Privacy policy

1. Who processes your data

The controller of personal data is the owner of the autola.io service. For any question about data processing, including exercising your rights, write to [email protected]. Registered users can also get in touch through the “Support” section of their account.

2. What data we collect

2.1. Account data

• When you register with email: your email address, name, password (stored in encrypted form — we do not know the password itself) and the date you accepted the terms of use and this policy.
• When you sign in with Google: the email address and name from your Google profile. We have no access to any other data in your Google account.

2.2. Data created as you use the service

• listings and lots you add to favourites, and their price at that moment — so we can tell you when it drops;
• saved searches (the name and the search address with its filters);
• notifications the service creates for you;
• support requests and the correspondence on them;
• your plan, its expiry date and redeemed promo codes;
• payment history: product or plan, amount, date, payment method, the promo code applied and payment status. Bank card, PayPal account and crypto wallet details are processed by the payment services — we do not receive or store them. If you pay with a partner's promo code, the partner sees only the amount and date of the payment, not your data;
• notification settings;
• your Telegram chat ID — only if you have linked the Telegram bot in your settings yourself;
• messages sent through the contact form: the topic, name, email, text and a page link, if you provided one.

2.3. Technical data

Like any website, the server records the IP address, the time of the request, the page address and the browser type. This data is used for security (for example, to protect against password guessing), for counting listing views and for fixing errors, and it is kept for a limited time — no longer than 30 days. IP addresses are not stored for counting views.

For signed-in users, the server counts how many site pages and extension requests an account makes per day. We use these counters to protect the data from automated copying: if a limit is exceeded, the account is blocked pending review. The counters are kept for 90 days.

2.4. Chrome extension

The extension works only for signed-in users and only on the supported listing sites. It sends us the IDs of the listings on the page you have open and a VIN that you select yourself to check. It does not read your browsing history or pages of other websites. Its display settings are stored in your browser. Extension requests are included in the activity counters (section 2.3).

We use two counters for traffic statistics. Umami runs on our own server, sets no cookies and does not recognise a visitor on a return visit: it records the page address, the referring source, the country and the type of browser and device, and does not store the IP address. Google Analytics collects similar information using its own cookies — for visitors from the European Economic Area, the United Kingdom and Switzerland, only with their consent (section 5). We do not build visitor profiles ourselves and we do not sell personal data. Advertising on the free plan is described in section 5.

3. Purposes and legal bases

• Performance of a contract (Art. 6(1)(b) GDPR) — registration and sign-in, your account, favourites and saved searches, the Chrome extension, notifications on the site and in Telegram, address confirmation and password reset emails, payment and renewal of paid plans, replies to support requests.
• Compliance with a legal obligation (Art. 6(1)(c) GDPR) — keeping payment records for accounting and tax purposes.
• Legitimate interests (Art. 6(1)(f) GDPR) — security of the service and protection against abuse, showing non-personalised ads on the free plan, replying to messages sent through the contact form and protecting the form against spam, fixing errors, counting listing views, cookie-free traffic statistics (Umami), aggregating publicly available listings (section 4).
• Consent (Art. 6(1)(a) GDPR) — linking the Telegram bot, emails with news and promo codes, advertising cookies, including personalised ads, and Google Analytics cookies (section 5). You can unlink the bot and unsubscribe from emails at any time in your account settings; every such email also contains an unsubscribe link.

The service makes no automated decisions that have legal effects on you. Market price estimates and analytics concern cars, not people.

4. Data in listings

The service collects car sale listings and auction lots published openly on third-party platforms. A listing may contain the seller’s name or company name, their city, the listing text and photos — exactly as published on the source platform. Phone numbers, email addresses and links are removed from listing texts automatically; the seller can only be contacted on the source platform.

The service uses the vehicle identification number (VIN) to show the listing history of a particular car. The service does not link a VIN to the car owner’s data and does not store such data.

If a listing contains your personal data and you would like it hidden, write to [email protected] with a link to the listing page.

5. Cookies and browser storage

The site’s own cookies are only those it needs to work: to keep you signed in, to protect forms against request forgery and to remember your chosen language and currency.

For visitors without an account and on the free plan, the site shows ads from Google AdSense. Google and its partners use cookies and similar technologies to show ads, limit how often they are repeated and measure their performance, and — if you consent — to show personalised ads based on your visits to this and other websites. Visitors from the European Economic Area, the United Kingdom and Switzerland are asked for this consent in a separate window before advertising cookies are used, and can change their choice at any time. You can turn off personalised ads in Google’s ad settings; how Google uses data from websites that show its ads is explained on Google’s page. On the paid plan there are no ads, and the advertising code is not loaded at all.

Google Analytics stores its own cookies for traffic statistics. Visitors from the European Economic Area, the United Kingdom and Switzerland are asked about this in the same window as about advertising cookies; without consent, Google Analytics receives only anonymised signals without cookies.

The contact form on the contact page is protected by the Google reCAPTCHA service, which may store its own cookies in your browser.

Display settings — for example, the light or dark theme — are stored in your browser itself and are not sent to us.

6. Who receives the data

We do not sell personal data or pass it to third parties for their own purposes, except Google as an advertising provider with your consent (section 5). Data is received only by the following providers:

• the hosting provider — hosting the website and the database;
• the email delivery service — sending service emails (address confirmation, password reset, payment and subscription emails) and, if you have agreed, emails with news and promo codes;
• payment services — accepting payments by card, PayPal and cryptocurrency;
• Google — signing in with a Google account, if you choose to, and protecting the contact form against spam (reCAPTCHA): Google receives your IP address and information about your browser;
• Google — showing ads to visitors without an account and on the free plan (AdSense): Google receives the IP address, information about the browser and its cookies (section 5);
• Google — traffic statistics (Google Analytics): Google receives the IP address, information about the browser and, with your consent, its cookies (section 5);
• Telegram — delivering notifications, if you have linked the bot;
• content delivery networks — loading interface libraries, maps and images; when a page loads, your browser fetches these files from their servers and shares its IP address with them.

The service operates from Ukraine, and some providers are located outside the European Economic Area. Data is transferred to such providers on the basis of the standard contractual clauses approved by the European Commission or other safeguards provided for in Chapter V of the GDPR.

Data may be disclosed to public authorities only where the law expressly requires it.

7. Retention periods

• account data, favourites, saved searches, settings and support requests — for as long as the account exists;
• payment history — for the period required by accounting legislation, including after the account is deleted;
• messages sent through the contact form — up to 1 year;
• notifications — 90 days;
• daily account activity counters — 90 days;
• Google Analytics data — 14 months;
• technical data — no longer than 30 days.

When an account is deleted, the data linked to it is deleted too, except for information we are required by law to keep.

8. Your rights

You have the right to:

• find out what data about you we process and obtain a copy of it;
• have inaccurate data corrected;
• have your data and your account deleted;
• restrict processing;
• receive your data in a machine-readable format (portability);
• object to processing based on legitimate interests;
• withdraw your consent — this does not affect the lawfulness of processing before the withdrawal.

To exercise a right, write to [email protected] from the address linked to your account, or contact support in your account. We will reply within one month. Accounts are deleted upon such a request.

You also have the right to lodge a complaint with the data protection authority of the EU country where you live or work, or with the Ukrainian Parliament Commissioner for Human Rights.

9. Security

Connections to the site are encrypted (HTTPS), passwords are stored in encrypted form and access to the database is restricted. No method of transmitting or storing data is completely secure, but we take reasonable technical and organisational measures to protect your data.

10. Children

The service is not intended for people under 16, and we do not knowingly collect their data. If you learn that a child has registered with the service, let us know and the account will be deleted.

11. Changes to this policy

We may update this policy. The date of the current version is shown at the top of the page. Registered users are informed of significant changes in advance — by a notification in their account or by email.

12. Contact

Questions about personal data: [email protected]. The terms of using the service are on the Terms of use page.