Privacy policy

Last updated: 27 October 2026

This policy explains what data the CarSpot app collects, why, and how you can control it, under the EU General Data Protection Regulation 2016/679 (GDPR). The Italian version is the reference text.

Data controller

Andrea Balloni, reachable at info@carspot-eu.com.

In short

• Faces and number plates are blurred on your phone before a photo is saved or sent. If blurring fails, the photo is not sent.
• The exact location of a photo stays on your device and only you see it on your map. Our servers only receive the area or neighbourhood.
• Usage statistics and error reports are optional and never contain photos, number plates or location.
• We don't sell your data and we don't show ads.

What data we process

• Account: email address or phone number, or the data Apple or Google share when you sign in with them (usually name and email).
• Profile: first and last name (private, other players can't see them), username and profile picture. Username and picture may be shown to other players, for example on leaderboards.
• Cards you capture: the already blurred photo, the recognised make and model, date and time, area or neighbourhood of the photo.
• Game data: experience points, level, completed missions, badges and in-game currency.
• Location: used on the device to show your map and assign an area to the card. The precise location never leaves your phone.
• Statistics and errors (only with your consent): how you use the app's features and technical information about malfunctions (iPhone model, iOS and app version).

Why, and on what basis

• Running the app (account, car recognition, saving and syncing your collection, missions): performance of the service you ask for, Art. 6(1)(b) GDPR.
• Usage statistics and error reports: your consent, Art. 6(1)(a). You can withdraw it at any time in Settings → Privacy → Anonymous statistics.
• Security and abuse prevention (for example limits on the number of recognitions): legitimate interest, Art. 6(1)(f).

Who processes the data for us

We use providers that process data on our behalf as data processors:

• Clerk (Clerk, Inc., USA): sign-in and account management.
• Supabase (servers in the European Union, Frankfurt): database and storage of card photos.
• An image recognition service: receives, through our server, only the already blurred photo to identify make and model.
• Mixpanel (data stored in the European Union): usage statistics, only with consent.
• Sentry (Functional Software, Inc., USA): error reports, only with consent.
• Apple and Google, if you choose to sign in with their account.

When data is transferred outside the European Union, the transfer relies on the Standard Contractual Clauses approved by the European Commission or other safeguards provided by the GDPR.

How long

We keep data while your account is active. If you delete your account, we delete your profile, cards and photos from our systems. Statistics are kept in aggregate form or deleted according to the providers' retention periods.

Your rights

You can ask to access, correct, delete, restrict, object to or receive a copy (portability) of your data by writing to info@carspot-eu.com. You can delete your account at any time from the app, in Settings → Account → Delete account.

If you believe the processing breaches the GDPR you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or the authority in your country.

Minimum age

CarSpot is meant for people aged 14 or over. If you are under 14, don't create an account.

Changes

If we change this policy we update the date at the top of the page and, for significant changes, let you know in the app.