Privacy policy

Who we are

AutoTimi (autotimi.gr) is a used-car valuation service for the Greek market. The operator of autotimi.gr is the data controller for the personal data described on this page.

For anything concerning your data, write to info@autotimi.gr.

What we collect and why

We collect only what each service you use needs to work. By service:

• Valuation. The vehicle details you enter (make, model, year, mileage, fuel, region and, if you provide them, a plate number or VIN), the result, an anonymous session identifier and your browser type. We use these to compute the valuation, to show your history if you have an account, and to improve the pricing model.
• Account. If you sign in, authentication is handled by Clerk. We keep your email address, your Clerk user id, your language and your sign-in dates.
• Payments. Payments are processed by Stripe. We never see or store card details. We keep your Stripe customer and subscription ids, your plan, its status and your credit balance.
• Free usage. To meter free valuations without an account, your browser generates a random device identifier stored locally (localStorage) that accompanies your requests. It contains no personal details, and you can remove it by clearing this site’s data in your browser.
• Dealer offer requests. If you ask for a dealer offer we keep your name, phone number, optionally your email, your preferred contact method and the time you gave consent. Only the one dealer who claims your request sees your contact details. Other dealers see the vehicle and region only.
• Assistant. Your messages and the replies are stored as a conversation linked to your account or device. To generate a reply, the text of your messages is sent to Google’s Gemini API. You can delete any conversation from the assistant page, and it is removed from our database immediately.
• Verify from a registration document. The file you upload is processed in memory and never written to disk or object storage. We keep only the consent event, the vehicle fields extracted, and a cryptographic hash of your IP address to prevent abuse.
• Report by email. If you ask for the valuation report by email we keep the address, the language and the request and send timestamps.
• Dealer accounts. For dealer subscribers we keep name, company, email, phone, region, and the stock and watchlists they enter.
• Listing analysis. If you paste a listing link, we keep the link and the public vehicle details from the ad so we can tell you whether the price is fair.

Public market data

Our prices are built from public used-car listings on Greek classifieds sites. From each listing we keep the vehicle details, the price and whether the seller is a private individual or a dealer. We do not collect sellers’ names, phone numbers or other contact details.

Legal basis

• Performance of a contract for the valuation, your account, payments, the assistant and the emailed report: without this data the service cannot be provided.
• Consent for dealer offer requests and for processing a registration document. You can withdraw it at any time.
• Legitimate interest for keeping the service secure, metering free usage, and improving the pricing model with anonymised valuation data.

Cookies and local storage

We use no advertising cookies and no third-party trackers. Everything stored in your browser is strictly necessary for the service to work:

• Clerk’s session cookies, so you stay signed in.
• A language preference cookie, when you switch language.
• The free-usage device identifier, in localStorage.

Who we share data with

We do not sell personal data. We use the following providers, each only for the purpose stated:

• Clerk - sign-in and account management.
• Stripe - payments and subscriptions.
• Vercel - website hosting.
• Google Cloud - API hosting in the europe-west1 region (Belgium), and the Gemini API for the assistant, document verification and market research.
• Neon - database, in the eu-central-1 region (Frankfurt).
• Resend - email delivery.
• The dealer who claims your request, only if you ask for an offer and only the contact details you gave for that purpose.

Some of these providers are based in the United States. Where data is processed outside the EU, this is done under the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

Google user data and Google APIs

AutoTimi’s operator authorises AutoTimi’s own internal tools to read data from Google accounts that belong to AutoTimi. This section describes that access, as Google’s API policies require.

• What is accessed. Search Console data for autotimi.gr (impressions, clicks, positions and index status for our own pages), and Google Ads keyword-planning data (estimated monthly search volume and competition for a list of Greek search terms we supply). Both belong to our own accounts.
• Whose data it is. Only the operator’s own Google accounts. We do not access the Google account of any visitor or customer, and signing in to AutoTimi gives us no access to your Google account.
• How it is used. Solely to decide which pages and articles to publish, and to monitor how our own pages perform in search. It is not used for advertising, not combined with your personal data, and not used to train machine-learning models.
• Who it is shared with. Nobody. It is not published on the site, not sold, not transferred to third parties, and not shown to visitors.
• Where it is stored. On the operator’s own computer, as a local cache kept for at most 24 hours, together with dated records of the figures used to make a decision. Credentials are stored in a file readable only by the operator’s user account.
• Limited use. Our use of data from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

How long we keep it

• Account data, for as long as your account is active and until you ask us to delete it.
• Assistant conversations, until you delete them or they expire.
• Dealer offer requests, for as long as it takes to complete contact with the dealer and until you ask for their deletion.
• Payment records, for as long as tax law requires.
• Valuations made without an account are not linked to you beyond the anonymous session identifier, and are kept as anonymised statistics to improve the model.

Your rights

Under the General Data Protection Regulation (GDPR) you have the right of access, rectification, erasure, restriction of processing, portability, objection, and to withdraw consent.

To exercise any of them, write to info@autotimi.gr. For deleting your account and data, the exact steps are on the Delete your data page. We reply within 30 days.

If you believe the processing breaks the law, you can lodge a complaint with the Hellenic Data Protection Authority (dpa.gr).

Children

The service is intended for adults. We do not knowingly collect data from anyone under 16.

Changes

When the way we process data changes, we update this page and the date at the top of it.