Privacy notice
Who handles your data, why it is used and how to exercise your rights.
Data controller
Antonio Nikolaev Nikolov, trading as Carspecy
2 Todorini Kukli, Sofia 1280, Bulgaria
support@carspecy.com
Data and purposes
We process technical request/security information to operate and protect the website; vehicle queries and correction submissions; Support correspondence; advert text, optional listing URL and buyer inputs; order, consent, payment-status and delivery records; and withdrawal requests. Stripe collects payment-card details on its checkout. Carspecy receives transaction references/status and the delivery email, not full card numbers. Do not paste unnecessary personal or sensitive data into an advert or support message.
Legal bases
Order preparation, report delivery and responding to contractual requests use the contract or steps you request before a contract. Security, debugging and reviewing catalog corrections use legitimate interests in operating a reliable service, subject to your rights. Required financial records and consumer-rights handling use applicable legal obligations. We do not treat acceptance of terms as consent to advertising. We do not sell your personal data.
AI-assisted research
Advert text and the vehicle context are sent to OpenAI to research and review the report. Controlled source requests may disclose a public source URL to the source website; they are not requests to inspect your car. AI can make mistakes. Reports support your own decision and do not determine eligibility for credit, insurance, employment or another legally significant outcome. Public catalog pages do not publish your private advert or report.
Service providers and transfers
Render provides hosting/database infrastructure; OpenAI provides report research/review; Stripe processes payment; Resend sends transactional emails. Support messages also pass through the domain email routing and operator mailbox services. Providers can process data outside the EEA under their applicable contracts and transfer arrangements. Contact us for the arrangements relevant to your data. Provider notices: Render, OpenAI, Stripe, Resend.
Retention and private access
Private report access expires 30 days from order creation. Operational source/AI captures have a 90-day expiry recorded in storage. Access or capture expiry is not a promise that all related database records or provider backups are immediately erased. Order, acceptance and withdrawal evidence is retained as needed for delivery, refunds, legal records and resolving claims. Support/security/correction data is kept only while needed for its purpose or a relevant legal obligation; request the retention criteria for your specific records from support.
Browser storage and security
The site uses session storage for a checkout attempt, withdrawal statement and private report access in your browser tab. It can contain the advert input or access token; use a private device and close the tab when finished. The report token is placed in a link fragment, access is checked by the server, and delivery credentials and private captures use encrypted storage. Do not share private links. No marketing analytics or advertising cookies are introduced by this notice; Stripe applies its own checkout storage and notice.
Your rights
Email support or write to the controller address to request access, rectification, erasure, restriction or portability, or to object where applicable. We may ask for proportionate verification and normally respond within one month; legally permitted extensions will be explained. Erasure may be limited by necessary legal records or claims. You may complain to the Bulgarian Commission for Personal Data Protection or your relevant supervisory authority. Giving checkout inputs is necessary to provide a paid report; free browsing does not require an account.
Changes
We update this notice when the service changes. A material new use of your data will be explained before it begins. The current version is dated below.