Privacy Policy

Last updated: 21 July 2026

This Privacy Policy explains how BuyCar.tech OÜ ("GAC", "we", "us") collects and uses personal data when you use the GAC platform and this website.

We are the data controller for that data.

BuyCar.tech OÜ
Narva mnt 5, 10117 Tallinn, Harju maakond, Estonia
Registry code: 17094494
Data protection contact: [email protected]

We have not appointed a Data Protection Officer, as we are not required to.

1. What data we collect

Account data. Your email address, the plan you chose (Personal or Dealer), your account role, and the one-time codes we send you to sign in.

Business data (dealers). Company name and details you enter, listings, vehicle data, photos and documents you upload.

Deal data. Deals and rentals you take part in, their status, dates, prices, counterparties, and messages exchanged through the Platform.

Wallet data. The public blockchain address you link to your account, and the on-chain transactions connected to your deals. Public addresses and on-chain transactions are permanently public by the nature of the blockchain.

Payment data (dealers). Subscription status, billing period, invoices and payment history. We never see or store your full card number — card details are entered on Stripe's own pages and stay with Stripe.

Telegram data. If you use the Telegram mini-app or notifications, your Telegram user ID and the identifiers Telegram passes to us.

Technical data. IP address, browser and device information, and server logs generated when you use the Platform.

We do not knowingly collect data from anyone under 18, and we do not collect special-category data (health, biometrics, political views and similar).

2. Why we use it and on what legal basis

• Creating and running your account, signing you in — to give you the service you asked for. Legal basis: contract.
• Running deals, escrow and rentals — to perform the service. Legal basis: contract.
• Billing the Dealer subscription — to take payment for the plan. Legal basis: contract.
• Sending service notifications (deal status, requests, overdue rentals) — to let you use the service. Legal basis: contract.
• Keeping the Platform secure, preventing fraud and abuse — to protect users and us. Legal basis: legitimate interest.
• Keeping accounting and transaction records — Estonian law requires it. Legal basis: legal obligation.
• Answering your support requests — to help you. Legal basis: contract / legitimate interest.
• Sending marketing emails, if we ever do — to tell you about the product. Legal basis: consent, withdrawable at any time.

3. Who we share it with

We do not sell your personal data. We share it only with the service providers we need to run the Platform:

• Stripe — card payments and subscription billing. EU / USA.
• Amazon Web Services (SES) — sending emails, including sign-in codes. EU / USA.
• Telegram (Bot API) — delivering notifications and running the mini-app. International.
• Hetzner — hosting our servers and database. Germany / Finland (EU).
• Cloudflare — hosting and delivering this website. EU / USA.

We also share data with other users of the Platform when a deal requires it — a seller sees who is renting their car, a renter sees the dealer they are dealing with — and with third-party partners (inspection, logistics, insurance) when you choose a deal that involves them.

We may disclose data to authorities where the law requires it, and to advisers or an acquirer in the context of a corporate transaction.

4. International transfers

Some of our providers process data outside the European Economic Area, mainly in the United States. Where that happens, transfers rely on the safeguards permitted under GDPR Chapter V — the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

5. Blockchain data — please read this

6. How long we keep it

• Account and deal data — for as long as your account exists, and up to 3 years after you close it, so we can handle disputes and claims.
• Accounting and payment records — 7 years, as required by Estonian law.
• Server logs — normally up to 12 months.
• Support correspondence — up to 3 years.
• On-chain data — permanently, by the nature of the blockchain (see Section 5).

7. Your rights

Under GDPR you have the right to:

• access the personal data we hold about you;
• rectify data that is wrong or incomplete;
• erase your data ("right to be forgotten"), subject to Section 5 and to records we must keep by law;
• restrict or object to processing based on legitimate interest;
• portability — receive your data in a machine-readable format;
• withdraw consent at any time where processing is based on consent;
• complain to a supervisory authority.

To exercise any of these, write to [email protected]. We answer within one month.

If you are unhappy with how we handled it, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or to the authority in your own EU country.

8. Security

We use encryption in transit (HTTPS), access controls, and hosting inside the EU. Sign-in uses one-time codes sent by email rather than stored passwords. Card data never touches our servers.

No system is perfectly secure. If a data breach puts your rights at risk, we will notify you and the supervisory authority as GDPR requires.

9. Cookies

This website uses only the cookies and local storage that are strictly necessary to run it — keeping you signed in and remembering your basic preferences. We do not use advertising or tracking cookies.

10. Changes to this policy

We may update this policy. The date at the top always shows the current version, and we will notify registered users by email about material changes.

11. Contact

Questions about your data, and any other enquiry: [email protected]