Privacy
What we collect, why, and what you can do about it.
Plain-language version. Effective date below — if we change anything material, we email account holders before it takes effect.
Effective: 2026-05-24
The short version
- We collect the data you give us (account email, listings, photos, messages) and a little bit we collect automatically (IP and browser, in server logs).
- We use it to run the marketplace — display listings, deliver messages, prevent fraud — and nothing else.
- We don't sell your data. We don't share it with advertisers. We don't build profiles for resale.
- You can correct your details or delete your account at any time from /account/settings; request a copy of your data by emailing us.
Who's the data controller
OnlyEVs.eu — see the Imprint for the legal entity, address and contact details.
What we collect
When you create an account
- Email address (required to verify your account and notify you).
- Display name and optional profile photo.
- Optional: phone number (you choose whether to show it on listings).
- Country and preferred language for the UI.
- If you sign in with Google: your Google email and name. We never see your Google password.
When you publish a listing
- All the listing data you enter (brand, model, specs, asking price, location).
- Photos you upload — stored on Vercel Blob, served from our infrastructure.
- City and postal code. We don't store precise GPS.
Automatically
- IP address, browser type, OS, language (server logs, kept 30 days).
- Conversation metadata between buyer and seller — we don't read the messages themselves except for fraud reports.
Lawful basis (GDPR Art. 6)
- Contract performance: account creation, listing display, messaging — without these the service doesn't work.
- Legitimate interest: fraud prevention, security logging, anti-spam.
- Consent: non-essential cookies, email marketing (if we ever do any).
- Legal obligation: tax records, dealer KYC where applicable.
How long we keep it
- Account data: kept until you delete your account — self-service deletion from settings is immediate; email requests are honoured within 30 days.
- Listings: kept while active; archived 6 months after sold/removed for fraud investigations, then deleted.
- Messages: kept while both parties have an account; deleted when either deletes their account.
- Server logs: 30 days.
Who we share with
- Vercel (hosting, EU region) — server logs, file storage.
- Neon (Postgres database, Frankfurt) — listing and account data.
- Cloudflare Workers AI (photo NSFW check) — listing photos only, no personal data.
- Resend (email delivery) — transactional emails (verification, password reset, message notifications).
- Google (Gemini) (message translation) — only when a user explicitly clicks "translate" on a message. The message text is sent to Google, which may process it on servers outside the EU; that explicit action is your consent to the transfer (GDPR Art. 49(1)(a)).
No advertisers, no data brokers, no analytics pixels from third parties.
Your rights
- Access: request a copy of everything we hold about you.
- Correct: fix anything wrong via /account/settings.
- Delete: delete your account from settings — wipes account, listings, messages.
- Object: ask us to stop processing for legitimate-interest purposes.
- Portability: request your data in a machine-readable format.
- Complain: contact your national data-protection authority. In Slovakia, that's the Úrad na ochranu osobných údajov SR.
Cookies
See the separate Cookies page for what we use and how to opt out of non-essential ones.
Contact
Privacy questions: privacy@onlyevs.eu. We reply within 30 days as GDPR requires.