Terms Privacy

CarMate — Privacy Policy

Effective date: July 15, 2026 Version: 1.1 (Beta)

1. Data controller

Anton Trafimuk, conducting business activity under the name Anton Trafimuk (sole proprietorship registered in CEIDG, Poland)
NIP: 5213959663 · REGON: 521472000
Address: al. Polski Walczącej 26, 00-712 Warsaw, Poland
Email: hello@carm8.app

This policy explains how we process personal data in the CarMate mobile application ("App") and on the carm8.app website, in accordance with the EU General Data Protection Regulation ("GDPR").

2. What data we collect and why

Data Purpose Legal basis
Account data: Google account data (name, email, profile picture, Google user ID) or email address for link sign-in Account creation and sign-in Contract performance (Art. 6(1)(b) GDPR)
Vehicle data (make, model, registration number, VIN, mileage) Maintaining your digital service book Contract performance (Art. 6(1)(b))
Service-history records (dates, costs, mileage, place, notes) Keeping your vehicle's service history Contract performance (Art. 6(1)(b))
Renewal dates and your device push-notification token Sending reminders (OC, inspection, service) Contract performance (Art. 6(1)(b))
Your reviews, ratings, and suggested edits Operating the community features of the App Contract performance (Art. 6(1)(b))
Device location (only while using the App, if you grant permission) Showing nearby car services on the map Consent (Art. 6(1)(a))
Email address for transactional messages (sign-in link, reminders) via Resend Delivering messages necessary to run the service Contract performance (Art. 6(1)(b))
Crash and error data (device model, OS version, app version, stack traces) via Sentry Fixing bugs and keeping the App stable Legitimate interest (Art. 6(1)(f))
Basic technical data (IP address, request logs) Security, abuse prevention, service operation Legitimate interest (Art. 6(1)(f))
App usage events (e.g. adding a vehicle, setting a reminder, adding an expense or service record, opening a notification) linked to a pseudonymous identifier — without VIN, registration number, email address, or note contents — via PostHog (EU-hosted) Measuring feature usage and improving the App (product analytics) Consent (Art. 6(1)(a)); you may withdraw it at any time — see section 9

We do not sell your data, use it for advertising, or track you across other apps or websites.

Location data is used in real time to query nearby services and is not stored as a movement history.

Vehicle and service-history data is entered by you and is for your use only — we do not share it with other users.

3. Third-party services

Some providers (including Resend, Railway, Cloudflare, Sentry) may process data outside the European Economic Area; in such cases transfers rely on EU Standard Contractual Clauses (SCCs) or adequacy decisions.

Business listing information shown in the App (names, addresses, opening hours) comes from public sources (OpenStreetMap, Google) and concerns businesses, not App users.

4. How long we keep data

5. Your rights

Under the GDPR you have the right to access, rectify, delete, or receive a copy of your data, restrict or object to processing, and withdraw consent at any time (e.g. by disabling location or notification permissions). Contact us at hello@carm8.app — we respond without undue delay and within one month at the latest.

You can delete your account directly in the App settings; this removes your personal data within 30 days, except where law requires longer retention.

You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (PUODO, uodo.gov.pl).

6. Security

Data is transmitted over HTTPS/TLS, stored in access-controlled databases, and protected by authentication on all administrative access. You can export or delete your service history at any time. The App is in beta; despite our safeguards, no system is 100% secure.

7. Children

The App is intended for users aged 16 and over. We do not knowingly collect data from children below this age.

8. Website and cookies

The carm8.app website does not use tracking or analytics cookies. We only store your language choice in your browser's local storage (localStorage), which is necessary for the site to work properly.

9. App analytics

To understand how you use the App and which features need improvement, we collect usage events (product analytics) using PostHog. We use an instance hosted in the European Union (eu.i.posthog.com), and analytics data is processed within the EEA.

We collect only events about actions taken in the App, for example:

We attach basic properties to events: platform (iOS/Android), app version, number of vehicles, and whether an OC date has been set and an expense added.

Events are pseudonymous. They are linked to your account identifier (and, before sign-in, to an anonymous identifier) and do not contain your VIN, registration number, email address, or note contents. We do not use interaction autocapture or session recording — we log only the specific, deliberate events listed above. We do not sell analytics data, use it for advertising, or track you across other apps or websites.

Legal basis. We process product analytics solely on the basis of your consent (Art. 6(1)(a) GDPR). Analytics is off by default and starts only after you enable it. You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

How to turn it on or off. You manage analytics in the App on the Privacy screen (the "Analytics" toggle). The setting is saved and synced to the server, so it also covers events sent server-side (e.g. sending reminders). Until you enable analytics, we collect no usage events.

10. Changes to this policy

We may update this policy (e.g. when adding features). Material changes will be announced in the App or by email at least 14 days in advance. The current version is always available at carm8.app/privacy.

11. Contact

Anton Trafimuk · al. Polski Walczącej 26, 00-712 Warsaw, Poland · hello@carm8.app