Privacy Policy
Last updated: to be completed before going live
Generic draft pending legal review before real-world use. Text in brackets [ ] must be completed with the exact details of the company operating ReceptCar.
1. Who processes your data
ReceptCar is published by [full legal name, address, contact]. For data entered by client garages (information about their own customers), the Publisher acts as a data processor under the GDPR (EU Regulation 2016/679) and the Swiss nFADP; the garage remains the data controller towards its own customers.
2. Data collected
Garage account: name, address, phone, e-mail, language, logo. User accounts: name, e-mail, role. Reception forms: end customer's name, phone, e-mail, license plate, mileage, vehicle photos, photo of the registration document, handwritten signature, noted damage and requested work — this information, in particular the photo of the registration document, constitutes personal data under the GDPR/nFADP.
3. Purposes
This data is processed to: provide the vehicle reception service (joint assessment of the vehicle's condition), generate and send the PDF document to the end customer, manage accounts and subscriptions, and ensure the security of the service.
4. Legal basis
Performance of the contract between the garage and its end customer (reception record), legitimate interest of the garage (protection in case of dispute), and for the Publisher, performance of the contract with the garage.
5. Retention
Reception forms (and associated files, including photos and PDF) are kept for the period chosen by each garage (30 days by default, 12 months optional), then automatically and permanently deleted. Account data is kept for as long as the account is active.
6. Hosting and subprocessors
Data is hosted and processed by Supabase (database and file storage) and Vercel (application hosting), as well as the e-mail and payment providers used by the Service (Resend, Stripe). [Complete with the exact list and server locations if applicable.]
7. Data subject rights
Any data subject (a garage's end customer or a Service user) may exercise their rights of access, rectification, erasure and objection with the relevant garage (data controller for its own customers) or with the Publisher for account data, at [contact e-mail address].
8. Security
The Service applies technical security measures: strict data isolation between garages (access control enforced at the database level), file storage in a private space with time-limited access, encrypted communications (HTTPS).
9. Contact
For any question about this policy or to exercise your rights: [contact e-mail address].