Privacy Policy

1. Introduction

Welcome to CarClan. We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, store, and protect your information when you use our car sharing expense management service.

CarClan is operated from within the European Union and complies with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Name (first and last name)
• Email address
• Password (encrypted)

2.2 Usage Data

When you use CarClan, we collect:

• Trip information (dates, distances, odometer readings, descriptions)
• Expense information (amounts, descriptions, dates)
• Group membership and settings
• Car details (names, registration details, specifications)
• Settlement history and financial balances within groups

2.3 Technical Data

We automatically collect certain technical information:

• IP address
• Browser type and version
• Device information
• Page visit data and navigation patterns
• Time zone and location data

3. How We Use Your Information

We use your personal data for the following purposes:

• Service Provision: To provide and maintain our car sharing expense management service
• Account Management: To create and manage your user account
• Group Coordination: To facilitate expense sharing and settlements between group members
• Communications: To send you service-related notifications and updates
• Analytics: To understand how our service is used and improve user experience
• Security: To protect against fraud, abuse, and security threats
• Legal Compliance: To comply with legal obligations and enforce our terms

4. Legal Basis for Processing (GDPR)

Under GDPR, we process your personal data based on:

• Contractual Necessity: Processing necessary to provide our service to you
• Consent: Where you have given explicit consent for specific purposes
• Legitimate Interests: For analytics, security, and service improvements
• Legal Obligation: To comply with applicable laws and regulations

5. Data Storage and Security

Your data is stored securely using industry-standard encryption and security practices. We use trusted third-party service providers to host and manage our infrastructure, all of whom are required to maintain appropriate security measures and comply with GDPR requirements.

While we implement strong security measures, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security but continuously work to protect your information.

6. Data Sharing and Third Parties

Current Practice: We do not sell, rent, or share your personal data with third parties for their marketing purposes.

6.1 Service Providers We Use

To provide our service, we work with the following trusted third-party service providers:

• Supabase: Database hosting, authentication, and backend infrastructure (EU-based servers)
• Vercel: Application hosting and content delivery

These providers have access to your data only to perform specific tasks on our behalf and are obligated to protect your information in accordance with GDPR requirements.

6.2 What Group Members Can See

When you join a car sharing group, other group members can see:

• Your name (first and last name)
• Trip data for trips you participated in
• Expense data for expenses you paid or participated in
• Your financial balance within the group
• Settlement information involving you

Group members cannot see your email address, password, or data from other groups you belong to.

6.3 Other Data Sharing

• Legal Requirements: When required by law, court order, or to protect our rights
• Business Transfers: If CarClan is acquired or merged, your data may be transferred to the new owner

Future Changes: If we plan to share your data with additional third parties in the future (such as for marketing or analytics purposes), we will update this policy and notify you. Where required by law, we will obtain your explicit consent before any new data sharing practices.

7. Analytics and Cookies

We use analytics tools to understand how users interact with our service. This helps us improve functionality and user experience. These tools may collect data about your visits, including pages viewed, time spent, and navigation patterns.

We use essential cookies necessary for service functionality. We may use additional analytics or marketing cookies in the future, and will provide appropriate notice and consent mechanisms if we do.

8. Your Rights Under GDPR

As an EU resident, you have the following rights:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data
• Right to Restriction: Limit how we process your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us at contact@carclan.app

9. Data Retention and Account Deletion

We retain your personal data for as long as your account is active or as needed to provide our service. You have the right to delete your account at any time.

9.1 How to Delete Your Account

To delete your account, please follow these steps:

1. Log into your CarClan account
2. Navigate to your Profile settings
3. Ensure all your balances (both distance and cash) are zero in all groups
4. Leave all groups you are a member of
5. Click the “Delete Account” button

9.2 Account Deletion Requirements

Important: Your account can only be deleted if all your distance and cash balances are zero across all groups. This requirement exists to ensure all financial obligations are settled before account deletion. If you have outstanding balances, you must first settle them with other group members before deleting your account.

9.3 What Gets Deleted

When you delete your account, we will remove:

• Your email address
• Your password and authentication credentials
• Your profile information (except as noted below)
• Your ability to log into the service

9.4 What Gets Retained

To maintain the integrity of settlement reports and financial records for other users in your former groups, we will retain:

• Your name in historical transactions, trips, expenses, and settlements
• Transaction records that you participated in
• Settlement history involving you

This retention is necessary to:

• Preserve the accuracy and completeness of financial records for other group members
• Maintain audit trails for settled expenses
• Prevent disputes about past transactions
• Comply with potential legal and accounting obligations

This limited data retention is based on our legitimate interest in maintaining accurate financial records and is the minimum necessary to achieve this purpose. If you have concerns about this retention, please contact us at contact@carclan.app to discuss your specific situation.

10. International Data Transfers

Your data may be processed in countries outside the European Economic Area (EEA). When we transfer data internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or adequacy decisions by the European Commission.

11. Children's Privacy

CarClan is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children under 16. If you become aware that a child has provided us with personal data, please contact us and we will take steps to delete such information.

12. Changes to This Privacy Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the new policy on this page and updating the “Last Updated” date. For significant changes, we may provide additional notice such as email notification.

13. Contact Us

If you have any questions, concerns, or requests regarding this privacy policy or our data practices, please contact us:

Email: contact@carclan.app

You also have the right to lodge a complaint with your local data protection authority if you believe your data protection rights have been violated.