Privacy Policy

1. Who processes the data

Detailero s.r.o., Company ID (IČO) 29589428, VAT ID (DIČ) CZ29589428, with its registered office at Uralská 689/7, Bubeneč, 160 00 Praha 6, registered in the Commercial Register (obchodní rejstřík) maintained by the Municipal Court in Prague (Městský soud v Praze), Section C, Insert 449023 (hereinafter “Detailero”).

Contact for privacy matters and exercising your rights: info@detailero.com, or by post to the address of the registered office. Detailero has not appointed a data protection officer.

2. Detailero's role

Detailero is the controller of the data of customer accounts, Studio accounts, subscriptions, public profiles, the inquiry platform, reviews, the global VIN history, security, support and its own marketing.

For CRM data that a Studio enters about its clients, vehicles and employees for its own operations, the Studio is the controller and Detailero the processor. Details are set out in the Data Processing Addendum . After an inquiry has been passed on, the Studio is also an independent controller for handling it commercially.

3. Categories of data

• Account – name, e-mail, phone, city, account identifier, sign-in provider and security data.
• Studio and subscription – company, contact and billing details, Company ID, VAT ID, roles, approval status, Stripe customer/subscription identifiers and the history of payment statuses; Detailero does not store the full card number.
• Garage and vehicles – make, model, year, color, label, license plate and VIN.
• Inquiries – contact, services, message, date, vehicle, the chosen Studio and the handling status.
• Reviews and content – rating, text, the Studio's reply, content reports and moderation.
• Global VIN history – VIN, the date and category of the service and the Studio that made the entry; without the owner's name.
• Communication – transactional e-mails, reminders, campaigns, unsubscribes, deliveries and push tokens.
• Technical and security data – sign-in time, audit records, device type, an IP hash or another limited identifier for spam protection, error information and consent to analytics.

4. Purposes and legal bases

• Providing the account and the features of the service – performance of a contract.
• Inquiry and passing it on to the chosen Studio – steps taken at the user's request prior to entering into a contract, and performance of the Detailero service.
• Subscriptions, accounting and tax documents – performance of a contract and a legal obligation.
• Public profile, reviews, moderation, security, fraud prevention and defense of legal claims – performance of a contract and legitimate interests in trustworthy and secure operation.
• Global VIN history – the legitimate interest of Detailero, Studios and users in a verifiable history of vehicle care, minimized to the VIN, the service, the date and the Studio.
• Detailero's own marketing and Studio marketing – consent or the statutory customer exception under the law of the user's country (in the Czech Republic the Act on Certain Information Society Services, zákon o některých službách informační společnosti, in Slovakia the Electronic Communications Act, zákon o elektronických komunikáciách), provided all of its conditions are met. Unsubscribing is possible at any time.
• Push notifications – performance of a contract for operational messages; device consent and marketing permission for promotional messages.
• Traffic measurement and analytics – traffic measurement without cookies with a pseudonymous identifier that changes every day, based on the legitimate interest (Art. 6(1)(f) GDPR) in knowing how many people use the service and where they get stuck; detailed analytics with an identifier on the device, linked to the account and e-mail for a signed-in user, based on consent (Art. 6(1)(a) GDPR). The choice in the cookie banner determines whether we may store information on the device; the legal basis for the processing of the data itself under the GDPR is a separate question, and we state it here. For an inquiry and a studio registration we record where you came to the website from (the campaign tag in the link, the domain of the previous website and the landing page), based on the legitimate interest in knowing which channels bring us customers and studios. We do not store any of this on your device.
• Ad measurement on the studio page – only on the /for-studios page and only on the basis of consent in the Marketing category (Art. 6(1)(a) GDPR; storing on the device under Section 89(3) of Act No. 127/2005 Coll. on Electronic Communications). The Meta Pixel sends Meta Platforms Ireland Ltd. an event about the visit to the page and about a click on the studio registration button, together with the identifiers in the _fbp and _fbc cookies, the IP address, browser data, the address of the visited page (including campaign parameters and the ad click identifier) and the address of the page you came from. Meta may match this data with its own cookies on facebook.com or with a signed-in Facebook or Instagram account. The purpose is to measure how many people came from Facebook and Instagram ads and registered a studio. You can withdraw consent at any time in Cookie settings in the footer or in your account settings (Ad measurement); withdrawal does not affect the lawfulness of processing before it. We do not treat consent to analytics as consent to marketing. The Pixel does not load in the mobile app.

5. Public visibility and recipients

Approved Studio profiles, their content and reviews are displayed publicly, with the author's identity limited. The global VIN history is available to a signed-in Studio and to a User who has a vehicle with that VIN in their garage. Clients' contact and CRM data are not public.

We publish the current List of Subprocessors separately. Some suppliers are established or process data outside the European Economic Area (EEA), in particular in the USA. For each of them, the list states the country and the safeguard on which the transfer is based: certification under the EU-U.S. Data Privacy Framework (a Commission adequacy decision) or standard contractual clauses, including a link to their text. We will send you a copy of the safeguards on request.

6. Retention periods

• Account and its regular content – for the lifetime of the account; after deletion, it is removed from active systems without undue delay.
• Technical backups of deleted active data – no more than 7 days, after which they are overwritten.
• Inquiry in the account – for the lifetime of the account, but no longer than necessary to document the course of the service and to defend legal claims.
• Detailero's tax and accounting records – for the statutory period, usually 10 years.
• Reviews – until deleted by the user, removed in moderation or the account is deleted; a necessary non-public record of the moderation may remain for the defense of legal claims, for no longer than 3 years from the moderation.
• Global VIN history – for as long as the service exists or until the record is corrected or removed; a change of the vehicle's owner does not delete it; for a Studio that has ceased to exist, only its name is shown, with a note that it no longer operates.
• Marketing consent and unsubscribes – for the period of sending and the necessary period afterwards to prove authorization and to respect unsubscribes; for Slovak consents, at least for the mandatory periods required there.
• PostHog analytics – records of visits and events for no longer than 1 year; the profile of a signed-in user with the account identifier and e-mail until consent is withdrawn or the account is deleted.
• Meta Pixel – the _fbp and _fbc cookies stored in your browser have a retention period set by Meta; we delete them when you withdraw consent. Meta keeps the data sent to Meta Platforms Ireland Ltd. under its own terms.
• Security and audit records – usually 12 months, longer only in the case of a specific incident or claim.

7. Account deletion

Deleting a customer account removes the sign-in, profile, garage, favorite Studios, customer preferences and public reviews. Data taken over by a Studio into its CRM or a job are managed by the Studio. The global VIN history remains, because it is not kept as the private history of a single owner.

When a Studio is deleted, we hide its public profile immediately and permanently erase its active CRM data, employees, jobs, clients, vehicles, internal notes and invoices 30 days after the account is closed; until then, they can be restored or invoices handed over at the Studio's request. Historical VIN records remain and are shown with the Studio's name only.

8. Rights of data subjects

You have the right of access, rectification, erasure, restriction, portability, objection to processing based on legitimate interest and withdrawal of consent. Send your request to info@detailero.com. We may verify your identity. We usually respond within one month.

For data kept by a Studio in its CRM, contact the relevant Studio first; as a processor, we will provide it with the necessary assistance. A complaint can be lodged with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů) in the Czech Republic or with the supervisory authority in the country of your habitual residence, in particular the Slovak Office for Personal Data Protection (Úrad na ochranu osobných údajov).

9. Automation and ranking

We do not carry out automated decision-making with legal or similarly significant effects. We rank Studios mainly by distance and the selected filters. Paid highlighting will always be clearly marked.

10. Security and access

We use encrypted transmission, access control at the database level, separation of company accounts, backups and limited administrator access. Administrator access to the CRM is permitted only for support, security, fixing an error, a legal obligation or at the Studio's request, and is to be audited.

11. Changes to the policy

We update the policy when the service, a purpose or a supplier changes. We will announce a material change by e-mail or in the app before it takes effect, if circumstances allow.

12. Production suppliers at launch

At launch, we use Supabase, Laravel Cloud, Vercel, Stripe, Resend, Cloudflare, Upstash, PostHog, the map, location autocomplete and reviews from Google Maps Platform, CARTO base maps and Photon address lookup in the app for Studios, Google and Apple sign-in and the Firebase and APNs push services. On the studio page (/for-studios) we use, only with consent in the Marketing category, the Meta Pixel of Meta Platforms Ireland Ltd. (Ireland; the data may reach the USA, where the transfer is covered by certification under the EU-U.S. Data Privacy Framework); elsewhere and in the mobile app we use no advertising pixels. Without consent, PostHog analytics stores nothing on the device and counts visits only with an identifier that changes every day; more detailed measurement with a persistent identifier starts only with consent. Every new supplier or SDK is assessed before it is integrated and reflected in this policy, the Cookie Policy and the List of Subprocessors .

The map, location autocomplete and reviews from Google Maps are provided by Google Maps Platform. When they are used, Google processes the IP address, the displayed map area and the entered search text in accordance with the Google Privacy Policy. We display reviews from Google Maps only as Google currently provides them; we do not store them.

13. Retention of inquiries without an account

An inquiry sent without an account is available to the chosen Studio in the platform part for fourteen days for a response. It is then deleted from the platform part, unless it is converted into a job at the request of the user or the Studio, or unless limited retention is necessary to deal with a specific misuse or legal claim. Data taken over by the Studio into its own CRM are managed by the Studio according to its own retention rules.

14. Sources of data and information under Article 14 GDPR

We obtain data directly from the user, the Studio, its authorized staff member, the Google or Apple sign-in provider, Stripe and from the technical operation of the service. A Studio may enter into the CRM data of a client or employee who does not have a Detailero account; the Studio is the controller of such data and is responsible for the information obligation. When an inquiry is passed on, the Studio obtains the data from Detailero at the user's request.

15. Necessity of providing data

Data marked as mandatory are a contractual requirement for the given feature; without them, the account, inquiry or subscription cannot be provided. Marketing consent and optional analytics are not a condition of the service. The phone number, city and some vehicle details are voluntary, unless the interface specifies otherwise for a particular request.

16. Assessment of legitimate interests

For security, fraud prevention, moderation and the defense of legal claims, we pursue legitimate operational and legal interests and limit the scope, access and retention period. For the global VIN history, we pursue the trustworthy continuity of the history of vehicle care; we minimize the shared data to the VIN, the service, the date and the Studio, and we enable objections, corrections and the examination of an unauthorized record. For traffic measurement without cookies, we pursue the interest in knowing the extent and stability of the traffic. We store nothing on the device and the identifier is computed with a key that changes every day, so visits cannot be linked across days. Even so, it is pseudonymous personal data, which is why we limit its scope and retention period.

17. Children

The service is not intended for children under 16 to create an account on their own. If we find an account of a child without the necessary consent, we may request verification or remove the account.

18. Accuracy and responsibility of the individual roles

Each user is responsible for the accuracy of the data they provide. The Studio, as an independent controller, is responsible for the lawfulness of its CRM, communication and business relationship. This division does not limit Detailero's responsibility for its own purposes and means of processing, security, suppliers, handling of data subjects' rights and the lawfulness of the platform features.

19. Points of contact and supervision

Requests concerning data managed by Detailero: info@detailero.com. Technical incidents and content reports: support@detailero.com. The Czech supervisory authority is the Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz. A data subject in Slovakia may also turn to the Office for Personal Data Protection of the Slovak Republic, dataprotection.gov.sk.

20. More detailed sharing and disclosure

We disclose data only according to role: to the chosen Studio for an inquiry; to staff to the extent of their Studio's permissions; to infrastructure providers under a contract; to advisers bound by confidentiality; to authorities on the basis of a lawful request; and to the acquirer in a transformation or sale of the business, subject to appropriate safeguards. We do not sell CRM contacts or provide them to other Studios.

21. Operational communication and marketing

Without marketing consent, we may send messages necessary for the account, security, an inquiry, a payment, a change of terms or the exercise of rights. We send Detailero's own offers only with the appropriate authorization. A Studio's messages are governed by its purpose and legal basis; Detailero records unsubscribes and technically blocks further marketing to that extent.

22. Verification of requests and authorization

Before handling a request, we may reasonably verify identity, in particular through sign-in, e-mail confirmation or additional information. A representative must prove their authorization. A request may be refused or charged for only if it is manifestly unfounded or excessive and the GDPR allows it.

23. Portability, export and copies

For data processed on the basis of a contract or consent and by automated means, you can request portability in a structured, commonly used format, provided the statutory conditions are met. An export must not adversely affect the rights of other persons. Copies of public or legally retained data need not be removed from every independent system immediately.

24. Change of ownership and legal requests

In the event of a merger, transformation, investment or sale of the business, data may be disclosed to advisers and the acquirer to the necessary extent and under confidentiality. The new controller must respect the applicable legal bases and inform users. We assess requests from authorities in terms of jurisdiction, scope and lawfulness, where the law allows us to review them.

25. Security limitations

We take measures appropriate to the risk, but no internet system can be described as absolutely secure. The User protects their device and sign-in credentials. This notice does not limit Detailero's statutory obligation to secure the processing or its liability for breaching this obligation.