Ireland Operations Limited, and transfers rely on Standard Contractual Clauses and/or the EU–US Data Privacy Framework.

Where data is transferred outside the EU, we rely on the safeguards offered by these providers under the applicable transfer mechanisms.

• Account data is retained while your account is active. When you request deletion, your account enters a 90-day retention window during which you can cancel; at the end of that window your personal data is anonymised. See Account Deletion for the full procedure. Billing records are retained for 7 years to comply with tax obligations.
• Sentry crash and error events are retained for 90 days.
• Clarity session recordings are kept by Microsoft for 30 days; recordings we mark as favourites and a small random sample that Microsoft retains are kept for up to 9 months, as are heatmap aggregates. Microsoft does not support deleting one person's Clarity data individually — only an entire project.
• Activity logs are retained for 12 months.
• The Android install referrer is stored with your account and deleted when the account is deleted; only an anonymous per-source monthly counter remains.

You may at any time:

• Access the personal data we hold about you — via the Profile screen or by emailing us.
• Correct inaccurate data — directly in the App.
• Delete your account — Profile → Delete account. Deletion begins a 90-day retention window (during which you can cancel by signing in again); your personal data is anonymised at the end of that window.
• Export your data — request via email; we will return a JSON archive within 30 days.
• Data held by Google or Microsoft (address suggestions, Clarity recordings) is processed by them as independent controllers; requests about that data go to them directly — we keep no copy of your address searches; only the address you save with an expense or a service provider is stored in your account (Section 2.1).
• Object or restrict processing — by email.
• Lodge a complaint with your data protection authority. In Ukraine this is the Ukrainian Parliament Commissioner for Human Rights (Уповноважений Верховної Ради України з прав людини); EU residents may complain to their national supervisory authority.

• HTTPS for all network traffic, with TLS certificates issued by Let's Encrypt.
• Passwords hashed with scrypt (Better Auth default parameters); session tokens stored in iOS Keychain / Android Keystore.
• Access to the production database is restricted to the Operator over SSH key authentication.
• Vulnerability reports may be sent to support@carmanager.cc.

The App is not directed at children under 18 (or the higher minimum age required by your local law), and we do not knowingly collect personal data from them. If you believe a child has provided us data, contact us and we will delete it.

If you are a resident of California or another US state with a comprehensive privacy law, you have the right to know what personal information we collect, to access and delete it, and to opt out of its sale or sharing for targeted advertising. We do not sell your personal information. If you opt in to the Analytics category, Microsoft Clarity may use the collected usage data for its own purposes, including advertising, as described in Section 5; withdrawing that consent via the Cookie settings control, or Profile → Privacy settings (app), stops this sharing. To exercise any of these rights, email us at support@carmanager.cc. We will not discriminate against you for exercising them.

We may update this policy. Material changes will be announced inside the App and by email. The "Last updated" date at the top reflects the current version.

For privacy questions, data requests, or to exercise your rights:

Email: support@carmanager.cc

We use cookies and similar technologies (such as browser localStorage) organized into three categories. Optional categories are off by default and are only activated if you opt in through the cookie consent banner (web) or the privacy sheet (app) shown on your first visit in the EU/EEA, the UK, Switzerland and Ukraine; elsewhere they are on by default and can be turned off at any time.

• Strictly necessary (always on): your authentication session, the record of your cookie consent choice, and basic UI preferences.
• Functional (opt-in, off by default): Google Maps address suggestions (web and app), including “use my location”.
• Analytics (opt-in, off by default): Microsoft Clarity session recordings and heatmaps.

The consent banner is shown to visitors in the EU/EEA, UK, Switzerland and Ukraine; the mobile app shows the equivalent privacy sheet in the same regions. You can change or withdraw your consent at any time via the Cookie settings control: Cookie settings, or Profile → Privacy settings (app).