This Privacy policy explains how Mycarro (Mycarro, we, us) processes personal data in connection with the Mycarro business platform: this website, the dashboard, the connectors and the related services (the Service). It applies the General Data Protection Regulation (EU) 2016/679 (GDPR), the data-protection law of Portugal and, for users in Switzerland, the Swiss Federal Act on Data Protection (FADP).
1. Two roles: controller and processor
1.1. We are the controller of the personal data described in this policy: the data of the people who visit this website, contact us, or sign up for and use the dashboard on behalf of a dealership (owners, staff and other users), and the data needed to bill dealerships and support them.
1.2. We are a processor of the personal data that dealerships put into the Service about their own customers, leads, buyers, sellers, employees and website visitors. For that data, the dealership is the controller, we process it only on its instructions under our Data processing agreement, and the dealership's own privacy notice applies. If you are a dealership's customer, contact that dealership to exercise your rights. We will pass on any request we receive to it.
1.3. This policy does not cover the consumer website mycarro.app and its apps, which have their own privacy policy, or the services of third parties you choose to connect, such as marketplaces or AI assistants.
2. What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Account data: name, email, phone, password hash, sign-in methods, profile photo, language, the dealership and role you belong to | Creating and securing your account, letting you sign in, and managing your dealership's users | Performance of the contract (Art. 6(1)(b)), and our legitimate interest in securing the Service (Art. 6(1)(f)) |
| Dealership and billing data: business name, tax number, address, contacts, plan, subscription history, invoices, the last digits and expiry of a card (the full card is held by the payment processor) | Providing plans, charging fees, issuing invoices, and keeping accounting and tax records | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Acceptance records: which version of the Terms and the Data processing agreement was accepted, when, and by which user | Proving the contract and its terms | Legitimate interest (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)) |
| Usage and audit data: actions in the dashboard and through connectors, the user or assistant who performed them, timestamps, settings | Providing the Service, the audit trail your dealership sees, security, fraud prevention, troubleshooting and improving the Service | Contract (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) |
| Technical data: IP address, device and browser type, request logs, error reports (without session replay) | Delivering the website, security, abuse prevention and fixing faults | Legitimate interest (Art. 6(1)(f)) |
| Website analytics: pages viewed, referrer, country and device type, collected without cookies and without identifying you | Measuring and improving our website | Legitimate interest (Art. 6(1)(f)) |
| Communications: messages you send us through the contact form, email, support tickets or the dashboard, and our replies | Answering you, providing support, sales conversations | Pre-contractual steps and contract (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) |
| Marketing: business contact details, your preferences | Telling you about our products and changes to the Service | Legitimate interest in marketing to business customers (Art. 6(1)(f)), or consent where the law requires it (Art. 6(1)(a)); you can object or unsubscribe at any time |
We also process personal data where we need it to establish, exercise or defend legal claims, to comply with orders of authorities, and to enforce our Terms (Art. 6(1)(c) and (f)).
You are not required to give us personal data, but without the data marked as necessary we cannot create an account or provide the Service. We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you.
3. Cookies and similar technologies
This website and the dashboard use only cookies and local storage that are strictly necessary: signing in, keeping your session secure, preventing abuse, and remembering choices such as language and theme. Our analytics are cookieless. We do not use advertising or cross-site tracking cookies. If we ever want to use non-essential cookies, we will ask for your consent first.
4. Who we share it with
We share personal data only as needed for the purposes above, with:
- Our processors (service providers), which act on our instructions under contracts that protect your data. They provide authentication and billing (Clerk, with Stripe as payment processor), hosting, content delivery, storage and email (Cloudflare and Hetzner), error monitoring (Sentry), cookieless analytics (Plausible), forms (Tally) and AI model inference (OpenRouter, and the model hosts it routes to). The current list is in the Data processing agreement.
- Your dealership and its users, who see your name, role and activity in the dashboard and its audit trail.
- Third parties you or your dealership choose to connect, such as marketplaces and AI assistants. They receive the data needed for the integration you activate and process it under their own terms.
- Professional advisers, auditors, insurers and banks, under a duty of confidentiality.
- Authorities, courts and law enforcement, where the law requires it or to protect our rights, our customers or others.
- A buyer or successor in a merger, acquisition, reorganisation or sale of assets, under equivalent protections.
We do not sell personal data.
5. International transfers
We host the Service in the European Union. Some of our providers, or their sub-processors, may process personal data outside the European Economic Area and Switzerland, including in the United States. Where they do, we rely on an adequacy decision (such as the EU-US Data Privacy Framework for certified providers) or on the European Commission's Standard Contractual Clauses, with the Swiss amendments where the FADP applies, together with additional safeguards where needed. You can ask us for information about these safeguards.
6. How long we keep it
- Account and usage data: for as long as your account is active, then up to 90 days to close it down safely. Audit records are kept for up to 2 years.
- Billing, invoices and accounting records: for the period the tax and commercial laws require (in Portugal, generally 10 years).
- Acceptance records and data needed for legal claims: for as long as claims can be brought, and until any claim is finally resolved.
- Communications and support: up to 3 years after the last contact.
- Technical logs and error reports: generally up to 90 days.
- Marketing: until you object or unsubscribe.
At the end of these periods we delete the data or anonymise it irreversibly.
7. Security
We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls based on roles, logging, backups, and providers chosen for their security. No system is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials safe.
8. Your rights
Subject to the conditions of the law, you have the right to:
- access your personal data;
- rectify it;
- have it erased;
- restrict its processing;
- data portability;
- object to processing based on legitimate interests, including at any time to direct marketing;
- withdraw consent at any time, without affecting the processing that came before.
To exercise them, write to [email protected]. We may need to verify your identity. We answer within one month, which may be extended by two further months where the law allows. If you are a user of a dealership, some requests (such as deleting a user) may also go to that dealership's administrator.
You have the right to lodge a complaint with a supervisory authority, in particular in the country where you live or work, or with Comissão Nacional de Proteção de Dados (CNPD). Users in Switzerland may also contact the Federal Data Protection and Information Commissioner (FDPIC). We would be grateful for the chance to resolve your concern first.
9. Children
The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children.
10. Changes
We may update this policy from time to time. We post the new version on this page with its effective date and, where the change is significant, we tell account holders by email or in the dashboard.
11. Contact
For anything about this policy or your personal data: [email protected] or our contact form. Our Terms of service govern the use of the Service.