Der juristische Arbeitstext unten liegt derzeit nur auf Englisch vor. Die finalen deutschen und englischen Fassungen müssen gemeinsam freigegeben werden.
Arbeitsentwurf der Datenschutzerklärung
Arbeitsentwurf geprüft: 18. Juli 2026
1. Who we are
This draft does not yet identify the contracting entity or data controller. Those details, its registered address and the responsible contact must be confirmed before a final notice is published or relied on.
2. What personal data we collect
Account data: Name, email address, and authentication provider ID (e.g. Google OAuth profile) when you sign in.
Vehicle data: Make, model, year, VIN, license plate, mileage, purchase price, and photos of your vehicles.
Service & cost records: Maintenance entries, fuel purchases, repair costs, vendor names, dates, and attached receipts or documents.
Usage data: IP address, browser type, device information, and app interaction patterns may be processed by essential server logs and, only after the relevant consent, configured analytics. The final notice must match the production inventory.
Payment data: Paid checkout is disabled during the closed beta. If billing is later enabled through Stripe, the final notice must describe the data flow and each party's role before launch.
3. Why we process your data (legal basis)
The following legal bases are working assumptions for legal review, not a complete or effective processing notice.
Contract performance (Art. 6(1)(b) GDPR): To provide the Carfolio service, store your vehicle record, and enable confirmed Carfolio record handoffs.
Legitimate interests (Art. 6(1)(f) GDPR): Fraud prevention, security monitoring, service improvement, and customer support.
Consent (Art. 6(1)(a) GDPR): For optional AI document analysis and marketing communications (where applicable).
Legal obligation (Art. 6(1)(c) GDPR): Tax and accounting compliance where required by Austrian law.
4. How we share your data
The product is designed without selling personal data. Any production disclosure is limited to configured providers, user-directed sharing and disclosures required by law. The final provider list must be approved before publication:
- Service providers: Configured cloud hosting, email delivery, customer support tooling, and analytics. The final provider and region list must match the verified deployment inventory before publication.
- Potential payments provider — Stripe: Paid billing is not active. If enabled, Stripe may support payment processing, subscription management, billing portal access and receipts. Its precise role must be confirmed. See Stripe's Privacy Policy.
- Professional advisers: Legal and accounting firms where necessary.
- Authorities: Where required by law or to protect our legal rights.
5. Data retention
A production retention schedule has not yet been approved. The final policy must set a purpose-specific period for account, vehicle, document, billing, support, security and analytics data; describe deletion and backup expiry; and identify records that must be retained under applicable law. This draft makes no fixed deletion-time guarantee.
6. Your rights
Where the GDPR applies, rights may include access, rectification, erasure, restriction, portability, objection and withdrawal of consent. The final notice must explain the verified request process and applicable response periods. The proposed contact is privacy@carfolio.site.
You also have the right to lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at).
7. International transfers
This draft makes no unconditional EU-only hosting claim. Storage and processing regions depend on the approved production deployment and its sub-processors. The final notice must list relevant regions and, where required, the transfer mechanism and supplementary safeguards actually in use.
8. Security
The architecture is designed around encrypted transport, access controls, least-privilege service access and private document storage. The final notice must describe only controls verified in the production deployment; this working draft is not a blanket security certification or guarantee.
9. Cookies
The application uses essential session mechanisms for authentication. Optional analytics must remain off until the relevant consent is recorded. A final cookie and storage audit must identify every production technology and retention period before this notice is published.
10. Contact
For privacy questions or data subject requests, contact:
[Legal entity — confirm before launch]
Email: privacy@carfolio.site
Website: carfolio.site