1. Who We Are
cardots ("we", "us", "our") is a social discovery platform for car enthusiasts, operated by RT Design Studio SRL. Our platform is accessible at cardots.net.
For any privacy-related questions, contact us at [email protected].
2. Data We Collect
We collect the following categories of personal data:
Account data - Your email address, username, full name, and profile photo. Collected when you create an account or update your profile.
Content you create - Photos you upload, titles, descriptions, external URLs, and topic tags you add to dots and collections.
Social activity - Likes, saves, comments, follows, and other interactions you make on the platform.
Profile information (optional) - Social media usernames (Instagram, Facebook, YouTube) that you voluntarily add to your profile.
Usage data - Pages visited, features used, and interaction patterns - collected to improve the platform. This data is aggregated and not used to build individual profiles.
Technical data - IP address, browser type, and device information - collected automatically when you use the Service.
3. How We Use Your Data
We use your data for the following purposes:
- To provide and maintain the cardots platform and your account
- To display your public profile and content to other users
- To send in-app notifications about activity related to your content
- To send transactional emails (e.g., sign-in links)
- To detect and prevent abuse, spam, and violations of our Terms of Service
- To improve the platform based on usage patterns
- To comply with legal obligations
4. Legal Basis for Processing (GDPR)
For users in the European Union, our legal bases for processing personal data are:
- Contract: Processing necessary to provide the Service you signed up for
- Legitimate interests: Improving the platform, preventing abuse, and ensuring security
- Consent: Where you have explicitly opted in (e.g., optional profile fields)
- Legal obligation: Where required by applicable law
5. Data Sharing
We do not sell your personal data. We share data only in the following limited circumstances:
- Service providers (processors): We use Supabase (database and authentication), Hetzner (hosting), Cloudflare (CDN, DNS, and TLS), Resend (transactional email), Upstash (rate-limit cache), Anthropic (AI keyword generation on opt-in), and Google (Analytics, only after you grant consent). These providers process data on our behalf and are bound by data processing agreements.
- Public content: Dots, collections, and profile information you mark as public are visible to all users of the platform and may be indexed by search engines.
- Legal requirements: We may disclose data if required by law or in response to valid legal requests.
6. Chrome Extension
The cardots browser extension accesses images and page metadata (Open Graph title, description, and image) only on pages where you actively interact with it by hovering over an image and choosing to save it.
The extension does not collect your browsing history, keystrokes, passwords, or any data from pages you visit without directly interacting with the extension.
7. Data Retention
We keep personal data only as long as necessary for the purposes for which it was collected, and according to the following schedule:
- Account data - until account deletion, then up to 30 days in backups.
- Your content (dots, collections, comments) - until you delete it or your account, then up to 30 days in backups.
- IP addresses and request logs - up to 90 days in raw form, then hashed or deleted.
- Moderation and audit logs - up to 12 months.
- Copyright takedown records - up to 24 months.
- Legal-hold data - retained as required by law or to defend legal claims.
8. Your Rights (GDPR)
If you are in the European Economic Area, you have the following rights:
- Access: Request a copy of the personal data we hold about you
- Rectification: Correct inaccurate or incomplete data
- Erasure: Request deletion of your personal data ("right to be forgotten")
- Portability: Receive your data in a structured, machine-readable format
- Objection: Object to processing based on legitimate interests
- Restriction: Request that we limit processing of your data
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.
You can delete your account at any time from Settings.
8A. Swiss Data Protection (nLPD)
If you are in Switzerland, you have rights under the Swiss Federal Act on Data Protection (nLPD), including the right to access, rectify, delete, and object to processing of your personal data. You may lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch.
9. Cookies
cardots uses essential cookies for authentication and preference storage. With your consent, we also use Google Analytics to understand how visitors use our platform - Google Analytics is loaded with Google Consent Mode v2 and receives only cookieless pings until you grant consent.
You can review the cookies we use and change your preferences at any time on our Cookie Policy page.
10. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, or destruction. All data is transmitted over HTTPS. Authentication tokens are handled by Supabase Auth with industry-standard security practices.
11. International Transfers
Our service providers (Supabase, Hetzner, Cloudflare, Resend, Upstash, Anthropic, and Google) may process data in data centres located outside the European Economic Area, including the United States. Where this occurs, we rely on Standard Contractual Clauses and other safeguards required by the GDPR and the Swiss nLPD.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a new "Last updated" date. For significant changes, we may also notify you by email.
13. Contact
For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at [email protected].