Privacy Policy

This policy explains which personal data are processed by the Carspot mobile application and the website carspot.eazy-media.fr, why, for how long, and what your rights are. The data controller is EAZY MEDIA, a French SAS with a share capital of €100, Angers Trade Register no. 929 391 928, 21 rue du Pic Martin, 49190 Rochefort-sur-Loire, France — contact@eazy-media.fr.

2.1 Provided by the user

• Username, email address and password (stored hashed, never in clear text)
• Profile picture and profile customisation items (optional)
• Answers to the car-preferences questionnaire (optional)
• Published content: vehicle photos, comments, collections, messages

2.2 Collected automatically

• App usage data (screens viewed, interactions) and technical data (device model, operating system, language)
• Technical crash reports in the event of a malfunction
• Spot geolocation at the time of the photo, only if you allow it (see Section 3)

Adding a location to a spot is optional and relies on your system permission, which you can revoke at any time in your device settings. On the spot map (a Carspot Gold feature), only your own spots are shown to you at their exact position; other users' spots are never exposed individually — they are aggregated server-side into wide zones (several kilometres) as simple counts, with no identifier or photo. Users who enabled the location-privacy option are entirely excluded from the map.

Licence plates visible on published photos are blurred automatically. To identify the photographed vehicle (make and model), the photo is transmitted to technical identification providers acting as processors, solely for that purpose; this automated processing produces no decision with legal effects concerning you. When photographing in public spaces, you remain responsible for respecting people's image rights (Section 5 of the Terms).

• Providing the Service (account, spots, collections, rankings, messaging, Gold subscription) — performance of the contract (Art. 6(1)(b) GDPR)
• Content personalisation and recommendations — performance of the contract and legitimate interest
• Security, fraud and cheating prevention, moderation — legitimate interest (Art. 6(1)(f))
• Service improvement and internal statistics — legitimate interest
• Push notifications — consent (Art. 6(1)(a)), revocable in settings
• Spot geolocation — consent, revocable in settings
• Retention of certain data after the contract ends — legal obligations (Art. 6(1)(c))

Carspot does not sell, rent or trade any personal data. No identified or identifiable data (profile, email, location, spot history, or any combination allowing re-identification) is transmitted to third parties for commercial purposes, and no commercial profiling is carried out on behalf of third parties. Only strictly anonymous, aggregated statistics that do not allow any re-identification may be shared as part of partnerships.

Your data are however processed by technical processors, strictly on our behalf and under our instructions: database and photo hosting (Supabase, data hosted in the European Union), push notification delivery, technical error tracking, automatic vehicle identification, and subscription and payment management (Section 7).

Carspot never collects or stores your card number or bank details. Payments are processed by Apple (App Store), Google (Google Play) or Stripe (website purchases), each acting under its own privacy policy. Carspot only receives confirmation that a payment was made, along with the subscription type, its status and its dates.

To link your subscription to your Carspot account across devices and stores, we use RevenueCat, a subscription management provider. RevenueCat receives a pseudonymous account identifier and the purchase information transmitted by the store; it never receives your name or your payment details. Its privacy policy is available at revenuecat.com.

This processing is based on the performance of the contract (Article 6(1)(b) GDPR) and, for retention, on our legal obligations (Article 6(1)(c)). Subscription status data (active or not, expiry date, purchase channel) is kept for the duration of the subscription and for up to five years after it ends, the statutory limitation period for commercial claims; invoices, where they exist, are issued and kept by the payment processor for the period required by accounting law. Stripe and RevenueCat are established in the United States: transfers are covered by the EU-US Data Privacy Framework and/or the European Commission's standard contractual clauses.

• Account data and content: for the life of the account; account deletion (Settings › My account) is permanent and erases the profile and associated data
• Subscription status: for the duration of the subscription then up to 5 years (commercial limitation period)
• Usage data and technical logs: limited periods with automatic periodic purging
• Notifications: automatically purged after 6 months

Data are protected by appropriate technical and organisational measures: encrypted transport (TLS), hashed passwords, strict row-level access control in the database, automatic licence-plate blurring, and internal access limited to what is strictly necessary.

In accordance with the GDPR, you have the rights of access, rectification, erasure, objection, restriction of processing, withdrawal of consent and portability. The app lets you directly view and export your data (Settings › My data) and delete your account. For any other request: contact@eazy-media.fr. You may also lodge a complaint with the French supervisory authority, the CNIL (cnil.fr).

The Service is reserved for persons aged 15 or over, the age of digital consent in France (Article 45 of the French Data Protection Act).

The website only uses cookies and storage strictly necessary for its operation (including the login session for Carspot Gold checkout). No advertising cookies or third-party advertising trackers are set.

This policy may change; significant changes are announced through the app. For any question about your data: contact@eazy-media.fr.