Zovano — Privacy Policy

Effective date: 8 October 2026 Version: 1.6

Archived version. This edition of the Privacy Policy was in force from 8 to 9 October 2026. Current version.

1. Data controller

Anton Trafimuk, conducting business activity under the name Anton Trafimuk (sole proprietorship registered in CEIDG, Poland)
NIP: 5213959663 · REGON: 521472000
Address: al. Polski Walczącej 26, 00-712 Warsaw, Poland
Email: hello@carm8.app

This policy explains how we process personal data in the Zovano mobile application ("App") and on the carm8.app website, in accordance with the EU General Data Protection Regulation ("GDPR").

The Polish version of this policy is binding; the English, Russian and Ukrainian versions are translations.

2. What data we collect and why

Data	Purpose	Legal basis
Account data: account identifier and, depending on the method, data received from Google or Apple (e.g. name, email address, provider identifier; for Apple, a Hide My Email address if used), or an email address and password hash for email sign-in. Profile details, if you add them: name, phone number and profile photo. Guest mode uses a pseudonymous guest account identifier and a secret for restoring the session on the device.	Account creation, sign-in, guest mode and data syncing.	Performance of a contract (Art. 6(1)(b) GDPR).
Vehicle data (make, model, registration number, VIN, mileage)	Maintaining your digital service book	Contract performance (Art. 6(1)(b))
Service-history records (dates, costs, mileage, place, notes)	Keeping your vehicle's service history	Contract performance (Art. 6(1)(b))
Reminder dates and details (e.g. type and mileage). Notifications are scheduled locally on your device; we do not register a push notification token.	Storing reminders and scheduling local insurance, inspection and service notifications.	Performance of a contract (Art. 6(1)(b) GDPR).
Your reviews, ratings, and suggested edits	Operating the community features of the App	Contract performance (Art. 6(1)(b))
Device location (only while using the App, if you grant permission)	Showing nearby car services on the map	Consent (Art. 6(1)(a))
Email address for transactional messages (email verification and password recovery) — through Resend	Delivering messages necessary to run the service	Contract performance (Art. 6(1)(b))
Crash and error data: device model, OS and App version, stack traces and the most recent technical events before the error (e.g. App diagnostic messages with email addresses and tokens masked, network request addresses without their parameters and without request or response bodies, App state changes), as well as App launches and whether a session ended in a crash (Sentry); error reports from Expo Observe. The data is linked to a random App installation identifier stored on the device. When you report a problem in the App, we attach the diagnostic log from recent days stored on the device.	Fixing bugs and keeping the App stable	Legitimate interest (Art. 6(1)(f))
Basic technical data (IP address, request logs), including the IP address and installation identifier when the App checks for updates (EAS Update)	Security, abuse prevention, service operation, and recognising automated test traffic (see section 9)	Legitimate interest (Art. 6(1)(f))
App usage events (including guest account creation or linking, adding a car, reminder, expense or service entry, active days, the platform you were active from, and the channel you tell us you found the App through), linked to a pseudonymous account identifier — without VIN, registration number, email address or note contents. See section 9 for details and your right to object.	Measuring feature usage and improving the App (product analytics)	Legitimate interest (Art. 6(1)(f)); you may object at any time, e.g. with the “Analytics” switch — see section 9
Pre-account onboarding measurements, linked to a temporary identifier in App memory and not to an account, name or email address. The onboarding analytics event itself does not contain an IP address. Independently, standard infrastructure technical logs may contain an IP address as described in the technical data row above.	Seeing where new users get stuck during onboarding	Legitimate interest (Art. 6(1)(f)) — see section 9
Expenses, insurance details and attachments (e.g. photos, invoices, receipts and PDF documents)	Maintaining car costs, insurance and documentation.	Performance of a contract (Art. 6(1)(b) GDPR).
Illegal-content notices and correspondence: identified content, explanation, good-faith statement and supplied contact details.	Assessing notices, contacting reporters and protecting rights.	Legal obligation (Art. 6(1)(c) GDPR) where required by law; otherwise legitimate interests (Art. 6(1)(f) GDPR).

We do not sell your data, use it for advertising, or track you across other apps or websites.

Location data is used in real time to query nearby services and is not stored as a movement history.

Data on your device. The App stores sign-in tokens on your device (in the system’s secure storage), a cache of some of your data and a diagnostic log covering the last 3 days. The Sentry and Expo SDKs store random installation identifiers used in error reports, session information and update checks. Uninstalling the App removes this data.

Vehicle and service-history data is entered by you and is for your use only — we do not share it with other users.

3. Third-party services

Apple / Sign in with Apple (Apple Distribution International Ltd., Ireland) — user authentication. At first sign-in, Apple may let you share your name and email address; you may use Hide My Email. Apple Privacy Policy
Google Sign-In (Google Ireland Ltd., Ireland) — authentication. Google Privacy Policy
Google Maps (Google Ireland Ltd., Ireland) — map display in the App. When the map loads, Google receives, among other things, the device’s IP address and the map area being displayed. Google Maps/Google Earth Additional Terms
Photon (komoot GmbH, Germany) — address search based on OpenStreetMap data. Our server forwards the queries: komoot receives the address text you type and — if you have shared your location — coordinates used to narrow the results, but not your IP address or account data.
Resend (Resend, Inc., USA) — email delivery for email verification and password recovery. Resend Privacy Policy
Sentry (Functional Software, Inc., USA; data stored in the EU region — Germany) — crash and error reporting; reports include an installation identifier stored on the device by the Sentry SDK. Sentry Privacy Policy
Expo (650 Industries, Inc., USA) — error reports from the App (Expo Observe) and delivery of App updates (EAS Update); each time the App checks for an update, Expo receives the IP address and an installation identifier. Expo Privacy Policy
Railway (Railway Corp., USA; servers in the Netherlands) — server and database hosting.
Cloudflare (Cloudflare, Inc., USA) — network security and traffic routing, and storage of the documents you upload to the App and of backups (the R2 service; data held in the European Union).

Transfers outside the EEA. We keep the database, uploaded documents, backups and Sentry error reports in the European Economic Area. Some recipients, however, are based in the United States and may process or access data outside the EEA. Transfers rely on:

Expo — standard contractual clauses adopted by the European Commission (Module 2: controller to processor);
Resend and Sentry — the European Commission adequacy decision under the EU-US Data Privacy Framework, in which these providers participate, supplemented by standard contractual clauses;
Railway and Cloudflare — standard contractual clauses or the EU-US Data Privacy Framework, as set out in these providers’ data processing agreements;
Google and Apple — the mechanisms described in their privacy policies.

You can obtain a copy of the standard contractual clauses by writing to hello@carm8.app.

Data about people associated with business listings

Business listings may contain information from publicly accessible sources such as OpenStreetMap, Google and other lawfully available public sources, as well as information submitted by users.

For sole traders or other businesses operated by natural persons, some business information — such as a personal name in the business name, professional contact details or a business address — may be personal data.

We process this data to operate and update the automotive service directory and enable business searches. The basis is our legitimate interest (Art. 6(1)(f) GDPR) in maintaining a useful directory of publicly available automotive services.

Categories may include business name, proprietor or representative name, business address, professional phone number and email address, website, opening hours and other public business information.

Sources may include public websites and databases, map and place-information providers and user submissions.

We keep the data for as long as needed to maintain an up-to-date listing. Data subjects may request access, correction, deletion or restriction and object to processing as described in the rights section.

4. How long we keep data

Account, vehicle, and service-history data: until you delete it or delete your account.
Reviews and edits: until deleted by you or removed during moderation; we may keep anonymized statistics.
Crash and technical log data: up to 90 days in our systems; at the error-reporting and update providers (Sentry, Expo) — in line with those providers’ retention periods, as described in their policies.
Account-linked analytics: up to 12 months. Pre-account onboarding measurements: up to 90 days. The data is then deleted.
Email delivery logs: short-term, in line with Resend's settings.
Notices and correspondence: for as long as needed to handle the matter, fulfil legal obligations and establish, exercise or defend legal claims, within applicable legal limits.

Backups. We back up the database and the documents you upload solely to restore the service after a failure. The legal basis is our legitimate interest in being able to restore the availability of data promptly after an incident (Art. 6(1)(f) in conjunction with Art. 32(1)(c) GDPR). Backups are stored encrypted in the European Union (Cloudflare R2) and are deleted automatically: rolling database backups after 30 days, weekly copies after 180 days, and copies of documents about 30 days after the original is deleted. Until then, deleted data — including after account deletion or an objection to analytics — may remain in backups. If we restore data from a backup, we will re-apply the deletions and objections received after the backup was made that we have recorded. For this we keep, in the European Union and for 210 days — longer than the oldest backup — a record of each objection to analytics, each withdrawal of one and each account deletion request: the account identifier, the type of request and its time, nothing else.

5. Your rights

Under the GDPR you have the right to access, rectify and delete your data, to restrict processing, to data portability, to object, and to withdraw consent at any time (e.g. by disabling location or notification permissions). We respond without undue delay and within one month at the latest.

You can download a copy of your account, vehicle, service-history, reminder, expense, insurance, saved-place and analytics data yourself in the App: Profile → Privacy & security → Download my data (a JSON file). The right to data portability covers data you have provided to us that we process on the basis of a contract or consent: you will receive it in a structured, commonly used and machine-readable format and, where technically feasible, you may ask us to transmit it to another controller. We provide other data, such as uploaded documents, on request to hello@carm8.app.

Right to object (Art. 21 GDPR). On grounds relating to your particular situation, you may at any time object to the processing of your data based on our legitimate interest (Art. 6(1)(f) GDPR), e.g. technical data, crash data or data in business listings. We will then stop processing that data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or grounds for the establishment, exercise or defence of legal claims. An objection to product analytics needs no reasons and will always be honoured: the easiest way is the “Analytics” switch on the Privacy & security screen, or you can write to hello@carm8.app — see section 9.

You can delete your account directly in the App settings; this removes your personal data within 30 days, except where law requires longer retention; for backups, see section 4.

You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (PUODO, uodo.gov.pl). If you live in another country, you may also be able to complain to the data protection authority there; in Ukraine that is the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua).

Providing your data is voluntary but necessary to hold an account — without an email address and password, or a Google or Apple sign-in, we cannot create an account or sync data across devices. You can also use the App in guest mode without giving contact details. We do not take decisions about you based solely on automated processing, including profiling, that would produce legal effects or similarly significantly affect you. Withdrawing consent does not affect the lawfulness of processing carried out on its basis before the withdrawal.

6. Security

Data is transmitted over HTTPS/TLS. Access to account data in the App is protected by authentication and authorisation controls. You may request a copy of your data or delete your account as described above.

We apply appropriate technical and organisational measures to protect data. However, no information system can guarantee the complete elimination of risk.

7. Children

The App is intended for users aged 16 and over. We do not knowingly collect data from children below this age.

8. Website and cookies

The carm8.app website does not use tracking or analytics cookies. We only store your language choice in your browser's local storage (localStorage), which is necessary for the site to work properly.

The reporting form prepares text in your browser. It does not send it automatically or save its fields in the website’s local storage. We receive the data only when you email the prepared notice; your email provider processes the message under its own terms.

9. App analytics

We collect usage events to understand and improve the App. Product analytics is first-party: events go to our own database hosted by Railway. We do not use an external product analytics provider; error reporting (Sentry, Expo Observe) is described in sections 2 and 3.

For accounts, including guest accounts, we record:

account creation and sign-in method (Google, Apple or email and password);
guest account creation, linking and linking failures due to an existing account (method only, without the other account’s details);
adding a car (make and, for a car from the catalogue, model — without year, registration number or VIN);
setting a reminder (type, e.g. insurance or inspection);
adding a service entry or expense (for expenses: category);
active usage days, and the platform you were active from (iOS or Android);
where you say you found the App, if you choose to answer — one of a fixed set of options, never free text.

So that our statistics count people rather than automated tests, our server compares the IP address of each request — in memory, without storing it — with the address ranges Google publishes for its Firebase Test Lab devices, on which Google Play automatically tests new versions of the App. Requests from those ranges are handled normally, but no analytics events, onboarding measurements or active days are recorded for them.

Events are pseudonymous: linked to an account identifier without VIN, registration number, email address or note contents. We do not use interaction autocapture or session recording. We do not sell analytics data or use it for advertising or cross-app or cross-site tracking.

Legal basis. We process product analytics under our legitimate interest (Art. 6(1)(f) GDPR) in understanding App usage, identifying usability problems and making development and improvement decisions based on actual product use. The set of events and properties is limited.

Your right to object. You may object to product analytics at any time, without giving a reason. The easiest way is in the App: Profile → Privacy & security → turn off the “Analytics” switch; this also works in guest mode. From then on we do not record analytics events for your account, and we delete the events and active days recorded earlier without undue delay. You can also write to hello@carm8.app from the email address linked to your account. If you use guest mode or have not given us an email address, include your account identifier — the id field in the user section of the file downloaded with “Download my data” on the same screen. Once we have matched such an objection to your account, we will act in the same way. You do not need to close your account to object. Backups are described in section 4.

Pre-account onboarding measurements. We measure the start of onboarding, the start and progress of adding a car (including opening the make picker) and the first service (added or skipped), the registration prompt being shown, the start of registration, and time to the first entry. Depending on the step, an event may include the model source (catalogue or custom entry), sign-in method or duration; we do not record make, model, year or service type. We include platform and App version. Event times are recorded to the full hour.

These measurements are not linked to an account, name or email address. They use a temporary identifier held only in App memory, never saved on the device and lost when the App process ends. The onboarding analytics event itself does not contain an IP address. Independently, standard infrastructure technical logs may contain an IP address as described in the technical data section above.

The basis is our legitimate interest (Art. 6(1)(f) GDPR) in identifying where new users encounter difficulties. These measurements are not linked to an account or to any other data that would allow us to tell whom they concern. We are therefore unable to identify your measurements and — in line with Art. 11 GDPR — cannot locate or delete them on the basis of an objection. They are deleted automatically after 90 days (section 4).

10. Changes to this policy

We may update this policy, for example when adding features or changing providers. We will inform you of material changes — in particular new purposes of processing, new recipients of data or transfers to new countries — at least 14 days before they take effect, by email or, if we do not have your email address, by a notice in the App. Previous versions of the policy are available in the archive linked in the header.

11. Contact

Anton Trafimuk · al. Polski Walczącej 26, 00-712 Warsaw, Poland · hello@carm8.app