ZovanoZovano — Privacy Policy
Effective date: August 9, 2026 Version: 1.2 (Beta)
1. Data controller
Anton Trafimuk, conducting business activity under the name Anton Trafimuk (sole proprietorship registered in CEIDG, Poland)
NIP: 5213959663 · REGON: 521472000
Address: al. Polski Walczącej 26, 00-712 Warsaw, Poland
Email: hello@carm8.app
This policy explains how we process personal data in the Zovano mobile application ("App") and on the carm8.app website, in accordance with the EU General Data Protection Regulation ("GDPR").
2. What data we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Account data: Google account data (name, email, profile picture, Google user ID) or email address for link sign-in | Account creation and sign-in | Contract performance (Art. 6(1)(b) GDPR) |
| Vehicle data (make, model, registration number, VIN, mileage) | Maintaining your digital service book | Contract performance (Art. 6(1)(b)) |
| Service-history records (dates, costs, mileage, place, notes) | Keeping your vehicle's service history | Contract performance (Art. 6(1)(b)) |
| Renewal dates and your device push-notification token | Sending reminders (OC, inspection, service) | Contract performance (Art. 6(1)(b)) |
| Your reviews, ratings, and suggested edits | Operating the community features of the App | Contract performance (Art. 6(1)(b)) |
| Device location (only while using the App, if you grant permission) | Showing nearby car services on the map | Consent (Art. 6(1)(a)) |
| Email address for transactional messages (sign-in link, reminders) via Resend | Delivering messages necessary to run the service | Contract performance (Art. 6(1)(b)) |
| Crash and error data (device model, OS version, app version, stack traces) via Sentry | Fixing bugs and keeping the App stable | Legitimate interest (Art. 6(1)(f)) |
| Basic technical data (IP address, request logs) | Security, abuse prevention, service operation | Legitimate interest (Art. 6(1)(f)) |
| App usage events (e.g. adding a vehicle, setting a reminder, adding an expense or service record, creating and later claiming a guest account, sending you a reminder notification, days of active use) linked to your pseudonymous account identifier — without VIN, registration number, email address, or note contents. Collected first-party and stored on servers we operate in the EU, hosted by Railway (see section 3); no third-party analytics provider. | Measuring feature usage and improving the App (product analytics) | Legitimate interest (Art. 6(1)(f)); you may object at any time — see section 9 |
| Onboarding measurements taken before you create an account (e.g. starting to add a vehicle, choosing a make, entering the vehicle's make, model and year, completing the first steps), linked only to a temporary identifier held in the app's memory — not linked to any account, name, or email address, and stored without an IP address | Seeing where new users get stuck during onboarding | Legitimate interest (Art. 6(1)(f)); to object, write to hello@carm8.app — see section 9 |
We do not sell your data, use it for advertising, or track you across other apps or websites.
Location data is used in real time to query nearby services and is not stored as a movement history.
Vehicle and service-history data is entered by you and is for your use only — we do not share it with other users.
3. Third-party services
- Google Sign-In (Google Ireland Ltd.) — authentication. Google Privacy Policy
- Google Maps / Places (Google Ireland Ltd.) — map display and address search; your queries and approximate location may be processed by Google. Google Maps/Google Earth Additional Terms
- Resend (Resend, Inc., USA) — sending emails (sign-in link, reminders). Resend Privacy Policy
- Sentry (Functional Software, Inc.) — crash and error reporting. Sentry Privacy Policy
- Railway (Railway Corp.) — server and database hosting.
- Cloudflare (Cloudflare, Inc.) — network security and traffic routing.
Some providers (including Resend, Railway, Cloudflare, Sentry) may process data outside the European Economic Area; in such cases transfers rely on EU Standard Contractual Clauses (SCCs) or adequacy decisions.
Business listing information shown in the App (names, addresses, opening hours) comes from public sources (OpenStreetMap, Google) and concerns businesses, not App users.
4. How long we keep data
- Account, vehicle, and service-history data: until you delete it or delete your account.
- Reviews and edits: until deleted by you or removed during moderation; we may keep anonymized statistics.
- Crash and technical log data: up to 90 days.
- Analytics data — both signed-in usage events and anonymous onboarding measurements: up to 12 months, after which it is deleted or anonymized into aggregate statistics.
- Email delivery logs: short-term, in line with Resend's settings.
5. Your rights
Under the GDPR you have the right to access, rectify, delete, or receive a copy of your data, restrict or object to processing, and withdraw consent at any time (e.g. by disabling location or notification permissions). You can object to product analytics directly in the App using the "Analytics" toggle on the Privacy screen — see section 9. Contact us at hello@carm8.app — we respond without undue delay and within one month at the latest.
You can delete your account directly in the App settings; this removes your personal data within 30 days, except where law requires longer retention.
You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (PUODO, uodo.gov.pl).
6. Security
Data is transmitted over HTTPS/TLS, stored in access-controlled databases, and protected by authentication on all administrative access. You can export or delete your service history at any time. The App is in beta; despite our safeguards, no system is 100% secure.
7. Children
The App is intended for users aged 16 and over. We do not knowingly collect data from children below this age.
8. Website and cookies
The carm8.app website does not use tracking or analytics cookies. We only store your language choice in your browser's local storage (localStorage), which is necessary for the site to work properly.
9. App analytics
To understand how you use the App and which features need improvement, we collect usage events (product analytics). This analytics is first-party: events are sent to servers we operate in the European Union, hosted by Railway (see section 3), and stored in our own database. We do not use any third-party analytics provider.
For signed-in users we record:
- account creation and sign-in method (Google or email link),
- creating a guest account, and later claiming it,
- adding a vehicle (make, model, year — without registration number or VIN),
- setting a reminder (type, e.g. OC or inspection),
- adding a service record or expense (category),
- sending you a reminder notification (type),
- days on which you actively use the App (a retention signal).
These events carry no other properties. Figures such as your number of vehicles, or whether you have set an OC date, are calculated when we run a report — they are not stored on the events.
Events are pseudonymous. They are linked to your account identifier and do not contain your VIN, registration number, email address, or note contents. We do not use interaction autocapture or session recording — we log only the specific, deliberate events listed above. We do not sell analytics data, use it for advertising, or track you across other apps or websites.
Legal basis. We process this product analytics on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in understanding how a beta product is used, so that we direct development at real friction points and make the App fit for general release. The processing is limited to the closed list of events above, pseudonymous, and stays on our own EU servers.
Your right to object. You have the right to object to this processing at any time. You do not need to give a reason: turn analytics off in the App on the Privacy screen (the "Analytics" toggle), and we stop recording your usage events. The setting is synced to the server, so it also covers events sent server-side (e.g. sending reminders).
Onboarding measurement before you have an account. Before you create an account, we measure the onboarding flow (e.g. starting to add a car, choosing a make, entering the vehicle's make, model and year, completing the first steps) to see where new users get stuck. These measurements are not linked to any account, name, or email address, and we do not store an IP address with them — only a temporary identifier held in the app's memory, never saved to your device, that disappears when the app closes. We attach the platform (iOS/Android) and app version. We rely on our legitimate interest (Art. 6(1)(f) GDPR) in understanding where new users get stuck. Because these measurements are not linked to an account, the Analytics toggle above cannot cover them; to object, contact us at hello@carm8.app.
10. Changes to this policy
We may update this policy (e.g. when adding features). Material changes will be announced in the App or by email at least 14 days in advance. The current version is always available at carm8.app/privacy.
11. Contact
Anton Trafimuk · al. Polski Walczącej 26, 00-712 Warsaw, Poland · hello@carm8.app