Privacy Policy

Introduction

This Policy explains what personal data HelvAuto collects when you use the service, why we collect it, and what your rights are. We aim to collect as little as possible and to be transparent about what happens with what we do collect.

We operate under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR). The data controller is HelvAuto, contactable at privacy@helvauto.ch.

Data we collect

When you create an account: full name, email address, phone number, preferred language, and the canton you're based in.

When you list a car: every field you fill in (make, model, year, photos, description, location), plus the upload metadata of the photos.

Automatically: your IP address, the rough city it resolves to, basic device / browser information, and how you navigate the site (which pages, how long, what you click). This is operational data, used to keep the platform running and to spot abuse.

How we use it

We use your data to operate the service: to authenticate you, to render your listings, to put the right phone number on the right page when a buyer signs in to contact you.

We also use it to communicate with you about your account and your listings — confirmations when you submit a car, status updates when admin reviews it, occasional product announcements.

We do not sell your personal data, we do not share it with advertisers, and we do not use it to build a profile of you across other sites.

Cookies, tracking, and analytics

We use a small number of cookies. Some are strictly necessary (authentication, language preference) — without them the site doesn't work. We do not use third-party advertising cookies.

For analytics we use Plausible Analytics, an EU-hosted, privacy-friendly service. Plausible does not set cookies, does not collect personal data, and does not track you across other sites. The data we see is aggregated traffic — which pages are popular, where visitors are coming from, what they search for. It exists so we can invest editorial effort in the right places.

You can opt out of Plausible at any time via the cookie banner or the "Cookie preferences" link in the footer. We respect that choice immediately — the script unloads in-session without a reload.

Sharing with third parties

We share data with the third-party services that make HelvAuto run:

• Supabase (database + authentication, hosted in EU) — stores your account and listings. • Stripe (payment processing, Ireland) — processes paid features and photoshoots. • Resend (transactional email, US/EU) — sends the emails you receive about your listings. • Plausible Analytics (privacy-friendly analytics, EU) — receives aggregated, cookie-free usage data from your browser. • Cloudflare (CDN, global) — serves the static parts of the site.

Each of these acts as a processor under our instructions and is bound by their own data processing agreements. We list them by name so you can read their policies if you want.

How long we keep things

Account data: as long as your account is open, plus up to 12 months after closure for accounting and dispute-resolution reasons.

Listings: visible until you delete them. After deletion we keep a minimal record (slug, status, date) for analytics and to prevent duplicate-listing abuse.

Payment records: 10 years, as required by Swiss bookkeeping law.

Your rights

Under FADP and GDPR you have the right to:

• Access the personal data we hold about you. • Correct inaccurate data. • Ask for deletion of data we no longer need. • Receive your data in a portable format. • Withdraw consent at any time (e.g. via the cookie preferences button in the footer). • Lodge a complaint with the Swiss FDPIC or your local EU data protection authority.

To exercise any of these, email privacy@helvauto.ch from the address associated with your account. We aim to respond within 30 days.

Security

Passwords are stored hashed (we never see your plaintext password). Your data is held by Supabase under row-level security policies — you can only read your own data, and admin access is logged. We use HTTPS everywhere.

If we ever suffer a breach affecting your data, we'll notify you and the FDPIC within 72 hours of becoming aware of it.

Minors

HelvAuto is for users 18 and older. If we learn that a user is a minor, we delete the account.

Changes

We update this Policy when our practices change. Material changes are emailed to active accounts at least 14 days before they take effect.

Contact

For privacy-related questions or to exercise your rights: privacy@helvauto.ch.