Data Processing

1Purposes and legal bases

• Contract: analysing recordings, producing estimates, running accounts and subscriptions.
• Consent: using recordings to train our models, personalised advertising and marketing emails. You can withdraw consent at any time.
• Legitimate interest: security, fraud prevention, fair use limits and service quality.
• Legal obligation: tax, accounting and lawful requests from authorities.

2Categories of data

Sound recordings and their context, vehicle details, results and history, account and contact data, purchase status, device and usage data, and on the Free plan, advertising identifiers.

3Model training

Recordings used for training are pseudonymised: they are separated from your email and account and stored with a random identifier. They are used only to improve VroomScan's sound models and are not sold or shared for other purposes.

4Where data is processed

All personal data is stored and processed on Amazon Web Services EMEA SARL (AWS) infrastructure in the Frankfurt, Germany region (eu-central-1). AWS processes data only on our instructions under a data processing agreement that meets GDPR Article 28.

5Recipients

AWS for hosting, storage and processing; analytics and crash reporting providers; Apple and Google for payments; and advertising partners for the Free plan. Each processes data on our instructions or under its own privacy terms.

6Transfers abroad

• Users in the EU and EEA: your data is stored inside the EU, so hosting involves no transfer to a third country.
• Users in Türkiye: storing data in Germany is a transfer abroad under KVKK Article 9. We carry out this transfer under the standard contract published by the Personal Data Protection Authority, signed with AWS and notified to the Authority as required by law.
• Other providers: some analytics, app store and advertising providers may process limited data outside the EU or Türkiye. These transfers rely on the European Commission's Standard Contractual Clauses or adequacy decisions under GDPR, and on KVKK standard contracts for data from Türkiye.

7Retention

Data is kept for as long as needed for the purposes above. Account data is deleted within 30 days of account deletion. Purchase records are kept for the periods required by tax law.

8Your rights

Under KVKK Article 11 and GDPR Articles 15 to 22, you can learn whether your data is processed, request access, correction, deletion, restriction or portability, object to processing, and complain to the KVKK Authority or your local supervisory authority.