Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

Креатив Идеа ЕООД (Creative Idea Ltd)
EIK: BG207742401
7700 Targovishte, 50 Trapezitsa St, Ent. A, Fl. 1, Apt. 2, Bulgaria
Email: [email protected]

2. Data We Collect

We collect the following categories of personal data:

Account data: your name, email address, and either a hashed password (if you register with email) or a Google account identifier (if you use Google Sign-In).
Vehicle data: all information you voluntarily enter about your vehicles — fuel records, insurance policies, vignettes, expenses, maintenance history, and reminders.
Session data: an authentication session token stored in our database and in a browser cookie, used to keep you signed in.
Payment data: your payment is handled entirely by Stripe. We receive only a Stripe Customer ID and subscription status — never your full card details.
Technical data: IP addresses and request logs retained briefly in standard server infrastructure logs for security purposes.

3. Purpose and Legal Basis

Purpose	Legal basis (GDPR Art. 6)
Providing the Vehicle Passport service	Art. 6(1)(b) — performance of a contract
Sending notifications you have configured	Art. 6(1)(b) — performance of a contract
Processing subscription payments	Art. 6(1)(b) — performance of a contract
Security and fraud prevention	Art. 6(1)(f) — legitimate interests

4. Data Processors (Third Parties)

We share data with the following third-party processors under appropriate data processing agreements:

Stripe, Inc. (USA) — subscription payment processing. Stripe is certified under the EU–US Data Privacy Framework. See stripe.com/privacy.
Resend — transactional email delivery (notification emails).
Hosting provider — cloud infrastructure on which the application runs. Data is stored within the EU or under equivalent safeguards.

We do not sell your personal data to any third party.

5. Data Retention

Active accounts: data is retained for as long as your account exists.
After account deletion: all personal data is permanently deleted within 30 days of your deletion request.
Payment records: retained for 5 years as required by Bulgarian accounting legislation (Закон за счетоводството).

6. Your Rights Under GDPR

You have the following rights regarding your personal data:

Right of access — request a copy of the data we hold about you.
Right to rectification — correct inaccurate data.
Right to erasure — delete your account and all associated data at any time via Settings → Delete account, or by contacting us.
Right to data portability — receive your data in a machine-readable format.
Right to restriction of processing.
Right to object to processing based on legitimate interests.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

7. Cookies

Vehicle Passport uses only strictly necessary cookies: a single session cookie that keeps you authenticated. This cookie is essential for the service to function and does not require your consent under the ePrivacy Directive.

We do not use analytics, advertising, or tracking cookies. No third-party cookies are set by our application.

8. Supervisory Authority

If you believe we have processed your personal data unlawfully, you have the right to lodge a complaint with the Bulgarian supervisory authority:

Commission for Personal Data Protection (КЗЛД / CPDP)
Website: www.cpdp.bg
Address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd, Bulgaria

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email at least 30 days before they take effect. The current version is always available at this URL.

10. Contact

Questions about this Privacy Policy? [email protected]