Privacy policy

What we process

Account: email, name (from Google/Facebook if used), sign-in methods, language, notification preferences, phone number (if you add it), whether buyers may see it and when it was verified, and — if you allow device notifications — the notification address of that device.

Listings: vehicle details, photos (location data is removed on your phone), price, city, plate and VIN (revealed on the listing on click).

Communication: messages between buyer and seller (with automatic translations if you write in different languages), viewing times, reports and moderation decisions.

Technical: listing view counts and visit statistics (not linked to a person, see below), error logs, security logs.

Why

To provide the service (account, listings, messages), for security and fraud prevention, to meet legal obligations (e.g. DSA notices and decisions) and — with your consent — for email and device notifications. Legal bases: contract, legitimate interest and legal obligation.

Who receives it

Processors: Supabase (database and files, EU data centre), Vercel (hosting), Google and Facebook (sign-in, if you choose it), an email provider (notifications), GatewayAPI (SMS: if you verify your phone number, a one-time code is sent to it; if you turn on SMS notifications, also the alerts you choose, e.g. a price offer or a viewing reminder), Anthropic (AI: writing and translating descriptions, translating chat messages when buyer and seller write in different languages, finding equipment and number plates in listing photos — photos are sent downscaled and only for that task). Public registers: Estonian Transport Administration (vehicle data, fees), Business Register (company verification).

Device notifications (if you allow them) reach you through the notification service of your browser or phone maker (Google, Apple, Mozilla or Microsoft). The content of browser notifications is encrypted and the service cannot read it. You can turn notifications off at any time in your profile settings or in the browser.

Buyers see your first name (if you allow), city and listing details, and a “Phone verified” badge if your number is verified. Buyers see your phone number only if you allow it: the number is revealed on click and is not in the page text. Your email is never shown to buyers.

Visit statistics

We count page views to see where visitors come from, which pages are viewed and where adding a listing is abandoned. No cookies are used for this and nothing is stored on your device. No IP address or account is stored: to tell visitors apart, a hash is calculated from the IP address and browser details together with a random key that changes every day and is deleted the next day — so the hash cannot identify a person or link visits on different days.

We store the page address (without identifiers for personal pages), the name of the previous site (e.g. Google), country, device type, browser, language and whether you were signed in. The data stays in our database (Supabase, EU) and is only used for aggregate statistics. Legal basis: legitimate interest (improving the service).

AI assistants (ChatGPT, Claude and others)

Autovaade car search can be used in AI assistants (public MCP server at autovaade.ee/mcp). An assistant only receives data that is already public on the listings: vehicle details, price, location (city), seller type and dealer name, traffic registry data and the listing link. A private seller’s name, phone number or e-mail is never given to the assistant — the buyer contacts the seller on the Autovaade listing.

From assistant requests we only store aggregate counts (which tool, whether it succeeded, duration, assistant name). The IP address is used for rate limiting only in server memory for about a minute and is not stored. We cannot see your conversation with the assistant — the AI provider processes it under its own terms. Legal basis: legitimate interest (making listings findable).

How long we keep it

Account until you delete it. Listings until the account is deleted: photos and description of a removed listing are deleted after 30 days (you can restore the listing during that time); the listing’s basic details and price history stay in your account as your sales history. After the account is deleted, only a summary of the listing remains for vehicle history and market statistics (make, model, technical details, mileage, prices, county and city, time of sale) — without your name, contact details, description or photos, and not linked to you. Messages until the account is deleted. Error logs 90 days. Visit statistics 13 months.

Your rights

You can request a copy of your data, correct or delete it, restrict processing and object. Write to privaatsus@autovaade.ee. You can complain to the Estonian Data Protection Inspectorate (aki.ee).

You can also download your data or delete your account yourself under Me → Account and data. The account and data are deleted 30 days after you confirm the deletion (you can cancel it during that time). This also applies to accounts created with Google or Facebook; you can add and remove sign-in methods on the same page.