Privacy Policy

1.In short

We collect only what the app needs to work: your email address for signing in, and whatever you record about your car. We do not sell data, do not share it with ad networks and do not show ads.

The data controller is Ivan Bobrov. Questions and requests: support@carnote.fun.

2.What data we process

Account. The email address and display name received from Apple or Google at sign-in, and an internal sign-in identifier. We never receive or store passwords.

Car. Make, model, generation, year, engine, displacement, power, emission class, transmission, body, colour, VIN, registration plate, mileage, purchase date, the name you gave the car, and insurance policy dates.

Records and servicing. Dates, categories, amounts, currency, litres, odometer readings, descriptions and notes; completed-job marks; reminders; calculated service intervals.

Photos. Receipt and invoice photos attached to records; document photos (registration certificate, title, insurance policy, licence) that you added yourself; car photos and the images generated from them; photos attached to a chat message or to a problem report.

AI assistant conversation. The text of your questions and the assistant’s answers, and any photo attached to a question.

Subscription. The plan, its expiry and monthly usage counters. We never receive card details: payment happens entirely in the App Store.

Problem reports. The message text, the app version and build, the OS version, the device model, the selected car and a screenshot if you attached one.

Notifications and activity. If you allowed notifications — the device token for push notifications (APNs), the device model, app version, language, your chosen reminder time and the device’s time zone, so that server-side reminders arrive at the right hour in your local time. The date the app last contacted the server, updated at most once an hour: it tells us whom to remind about due dates when they have not opened the app for a long time and their phone will no longer remind them itself. When you open the subscription or attempt-pack screen — the time and the part of the app it was opened from: this tells us which features people care about. The app has no third-party analytics.

We do not collect your location or contacts, and we do not track you across other apps and websites.

3.Why, and on what basis

Data is processed to perform our contract with you — that is, so the app does what you installed it for: keeps your records, computes statistics and due dates, recognises documents and answers questions. Problem reports are processed on the basis of our legitimate interest in fixing bugs.

Processing is based on the consent you give by starting to use the app, and which you can withdraw by deleting your account.

Sending data to OpenAI for the AI features is based on a separate consent that you give in the app itself and can withdraw in Profile → AI features (OpenAI).

4.Who we share data with

OpenAI (OpenAI, L.L.C., USA) — for the AI features. Data is sent there only if you allowed it: before the first AI action the app shows a “Carnote uses AI from OpenAI” dialog listing what is sent and to whom, with “Allow” and “Not now” buttons. You can withdraw the permission at any time in Profile → AI features (OpenAI). Without it the AI features do not work; everything else in the app does.

Only what a specific action that you start needs is sent: a photo of a receipt, invoice, document or the odometer for recognition; a voice recording for transcription into text; the question text together with your car’s data and recent records for the assistant’s answer; a photo of your car for its portrait and the Try-on studio; the car’s make, model, year and mileage for the service schedule and tips. We instruct the model not to return the owner’s name and address from documents, and we do not store them.

OpenAI processes this data under a Data Processing Addendum and protects it at least as well as we do: data received through the API is not used to train OpenAI’s models and is kept by OpenAI for no longer than 30 days for abuse monitoring, after which it is deleted.

Apple and Google — signing in. We receive an email address and an identifier from them, and they learn that you signed in to Carnote.

Apple — subscription payment. RevenueCat — purchase bookkeeping and subscription restoration; your account identifier in our service and purchase details are sent there.

Apple (APNs) — push notification delivery. To show a reminder we send Apple your device token and the notification text.

Telegram — delivering problem reports to us. A copy of each report — its text, the attached screenshot, the app version, the device model and your account’s email address — is forwarded through the Telegram Bot API to our internal chat so that we see it right away. Nothing is sent there for any other purpose.

We do not share data with ad networks or data brokers.

5.Where data is stored

The server and database are in a data centre in Amsterdam, the Netherlands. The connection with the app is protected by TLS. The providers listed above process data on their own servers, including outside the European Union.

6.How long we keep it

Data is kept while your account exists. Public report links live for 30 days and switch off automatically, or at any moment on your command. Problem reports are kept for up to a year.

7.Your rights

If you are in the European Union, the General Data Protection Regulation (GDPR) applies to you. Wherever you live, we honour the rights below for everyone.

• Access. Obtain a copy of the data we hold about you.
• Rectification. Correct data that is wrong or incomplete.
• Erasure. Ask us to delete your data and your account.
• Restriction. Ask us to pause processing while a dispute is resolved.
• Objection. Object to processing we carry out under our legitimate interests.
• Portability. Receive your data in a machine-readable form and take it to another service.
• Withdrawing consent. Where processing rests on your consent, withdraw it at any time; this does not undo what was done before.

Most of this you can do yourself, without asking us:

• Records, cars, reminders and documents can be corrected and deleted right in the app.
• Export your history in Profile → Export data: a PDF report or a link.
• To delete your account with all its data, go to Profile → Account → Delete account. Everything is removed immediately and irreversibly; backups are overwritten within 30 days.
• The only things kept after deletion are an irreversible digital fingerprint of the sign-in method (Apple or Google) and the number of free car renders already used. The fingerprint cannot be turned back into you, your email or your identifier; it exists only so that free renders do not start over if you sign in again the same way.

For anything else write to support@carnote.fun from the address the account is registered to. We answer within one month, as the regulation requires; if a request is complex we will tell you the deadline is extended and why. We do not charge for this.

We do not make decisions about you based solely on automated processing that produce legal effects. The assistant’s suggestions are advice you are free to ignore.

If you believe we process data incorrectly, write to us and we will look into it. You also have the right to lodge a complaint with the data protection authority in your country of residence.

8.Public report links

When you create a report link it contains what you chose on the export screen: the car details, the list of records and, with your consent, amounts, the VIN and receipt photos. The page opens for anyone holding the link, without signing in. The address contains a random key, but a link can be forwarded — send it only to people you trust and revoke it when it is no longer needed.

9.Children

The app is not intended for children under 13, and we do not knowingly collect their data.

10.Changes to this policy

We may change this policy. The date of the last change is shown at the top of the page; we will surface material changes in the app.

11.Contact

Questions about data and deletion requests: support@carnote.fun.