1. Who we are

CarPulse (carpulse.al, carpulse.it and the CarPulse apps) is operated by Lorin & Co sh.p.k., Rruga Ibrahim Rugova, Tirana, Albania, which is the controller of your personal data. Privacy contact: privacy@carpulse.al · Phone / WhatsApp: +355696348280 We apply the EU General Data Protection Regulation (GDPR) and Albanian Law No. 124/2024 on personal data protection.

2. Data we collect

Account data: name, email, phone number, password (stored hashed), profile photo, and for dealers the business name, address, tax number and staff accounts. Listing data: vehicle details, VIN (optional), photos, price, location and description. Messages: chat messages, contact requests, test-drive and deposit requests, support tickets, and WhatsApp messages exchanged with our WhatsApp Business number. Payment data: plan, amounts, invoices and the payment reference. Card details are entered directly with Stripe; we never see or store the full card number. Usage and device data: IP address, device and browser type, app version, language, pages and listings viewed, searches, clicks and crash logs. Location: an approximate location derived from your IP address, the city you enter, and precise location only if you allow it in your device. Data from public sources: dealer stock and contact details that dealers publish on their own public pages, and, for sellers we contact about a free CarPulse listing, the public listing they published on another car-listing website (see section 7).

3. Why we use it, and on what legal basis

To run your account, publish listings, deliver messages and process payments (performance of the contract). To keep the marketplace safe: fraud and spam prevention, duplicate and fake-listing detection, security logs (legitimate interest). To measure and improve the service with analytics and session recordings (legitimate interest; consent where the law requires it). To advertise CarPulse and measure our ads, including Meta advertising audiences (legitimate interest; consent where the law requires it; see section 4). To send service emails, WhatsApp and push notifications such as saved-search alerts, payment receipts and renewal reminders (contract; marketing messages only with consent where required). To keep invoices and accounting records (legal obligation).

4. Advertising: Meta pixel, Conversions API and Custom Audiences

We advertise CarPulse on Facebook and Instagram (Meta Platforms Ireland Ltd). Meta pixel: our website sends Meta events such as page views, searches, sign-ups and purchases, together with cookies (_fbp, _fbc) and the Facebook click ID from the ad link. Conversions API: our server sends Meta the same kind of events (for example "registration completed" or "listing published") with hashed (SHA-256) identifiers such as your email address and phone number, so Meta can match them to its users and count ad results. Custom Audiences: we upload hashed (SHA-256) email addresses and phone numbers of CarPulse users to Meta to show our ads to existing users, to exclude them from ads, and to build lookalike audiences. Meta matches the hashes with its own users and deletes the ones that do not match. Meta does not receive the plain email or phone number. For these uses Meta and CarPulse are joint controllers for the collection and transfer of the data. You can object at any time by writing to privacy@carpulse.al; we will then stop using your data for advertising audiences. You can also manage ad preferences in your Meta account. On the website we also use Google Analytics 4 (aggregated traffic measurement) and Google Ads conversion tags (measuring which ads lead to sign-ups or listings). Google receives your IP address, device data and the pages you visit.

5. Analytics and session recordings

We use PostHog (EU cloud, eu.posthog.com, data hosted in the European Union) to understand how the website and apps are used: page views, clicks, searches and the steps of the selling and payment flows. For a sample of visits PostHog also makes session recordings (a replay of mouse movements, clicks and page content) so we can find bugs and confusing screens. Password and card fields are not recorded (card fields are Stripe's and never part of our page).

6. Who receives your data

Other users: the public parts of your listing and profile, and your messages to the person you write to. When you contact a dealer or request a test drive, financing or a deposit, the dealer receives your name, contact details and request. Service providers that process data for us under contract: • Hosting: Netcup GmbH (servers in the EU). • Payments: Stripe (card payments and Link), PayLink (older subscriptions in Albania). • Email: Resend (transactional emails such as receipts, alerts and password resets). • WhatsApp: Meta Platforms (WhatsApp Business messages from our official number). • AI features: OpenAI and Google (Gemini API) for listing text, photo and price analysis, the search assistant and the valuation tool. They receive the listing or question text and photos, not your account password or payment data. • Analytics: PostHog (EU). • Advertising: Meta (see section 4). • Location: ip-api.com, which receives an IP address and returns an approximate city (for visitors, and to fill in the city of older listings). • Push notifications: Expo (app notifications). Sign-in: Google and Apple, if you choose to sign in with them. Authorities, when the law requires it, and a buyer of our business, under this Policy. We do not sell your personal data.

7. Data from public listings (Art. 14 GDPR)

When we invite a private seller to publish for free on CarPulse, we may prepare a draft from the listing that seller published on another public car-listing website (make, model, price, photos, location and the phone number shown in the listing). We tell the seller which website the data came from, use it only to offer the free listing, and delete the draft on request through the link in our message or by writing to privacy@carpulse.al.

8. Dealers and the Dealer Platform

A dealer that receives a lead from CarPulse uses your request as its own controller, under its own privacy policy. When a dealer uses the CarPulse Dealer Platform to manage its own customers, leads, test drives, deposits and staff, CarPulse processes that data on the dealer's behalf as its processor, under the processor terms in section 12 of the Seller Agreement (Art. 28 GDPR).

9. International transfers

Some providers (Stripe, Resend, OpenAI, Google, Meta, Expo, ip-api.com) process data outside the EU and Albania, mainly in the United States. We rely on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework where the provider is certified.

10. How long we keep data

Account data: while your account is active and up to 24 months after deletion, to resolve disputes and meet legal obligations. Listings: up to 12 months after a listing is removed. Invoices and payment records: as long as tax law requires. Analytics data and session recordings: according to the retention settings of our analytics provider. Backups are kept for a limited period and then overwritten.

11. Your rights

You can ask to access, correct or delete your data, to restrict or object to processing (including Meta advertising audiences and analytics), to receive your data in a portable format, and to withdraw any consent at any time. Write to privacy@carpulse.al; we answer within 30 days. You can delete your account in the app. You can also complain to a data-protection authority: in Albania the Commissioner for the Right to Information and Personal Data Protection (idp.al), in Italy the Garante per la protezione dei dati personali (garanteprivacy.it), or the authority where you live.

12. Children

CarPulse is not intended for anyone under 16 and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.

13. Cookies

We use cookies and similar storage on the website and SDKs in the apps. The Cookie Policy lists them.

Cookie Policy

14. Changes to this Policy

We will tell you about material changes through the service or by email at least 14 days before they take effect.