Zovano — Privacy Policy

Publication date: 13 November 2026
Effective date: 26 November 2026
Version: 1.16
Previous versions: version 1.15, in force from 25 November 2026 to 25 November 2026, version 1.14, in force from 23 November 2026 to 24 November 2026, version 1.13, in force from 2 November 2026 to 22 November 2026, version 1.12, in force from 2 November 2026 to 2 November 2026, version 1.11, in force from 30 October 2026 to 2 November 2026, version 1.10, in force from 29 October 2026 to 29 October 2026, version 1.9, in force from 28 October 2026 to 28 October 2026, version 1.8, in force 11–27 October 2026, version 1.7, in force 9–11 October 2026, version 1.6, in force 8–9 October 2026, version 1.5, in force 7–8 October 2026, version 1.2, in force until 6 October 2026

1. Data controller

Anton Trafimuk, conducting business activity under the name Anton Trafimuk (sole proprietorship registered in CEIDG, Poland)
NIP: 5213959663 · REGON: 521472000
Address: al. Polski Walczącej 26, 00-712 Warsaw, Poland
Email: privacy@carm8.app

You may also send data requests to support@carm8.app, legal@carm8.app or hello@carm8.app — they reach the same mailbox and we handle them in the same way.

This policy explains how we process personal data in the Zovano mobile application ("App") and on the carm8.app website, in accordance with the EU General Data Protection Regulation ("GDPR"). If you live in Switzerland, we also process your data in accordance with the Swiss Federal Act on Data Protection (FADP), and if you live in Moldova, we also apply Law No. 195/2024 of the Republic of Moldova on personal data protection. For you, references in this policy to GDPR articles also cover the corresponding provisions of those laws.

The Polish version of this policy is binding; the English, Russian, Ukrainian, German, French, Italian and Spanish versions are translations.

2. What data we collect and why

We do not sell your data, use it for advertising, or track you across other apps or websites.

Location data is used in real time to query nearby services and narrow address search results, and is not stored as a movement history. The exception is Smart Actions, if you turn it on: the App then keeps on your device, for a limited time, which public fuel stations and car services you have probably stopped at — without routes or GPS points (see “Smart Actions” below).

Data on your device. The App stores sign-in tokens on your device (in the system’s secure storage), a cache of some of your data and a diagnostic log covering the last 3 days. The Sentry and Expo SDKs store random installation identifiers used in error reports, session information and update checks. Uninstalling the App removes this data, except that on iPhone and iPad, entries in the system’s secure storage (sign-in tokens and the device token) may remain after the App is uninstalled; they are deleted when you delete your account in the App on that device or when you reset the device to factory settings. The device token (see above) stays on the device after you sign out, so that we recognise your device the next time you sign in. It is deleted when you delete your account in the App on that device; if the account is deleted in another way, the token stays on the device but is no longer linked to any account. If you turn on Smart Actions, the App also stores the data described below on your device. Once you open the purchase screen or the “Support Zovano” screen or press “Restore purchases”, or once the store reports a purchase for your account, the RevenueCat SDK also stores on your device your billing identifier and a cache of your purchase status and of the products on sale; this data is included in your phone’s backups. When you sign out or delete your account, the App stops sending requests to RevenueCat; until you close the App, the RevenueCat SDK may still refresh your purchase status in the background under your billing identifier. From the next start of the App nothing is sent to RevenueCat until an account that has opened a purchase screen signs in. Your billing identifier and purchase status stay on the device until another account opens a purchase screen on it or until you uninstall the App.

Vehicle and service-history data is entered by you and is for your use only — we do not share it with other users.

Smart Actions (background location)

Smart Actions is an optional feature and is off by default. When you turn it on, the App notices on your phone that you have probably stopped at a fuel station or car service by car and driven away, and suggests adding the expense with the place and date filled in — in the App and, if you allow notifications, with a notification on your device. We make at most one fuel suggestion and one service suggestion a day. You always decide whether to save the expense. The notification names the place; depending on your phone’s settings, it can be visible on the lock screen without unlocking the phone — you can hide notification previews in the system settings. The feature is available to anyone who may use the App (aged 16 or over, see section 7), including with a guest account.

• Permissions. The feature needs precise location access “Always” (on Android: “Allow all the time”), including when the App is closed or not in use. Without background access or precise location, the feature is paused and the App does not notice visits, even while it is open. Notifications are optional.
• What happens on your phone. The App registers zones (geofences) with the operating system around nearby fuel stations and car services from a public catalogue. When the phone enters or leaves such a zone, the system wakes the App, which may read your precise location for a short time to check whether the car stopped on the premises and drove away. Recognising the visit, matching the stop to a place and deciding on a suggestion happen only on the device. Location points stay in the device’s memory only until they are processed; we do not store routes, GPS points or the position of the stop.
• What reaches our server. To know where nearby stations and services are, the App downloads the public place catalogue (from OpenStreetMap data) from our server for map squares of about 1.5 km — the one you are in and the neighbouring ones. These requests carry no sign-in token and no account identifier; like every request, they reach us with an IP address and a time (see “Basic technical data” above). Coordinates, routes, stops and visits are not sent. A visited place reaches our server only if you save an expense with that place yourself.
• What is stored on your phone. While you use the feature, the App stores on your device: suggestions with the names and identifiers of nearby catalogue places (an open one for up to 24 hours after you left, and for about 48 hours after it is closed, so the same visit does not come back); the places for which you chose “Don’t suggest for this place”, and your “I wasn’t there” answers; the detection state — open visits (place identifiers and times, without coordinates) until they are decided, at most 10 hours, and the times of visits to each place over the last 14 days, so that no service suggestion is made where you park every day; a copy of the place catalogue for the downloaded squares, for up to 48 hours; the registered zones — circles around catalogue places and one zone around your area that is used to refresh the zones. The centre of that zone is the grid cell of about 500 m that you are in. This data is included in your phone’s backups (for example iCloud, a computer or Android backup) and is kept there according to that backup’s settings. We do not send this data to our server. When you turn the feature off, the App deletes the suggestions, hidden places and detection data, and keeps only your choice to keep the feature off until you sign out. When you sign out, it deletes the rest.
• Turning it off. You can turn the feature off at any time in Profile → Smart Actions, or withdraw the location or notification permission in the system settings. When the feature is turned off, the App deletes the suggestions, hidden places and detection data described above and cancels scheduled notifications; it keeps only your choice to keep the feature off until you sign out.
• Analytics. Section 9 describes the usage events of this feature.

Document recognition (scans of receipts and other car documents)

Document recognition is optional. Where the App offers it, including in guest mode, you can photograph a receipt, an invoice or another car document — for example a receipt or invoice for fuel, a car service, parking, tolls or leasing, a vehicle tax notice, an insurance policy or an inspection certificate — or choose a PDF of one (up to 5 pages and 5 MB). You can also scan a registration certificate or a driving licence; it is read in the same way. We read each document automatically. For now, we propose an entry only from fuel, EV-charging or car-service items on the document. A document with none of these is rejected, and you can enter its details by hand. When a scan is recognised, the App may also suggest a reminder: for an oil change, based on a service on the document, or for an inspection or third-party liability insurance, based on your car’s details. The proposal is saved only after you check it, correct it if needed and confirm it.

What we send and to whom. The file goes to our server. Before we keep it or send it on, we remove the photo’s metadata (including the location where it was taken) and a PDF’s document properties; photos embedded in a PDF keep their own metadata, which may include location. We then send the file to Google Cloud, which reads it for us in the European Union with its Gemini models (Gemini Enterprise Agent Platform, formerly Vertex AI). Google receives only the file and our instructions. We send nothing else about you: not your account identifier, the details of your cars from the App or your country. Google sees only what is printed on the document itself, which may include a registration number, a VIN, your name, address or PESEL number, or your photo (for example on a driving licence).

Google acts as our processor. It does not use the file to train its models and does not keep it after reading it. The only exception: if Google’s automated safety systems flag a request as possible abuse, Google may keep it in the European Union for up to 90 days so that its staff can review it. Those staff may be outside the European Economic Area (see section 3).

Checks. We check the result before showing it to you: whether the amounts add up, whether the date and unit price are plausible, whether the fuel type, registration number, VIN and mileage match your cars, and whether you have already recorded a similar expense. We match the seller to a place in our public place catalogue. Rejecting a scan or applying a limit only means you enter the details by hand; it has no legal or similarly significant effect on you.

What we keep. We keep each scan together with its recognition attempts, as listed in the table above. We use this data to show you the result, measure and fix recognition errors, handle complaints, reject a document that has already been scanned and limit the number of scans per day and month. We delete the model’s answer 90 days after the attempt. For a saved scan, the scan data and its attempts, including the fingerprint and what you confirmed and corrected, are kept as long as at least one entry created from it exists, even after the image is deleted. Once you delete those entries, the scan or your account, they are deleted within the periods in section 4.

The image after you save. With Pro, the image is kept as an attachment of the entry you saved, within the attachment limits. If the image does not fit within the attachment limits, it is handled as if you did not have Pro. Without Pro, we delete the image right after you save the entry, unless you have agreed to keeping scans for training (below). A scan you do not save is deleted 7 days after you upload it, or earlier if you dismiss it. Deleted images may remain in encrypted backups for the periods in section 4.

Fines are not supported. Document recognition is not designed for fines, penalty charges for unpaid parking or tolls, invoices that pass the amount of a fine on to you (for example from a leasing or rental company) or other documents about offences, and we do not use what is read from them. If you scan one, it is handled like any other scan until the model recognises what it is: we send it to Google and, once the model identifies it as such a document or finds a line for a fine on it, we reject the scan, immediately erase what the model read and delete the image. We keep only a technical record of the scan without its content (the file’s hash, the file name if the App sent one, its status, the model used, the cost and timestamps). After 7 days it is deleted like other unsaved scans, but its record stays for a further 32 days so that it still counts towards the scan limits, and is then deleted permanently. If Google’s safety systems flag the request, Google may keep it as described above. For backups, see section 4.

Keeping scans for training (optional). After your first saved scan, the App asks once whether we may keep your scans to train and test our own recognition model in the future. It is not part of the Terms of Service and stays off unless you agree. If you refuse, nothing in the App changes. If you agree, we keep the images of the scans you save from then on, together with your corrections. We do not keep documents recognised as insurance policies, vehicle tax notices or vehicle and driver documents, such as a registration certificate or a driving licence, for training. If one is not recognised as such, we remove other people’s data from it or leave it out before any training. Without Pro, these images are kept but not shown in the App. Images kept as attachments of your entries are not used for training. We keep them until you withdraw consent or delete the entry, the scan or your account, but never longer than 24 months after upload. We record when you agreed and which version of the consent text you saw. We do not use these scans for anything else or give them to anyone other than our hosting providers, and have not yet trained any model on them; before we start training, we will update this policy. You can withdraw consent at any time in the App (Profile → Account and security) as easily as you gave it. We then immediately stop using and delete the images we kept only for this purpose (if a deletion fails, we retry it automatically); your corrections stay with the scan data as described above.

Your right to object. You may object (Art. 21 GDPR) to our processing of your recognition attempts based on our legitimate interest by writing to privacy@carm8.app. We will then stop keeping your attempts for measuring and fixing recognition errors. We will consider an objection to keeping the document fingerprint and the count of your scans. However, rejecting duplicate scans and applying the scan limits, which protect the service against abuse, are as a rule compelling legitimate grounds that override your interests, rights and freedoms. This data is deleted within the periods in section 4.

Analytics. Document recognition adds no usage events to the analytics described in section 9.

Data about other people on scanned documents

A scanned document may show data about people other than the user who scans it: the name, address and tax number of a seller or issuer who is a natural person, such as someone running a fuel station or garage; the name, address and tax number of a buyer named on an invoice, if that is not the user; the policyholder, co-owners or other people named on an insurance policy, with their address and identification number (such as a Polish PESEL number), if that is not the user; the taxpayer or co-owners named on a vehicle tax notice, with their address and PESEL number or tax number; the owner, holder or anyone else named on a registration certificate, driving licence or similar document, with their identification details (such as their address or PESEL number), if that is not the user; a cashier’s name; and payment-card or loyalty-card details. The source of this data is the document the user scans.

All of it reaches Google Cloud as part of the file and remains on the image, for the purposes and periods described in “Document recognition”. We read the seller’s name, address and tax number from the document. We keep them in the recognition attempt, include the tax number in the document’s fingerprint, and use them to match the seller to a place in our catalogue (see “Data about people associated with business listings”) and to reject a document that has already been scanned. The seller’s name may appear in the user’s entry. We do not ask the model for the name, address or identification number of buyers, policyholders, co-owners, taxpayers, or owners and holders named on vehicle and driver documents, for cashiers’ names or for payment-card or loyalty-card details. We only count the payment lines on a receipt and never copy their text. These details stay only on the image. The document’s own details, such as a policy number, dates, a registration number, VIN and mileage, are read and may relate to these people. If the model misreads a document, a free-text field, such as the text of a line or the seller’s name, may pick up another person’s name. Documents recognised as insurance policies, vehicle tax notices or vehicle and driver documents, such as a registration certificate or driving licence, are not kept for training; before any future training or testing, we will remove such data from other images or leave the scan out.

The basis is legitimate interest (Art. 6(1)(f) GDPR): the user’s interest in recording their own car costs from the document that proves them, and our interest in fixing recognition errors, rejecting duplicate scans and, where the user has consented, keeping scans to develop our recognition model.

We do not inform these people individually. We do not extract the identities of buyers, policyholders, co-owners, taxpayers, owners and holders named on vehicle and driver documents, or cashiers. Informing them would require us to read and keep their names and addresses, which we otherwise do not do, and would involve disproportionate effort (Art. 14(5)(b) GDPR). Contacting every seller whose receipt a user scans would also involve disproportionate effort, given the limited impact on sellers, who print this data on their own receipts and invoices. This section is our notice to them. They have the rights described in section 5, including the right to object, and can contact us at privacy@carm8.app; to help us find the document, they can give the seller, date and receipt, invoice or policy number.

3. Third-party services

• Apple / Sign in with Apple (Apple Distribution International Ltd., Ireland) — user authentication. At first sign-in, Apple may let you share your name and email address; you may use Hide My Email. Apple Privacy Policy
• Google Sign-In (Google Ireland Ltd., Ireland) — authentication. Google Privacy Policy
• Google Maps (Google Ireland Ltd., Ireland) — map display in the App. When the map loads, Google receives, among other things, the device’s IP address and the map area being displayed. Google Maps/Google Earth Additional Terms
• Photon (komoot GmbH, Germany) — address search based on OpenStreetMap data. Our server forwards the queries: komoot receives the address text you type and — if you have shared your location — coordinates used to narrow the results, but not your IP address or account data. komoot Privacy Policy
• Resend (Resend, Inc., USA) — email delivery for email verification and password recovery. Resend Privacy Policy
• Sentry (Functional Software, Inc., USA; data stored in the EU region — Germany) — crash and error reporting; reports include an installation identifier stored on the device by the Sentry SDK. Sentry Privacy Policy
• Expo (650 Industries, Inc., USA) — delivery of App updates (EAS Update); each time the App checks for an update, Expo receives the IP address and an installation identifier. App versions earlier than 1.3.0 also send error reports to Expo (Expo Observe) until they are updated. Expo Privacy Policy
• RevenueCat (RevenueCat, Inc., USA) — handling of in-app purchases on our behalf: it checks App Store and Google Play purchases and tells our server whether your account has Pro. RevenueCat receives your billing identifier, the App Store receipt or Google Play purchase token with the product, price, currency and store country, the device type, the operating-system, App and SDK versions, language settings, on iPhone and iPad the IDFV (identifier for vendor) — a device identifier that iOS gives to all apps of one developer on that device, which the RevenueCat SDK sends with every request — and the IP address of the connection, from which RevenueCat keeps only the country. It does not receive your name, email address, precise location, car data or advertising identifiers; on Android it receives no device identifier. RevenueCat Privacy Policy
• App Store (Apple Distribution International Ltd., Ireland) and Google Play (Google; payments by Google’s payment entities as described in the Google Payments Privacy Notice) — payment for purchases in the App. Apple and Google process the payment and your store account as independent controllers, under their own terms and privacy policies.
• Railway (Railway Corp., USA; servers in the Netherlands) — server and database hosting.
• Cloudflare (Cloudflare, Inc., USA) — network security and traffic routing, and storage of the documents you upload to the App and of backups (the R2 service; data held in the European Union).
• Google Cloud (Google Cloud Poland Sp. z o.o., Poland, together with Google LLC, USA, and Google LLC’s affiliates) — reading the documents you scan (Gemini models on Gemini Enterprise Agent Platform — formerly Vertex AI — with processing in the European Union), as our processor under the Cloud Data Processing Addendum. Google receives only the file and our instructions. See “Document recognition” in section 2. Cloud Data Processing Addendum

Transfers outside the EEA. We keep the database, uploaded documents, backups and Sentry error reports in the European Economic Area. Some recipients, however, are based in the United States and may process or access data outside the EEA. Transfers rely on:

• Expo — standard contractual clauses adopted by the European Commission (Module 2: controller to processor);
• Resend and Sentry — the European Commission adequacy decision under the EU-US Data Privacy Framework, in which these providers participate, supplemented by standard contractual clauses;
• Railway and Cloudflare — standard contractual clauses or the EU-US Data Privacy Framework, as set out in these providers’ data processing agreements;
• RevenueCat — standard contractual clauses adopted by the European Commission (Module 2: controller to processor), under RevenueCat’s data processing agreement;
• Google Cloud — files are read, and any copies kept, in the European Union. Where Google LLC in the United States has access, for example for technical support or abuse review, the transfer relies on the European Commission adequacy decision under the EU-US Data Privacy Framework, in which Google LLC participates. Any other access, including from other countries, relies on standard contractual clauses (Module 3: processor to processor) between Google companies under the Cloud Data Processing Addendum;
• Google (Sign-In, Maps, Google Play) and Apple — the mechanisms described in their privacy policies.

You can obtain a copy of the standard contractual clauses by writing to privacy@carm8.app.

Users in Switzerland. Your data is processed in Poland, stored in the Netherlands, Germany and other countries of the European Union, and disclosed to the recipients listed in this section, who are also located in Ireland and the United States. Switzerland recognises the countries of the European Economic Area as ensuring an adequate level of protection. For recipients in the United States we rely, where the recipient is certified, on the Swiss-US Data Privacy Framework, and otherwise on the standard contractual clauses as adapted for Swiss law, as set out in each provider’s data processing agreement; for Google (Sign-In, Maps, Google Play) and Apple, on the mechanisms described in their privacy policies.

Data about people associated with business listings

Business listings may contain information from publicly accessible sources such as OpenStreetMap, Google and other lawfully available public sources, as well as information submitted by users.

For sole traders or other businesses operated by natural persons, some business information — such as a personal name in the business name, professional contact details or a business address — may be personal data.

We process this data to operate and update the automotive service directory and enable business searches. The basis is our legitimate interest (Art. 6(1)(f) GDPR) in maintaining a useful directory of publicly available automotive services.

Categories may include business name, proprietor or representative name, business address, professional phone number and email address, website, opening hours and other public business information.

Sources may include public websites and databases, map and place-information providers and user submissions.

We keep the data for as long as needed to maintain an up-to-date listing. Data subjects may request access, correction, deletion or restriction and object to processing as described in the rights section.

4. How long we keep data

• Account, vehicle, and service-history data and favourite car services: until you delete them or delete your account.
• Expenses, insurance details and attachments: at the latest until you delete your account. Scanned documents: as below.
• Scanned documents: a scan you do not save — 7 days after upload, or earlier if you dismiss it; the image of a saved scan — with Pro, as long as the entry exists (as its attachment, within the attachment limits); without Pro, deleted right after you save, unless you agreed to keeping scans for training; images kept for training — until you withdraw consent or delete the entry, scan or account, and never longer than 24 months after upload. The data of a saved scan and its attempts: until you delete the entries created from it, the scan or your account; the model’s answer is deleted after 90 days. Once a scan is deleted (other than with your account), its record and attempts are kept for a further 32 days, so that they still count towards the monthly scan limit, and are then deleted permanently. At Google: only while the file is being read; a request flagged as possible abuse — up to 90 days.
• Purchase data: your billing identifier and Pro status until you delete your account; the record of purchase events for 12 months from receipt — after account deletion it no longer contains your account identifier and we cannot link it to you, and until the end of that period it is used only for revenue and refund statistics. When you delete your account, we have RevenueCat delete its record of you, and repeat this after 1, 7 and 30 days in case a delayed store notification, or a refresh by the App before it was closed, has re-created it. On your device, your billing identifier and purchase status stay until another account opens a purchase screen on it or until you uninstall the App (section 2, data on your device). Apple and Google keep transaction records under their own terms.
• Smart Actions data stored on your device: for the periods given in section 2, at the latest until you turn the feature off (your choice to keep it off: until you sign out), sign out or uninstall the App. We do not store it on our server.
• Reviews and edits: until deleted by you or removed during moderation; we may keep anonymized statistics.
• Crash and technical log data: up to 90 days in our systems; at the error-reporting and update providers (Sentry, Expo) — in line with those providers’ retention periods, as described in their policies.
• Sign-in protection data (including the device identifier recorded on our server): deleted after a successful sign-in or password recovery; otherwise no later than 25 hours after the last failed attempt or the end of the last lockout, whichever is later. The device token is kept on the device until you delete your account in the App on that device (see section 2) and expires one year after it is issued.
• Account-linked analytics: up to 12 months. Pre-account onboarding measurements: up to 90 days. The data is then deleted.
• How many times the App has asked you to rate it and when it last asked: until you delete your account.
• Email delivery logs: short-term, in line with Resend's settings.
• Notices and correspondence: for as long as needed to handle the matter, fulfil legal obligations and establish, exercise or defend legal claims, within applicable legal limits.

Backups. We back up the database and the documents you upload solely to restore the service after a failure. The legal basis is our legitimate interest in being able to restore the availability of data promptly after an incident (Art. 6(1)(f) in conjunction with Art. 32(1)(c) GDPR). Backups are stored encrypted in the European Union (Cloudflare R2) and are deleted automatically: rolling database backups after 30 days, weekly copies after 180 days, and copies of documents about 30 days after the original is deleted. Until then, deleted data — including after account deletion or an objection to analytics — may remain in backups. If we restore data from a backup, we will re-apply the deletions and objections received after the backup was made that we have recorded. For this we keep, in the European Union and for 210 days — longer than the oldest backup — a record of each objection to analytics, each withdrawal of one and each account deletion request: the account identifier, the type of request and its time, nothing else.

5. Your rights

Under the GDPR you have the right to access, rectify and delete your data, to restrict processing, to data portability, to object, and to withdraw consent at any time (e.g. by disabling location or notification permissions or Smart Actions, or by withdrawing your consent to keeping scans for training). We respond without undue delay and within one month at the latest.

You can download a copy of your account, vehicle, service-history, reminder, expense, insurance, saved-place, purchase and analytics data yourself in the App: Profile → Account and security → Download my data (a JSON file). The right to data portability covers data you have provided to us that we process on the basis of a contract or consent: you will receive it in a structured, commonly used and machine-readable format and, where technically feasible, you may ask us to transmit it to another controller. We provide other data, such as uploaded and scanned documents and recognition attempts, on request to privacy@carm8.app.

You can delete your account directly in the App settings; this removes your personal data within 30 days, except where law requires longer retention; for backups, see section 4.

You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (PUODO, uodo.gov.pl), which is our lead supervisory authority. You may also complain to the supervisory authority of the country of the European Union or the European Economic Area where you live or work or where the alleged infringement took place (Art. 77 GDPR). If you live in Switzerland, you may complain to the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch). If you live in Moldova, you may complain to the National Center for Personal Data Protection (datepersonale.md). If you live in another country, you may also lodge a complaint with the data protection authority there; in Ukraine that is the Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua).

Providing your data is voluntary but necessary to hold an account — without an email address and password, or a Google or Apple sign-in, we cannot create an account or sync data across devices. You can also use the App in guest mode without giving contact details. Purchase data is necessary to buy Pro or a tip; without it we cannot sell or unlock Pro. We do not take decisions about you based solely on automated processing, including profiling, that would produce legal effects or similarly significantly affect you. Withdrawing consent does not affect the lawfulness of processing carried out on its basis before the withdrawal.

6. Security

Data is transmitted over HTTPS/TLS. Access to account data in the App is protected by authentication and authorisation controls. After 5 failed attempts in a row, email and password sign-in is temporarily locked for 15 minutes; after the next 5, for 1 hour; and after every further 5, for 24 hours. If there have been no failed attempts or lockouts for 24 hours, the count starts again. Password recovery removes the lockout; the lockout does not affect signing in with Google or Apple. You may request a copy of your data or delete your account as described above.

We apply appropriate technical and organisational measures to protect data. However, no information system can guarantee the complete elimination of risk.

7. Children

The App is intended for users aged 16 and over. We do not knowingly collect data from children below this age.

8. Website and cookies

The carm8.app website does not use tracking or analytics cookies. We only store your language choice in your browser's local storage (localStorage), which is necessary for the site to work properly.

The reporting form prepares text in your browser. It does not send it automatically or save its fields in the website’s local storage. We receive the data only when you email the prepared notice; your email provider processes the message under its own terms.

9. App analytics

We collect usage events to understand and improve the App. Product analytics is first-party: events go to our own database hosted by Railway. We do not use an external product analytics provider; error reporting (Sentry) is described in sections 2 and 3.

For accounts, including guest accounts, we record:

• account creation and sign-in method (Google, Apple or email and password);
• guest account creation, linking and linking failures due to an existing account (method only, without the other account’s details);
• adding a car (make and, for a car from the catalogue, model — without year, registration number or VIN);
• setting a reminder (type, e.g. insurance or inspection);
• adding a service entry or expense (for expenses: category, whether you added it from a Smart Actions suggestion, and how you chose its place: from favourites, by search, typed in, suggested, or no place);
• Smart Actions: starting, completing or skipping the feature’s setup (on which screen, and whether visit detection and notifications ended up fully on), a suggestion being made, opened (from a notification or the list), dismissed or expired, a place being excluded, and the feature being turned off. These events carry only the kind of place (fuel station or car service) — never the place itself, your location, a route or an amount. The App sends them only while it is open, and we record their time to the full hour; the hour at which you open a suggestion from a notification may therefore indicate when you were probably at a fuel station or car service;
• the App asking you to rate it in the App Store or Google Play, and the moment that prompted it (a reminder you set during onboarding, your second or any later entry, a reminder marked done, or your own tap on “Rate Zovano”) — the stores do not tell us whether or how you rated the App;
• active usage days, and the platform you were active from (iOS or Android);
• where you say you found the App, if you choose to answer — one of a fixed set of options, never free text.

Purchases are not recorded as analytics events. To see how often the purchase screen is shown, we count its views per day, by the place in the App it was opened from and by platform, without an account identifier; views by accounts that have objected to analytics are not counted.

So that our statistics count people rather than automated tests, our server compares the IP address of each request — in memory, without storing it — with the address ranges Google publishes for its Firebase Test Lab devices, on which Google Play automatically tests new versions of the App. Requests from those ranges are handled normally, but no analytics events, onboarding measurements or active days are recorded for them.

Events are pseudonymous: linked to an account identifier without VIN, registration number, email address or note contents. We do not use interaction autocapture or session recording. We do not sell analytics data or use it for advertising or cross-app or cross-site tracking.

Legal basis. We process product analytics under our legitimate interest (Art. 6(1)(f) GDPR) in understanding App usage, identifying usability problems and making development and improvement decisions based on actual product use. The set of events and properties is limited.

Your right to object. You may object to product analytics at any time, without giving a reason. The easiest way is in the App: Profile → Account and security → turn off the “Analytics” switch; this also works in guest mode. From then on we do not record analytics events for your account, and we delete the events and active days recorded earlier without undue delay. You can also write to privacy@carm8.app from the email address linked to your account. If you use guest mode or have not given us an email address, include your account identifier — the id field in the user section of the file downloaded with “Download my data” on the same screen. Once we have matched such an objection to your account, we will act in the same way. You do not need to close your account to object. Backups are described in section 4.

Pre-account onboarding measurements. We measure the start of onboarding, the start and progress of adding a car (including opening the make picker) and the first service (added or skipped), the reminder offer (shown, set or skipped), the registration prompt being shown, the start of registration, and time to the first entry. Depending on the step, an event may include the model source (catalogue or custom entry), the reminder type (oil, inspection, tyres or OC) together with whether we proposed its date from the first service, sign-in method or duration. We do not record make, model or year. We do not record the type of the first service. But if we proposed the reminder from it, the reminder type (oil, inspection or tyres) matches the kind of that service. We include platform and App version. Event times are recorded to the full hour.

These measurements are not linked to an account, name or email address. They use a temporary identifier held only in App memory, never saved on the device and lost when the App process ends. The onboarding analytics event itself does not contain an IP address. Independently, standard infrastructure technical logs may contain an IP address as described in the technical data section above.

The basis is our legitimate interest (Art. 6(1)(f) GDPR) in identifying where new users encounter difficulties. These measurements are not linked to an account or to any other data that would allow us to tell whom they concern. We are therefore unable to identify your measurements and — in line with Art. 11 GDPR — cannot locate or delete them on the basis of an objection. They are deleted automatically after 90 days (section 4).

10. Changes to this policy

We may update this policy, for example when adding features or changing providers. We will inform you of material changes — in particular new purposes of processing, new recipients of data or transfers to new countries — at least 14 days before they take effect, by email or, if we do not have your email address, by a notice in the App. Previous versions of the policy are available in the archive linked in the header.

11. Contact

Anton Trafimuk · al. Polski Walczącej 26, 00-712 Warsaw, Poland · privacy@carm8.app