Privacy policy

Carnoat is built to keep personal details out of sight: names and addresses are removed from copies of your documents, a car's documents and its owner's identity are never shown in public (a car is shown in public only when its owner offers it openly), and identities are only exchanged after both sides have been verified. This policy explains which personal data we process, why, and what you can do about it.

Who is responsible

DMOTIV BV, Pampa 3, 2330 Merksplas, Belgium, VAT BE 1038.924.933, is the controller of your personal data. For anything about privacy, write to privacy@carnoat.com.

What we process, and why

Data	Why	Legal basis
Your account: name, email address, language, password (stored as a hash), sign-in methods	To give you an account and keep it secure	Contract
If you sign in with Google: your Google account's name, email address and an identifier	To sign you in	Contract
A profile photo, if you add one, or your Google photo at your first sign-in if you have none	To show you in your account and, once you share your details in a conversation, to the other side	Contract
Documents, photos and video you upload, and what we read from them	To build your car's history, as you ask us to	Contract
The number plate you give a car	To file documents that name it with the right car; only you see it, and it doesn't pass with a sale	Contract
A car you offer: price, mileage, your description, the town and how precisely to show it, and its photos	To show it to buyers as you choose. A car offered openly is shown in public and can be found by search engines; a discreet car only as an anonymous profile, at most its province	Contract
Questions and conversations between a buyer and an owner	To let you talk about a car without exchanging contact details. Our team reads a conversation only when one of you reports it	Contract and legitimate interest
Cars you save, compare or follow for a lower price	To keep your list and tell you when a price drops; the owner sees how many people saved the car, never who	Contract
Views of a car on offer	To tell its owner how many people looked, per day. A visitor is counted by a code made from the day, their IP address and browser, kept only until midnight and never stored with anything else	Legitimate interest
A report about an advertisement: your email address (if you have no account), what you report and how it was handled	To act on it, tell you the outcome and tell the owner why, without naming you	Legal obligation (Digital Services Act) and legitimate interest
A fingerprint of each photo of a car on offer	To find photos copied from another owner's car	Legitimate interest
Your identity check: the outcome and a reference at Didit	Before names, documents or a viewing pass between a buyer and an owner, and before a question about a discreet car, to prevent fraud	Contract and legitimate interest
A business account: the business's details, its VAT number and the answer of the EU VAT register (VIES), and who works for it	To check a garage or dealer before its name appears on Carnoat	Contract and legitimate interest
An invoice a garage sends you: your email address and the invoice, as the garage gave them	To let you file it in your archive or decline it; the garage is responsible for having your address	Legitimate interest
A handover link or a team invitation: the email address it was sent to	To let only that person accept it	Contract
Payments: what you bought and when; card details stay with Stripe	To deliver and invoice what you ordered	Contract and legal obligation
Searches on the marketplace and the filters read from them	To show results, send match alerts, and detect attempts to map the marketplace	Contract and legitimate interest
Messages to us, reports and their handling	To answer you and keep the platform safe	Legitimate interest
Your WhatsApp number, if you opt in	For urgent messages only, never marketing	Consent
Browser notifications, if you turn them on for a device: that device's push address	To send a notification's subject to that device; turning them off removes it	Consent
Technical data: IP address, browser, error reports without personal content	Security and keeping the service running	Legitimate interest
Analytics, only if you allow it	To understand how Carnoat is used and improve it	Consent

Documents and redaction

Your original documents are encrypted and visible only to you. We make a copy with personal details blacked out; that copy is shown to a buyer only after a moderator has approved it and you have chosen to share it. Details of businesses (a garage's name, address or VAT number) stay visible, because they are not personal data and they matter to a buyer.

Who else processes data for us

We work with a small number of processors, each under a contract that binds them to our instructions:

• hosting in the European Union (TransIP, the Netherlands), and encrypted backups with Google Cloud in Belgium;
• Didit, for identity checks;
• Google, to sign you in if you choose to sign in with Google;
• Stripe, for payments;
• OpenAI and Anthropic, to read documents, understand marketplace searches, translate the descriptions of cars on offer and answer help questions; they do not use this data to train their models;
• Brevo, to send email;
• the push service of your browser (for example Google, Apple or Mozilla), only if you turn on browser notifications; it passes an encrypted message to your device;
• Cloudflare, which delivers this website and checks the public forms (signing up, a forgotten password, contact, the help assistant) for automated abuse with Turnstile, which sees your IP address and browser details for that check and sets no tracking cookies;
• an error tracker in the EU, which receives error reports stripped of personal data;
• Google Analytics, only if you allow analytics.

Some of these providers are based in the United States. Transfers outside the European Economic Area rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework or on standard contractual clauses.

How long we keep data

• Your account and your original documents: for as long as you have the account.
• After you delete your account: everything is erased after 30 days, except the history of a car you sold through a confirmed sale, which stays with that car and its new owner.
• Proof of payment and chassis number photos sent for a check: deleted once a moderator has decided; only the decision is kept.
• A record of who did what and when (not the content): kept for fraud prevention and dispute resolution.
• Backups: up to 30 days. Data you or we delete in the service can remain in a backup for up to 30 days more, encrypted and unused, until that backup expires.
• Invoices: 7 years, as Belgian law requires.
• Conversations between a buyer and an owner: for as long as both accounts exist; when either is erased, the conversation is erased with it.
• Reports about an advertisement and their handling: for as long as the Digital Services Act requires us to account for them.
• An invoice a garage sent you that you neither filed nor declined: removed after 90 days.
• Your identity check: kept by Didit for as long as anti-money-laundering law requires, often 5 years or more, independently of your account at Carnoat.

Your rights

You can see, correct, export and delete your data. Most of this you can do yourself in your settings: download a copy of everything, delete a document, or delete your account. You can also object to processing based on our legitimate interest, withdraw consent at any time (for analytics, in the cookie settings), and ask us to restrict processing. Write to privacy@carnoat.com; we answer within a month.

If you are not satisfied with how we handle your data, you can complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, www.dataprotectionauthority.be.

Cookies

Which cookies we use, and how to change your choice, is set out in the cookie policy.

Changes

When we change this policy, we update the date at the top. We tell you about important changes by email.