Privacy Policy

Apollo Tech s. r. o., Karpatské námestie 10A, 831 06 Bratislava - mestská časť Rača, Slovakia. Company ID (IČO): 51097869. Commercial Register of the Bratislava III Municipal Court, section Sro, insert no. 122557/B.

The operator of the AutoNinja platform is the controller of the data described here. Contact: info@autoninja.ro. Policy updated on 28 October 2026.

We receive from you account and contact data, company and billing data, listings, photos, messages, support requests, complaints and notices of withdrawal. From your device we receive technical data about access, IP, browser, session and security. The payment provider passes on the status, amount and transaction identifiers; we do not keep the full card number or the security code.

If you choose Google sign-in, we receive the account identifier, e-mail and profile data made available for authentication. A dealer's listings may come from files or feeds authorised by the dealer. Data about interactions comes from users and from the operation of the service.

For a private seller, other people see only the first name and the initial of the last name (for example Ján N.); a dealer appears under the company name. Stripe issues the invoice for a payment on our behalf, using the name and address you enter at checkout. When you report a listing or a conversation, we process your name, e-mail and the text of the report to handle the notice and tell you the outcome (a DSA obligation).

Listings, photos, the seller's public profile and published contact details are accessible to visitors and search engines. Do not publish identity documents or data of former owners. Private messages are not part of the public listing. Other users and search engines may keep copies outside our control.

Contract — Art. 6(1)(b) GDPR: account, publishing and managing listings, communication, orders and support related to the service. Without the necessary data we cannot create the account, publish the listing or fulfil the order. Optional fields may be left blank.

Legal obligation — point (c): accounting records, invoicing, consumer rights and handling mandatory notices. Legitimate interest — point (f): protecting users and the platform against fraud and abuse, security, diagnosing errors and defending rights. You can object to processing based on legitimate interest.

Consent — point (a): optional analysis of usage, including AutoNinja's own telemetry, Google Analytics 4 and Microsoft Clarity, as well as optional advertising uses. Refusing does not block the basic services. You can withdraw consent at any time at /cookies and this does not affect the lawfulness of earlier processing.

Offering our service to dealers: we use contact details of companies and their contact persons from public registers and listings to offer them our service (legitimate interest, Art. 6(1)(f) GDPR). You can object at any time, and then we stop contacting you. If you don't become a customer, we delete the data within 12 months of the last contact. A dealer's callback request from our form (name, e-mail, phone, website) is deleted after 12 months.

Subscribing to the newsletter is optional and is confirmed by e-mail. For this purpose we use the e-mail address, language, market and the record of the request and of the confirmation of consent. Resend manages the list and the sending of messages. Upstash keeps an unconfirmed request for at most 24 hours, and temporary counters to prevent abuse.

You can unsubscribe using the link in every newsletter. After unsubscribing, we no longer send newsletters; the provider may keep the unsubscribed status to respect your choice. The subscription data and the record of consent are kept for as long as they are needed for the subscription and for respecting your preferences. For deletion or information, use the contact stated in this policy.

With analytics consent, AutoNinja keeps usage events in its own database, and Google Analytics 4 measures visits and actions. Microsoft Clarity produces interaction maps and session recordings: pages visited, clicks, scrolling, information about the device and interactions. Pseudonymous browser identifiers and the internal account identifier may be used to link sessions; they are not anonymous data. We deliberately do not send your name or e-mail as an analytics identifier.

Clarity may also process data under Microsoft's privacy statement: https://privacy.microsoft.com/privacystatement. We don't run Google Analytics or Clarity on the sign-in, account, dealer, administration, payment, add-listing, withdrawal and contract document pages. With analytics consent, we record there only the form steps and a completed payment (never what you typed) and pass them to Google Analytics as well. Marketing consent is separate from analytics consent. Google information: https://policies.google.com/privacy. The list of technologies and their duration is at /cookies.

For a seller with at least 3 answered conversations in the last 90 days, we show "usually replies within X hours". It is worked out from reply times, and unanswered messages count as slow (legitimate interest; you can object). If you switch on WhatsApp, a buyer who clicks opens WhatsApp (Meta) with your number, and WhatsApp's terms apply from there. For invitations we record who invited whom, so we can give the reward. To detect fraud we keep a fingerprint of every photo and track price changes. You can download all your data in My account.

Technical validations, anti-spam protection and risk signals may prevent publication or trigger moderation. To appeal a restriction and request human review, contact info@autoninja.ro. The ranking of listings and the influence of paid promotion are described in the terms.

Account data and content are kept for as long as they are needed for the account and the services requested. When an account is closed, documents and evidence that must be kept for a legal obligation, a complaint or a dispute are reviewed separately; closing does not mean immediate deletion of all copies. The expiry of a listing is not the same as deleting it from the account.

We delete messages 12 months after the last message in a conversation. An expired, sold or rejected listing and its photos are deleted 12 months after it ended. An account nobody has signed in to for 3 years is deleted; we send a warning e-mail 30 days before, and signing in is enough to keep it. Payments and invoices are not affected; we keep them as accounting law requires.

Photo fingerprints used to detect fraud are deleted after 24 months. Contact-form messages and data-protection requests are deleted 3 years after they were handled.

Accounting documents are kept for 10 years after the year they relate to, under Slovak accounting law. Support requests, reports, withdrawals and contractual evidence are kept until they are resolved and, if needed to defend rights, until the applicable legal period expires or the proceedings end. We do not justify keeping other account data merely by the existence of an accounting document.

We keep reports of illegal content, moderation decisions and their reasons after the listing or account is deleted, usually for 1 year after the case is closed and, if there is a dispute, until it ends. A report keeps a copy of the reported listing. We keep the log of administrator actions for 3 years. We need this to show that we followed the DSA and to defend legal claims (Article 17(3)(e) GDPR).

The cleanup rule for our own telemetry is 180 days for analytics events and 30 days for web performance measurements. Security logs and backups have a separate cycle; evidence of an incident may be isolated until the investigation or dispute is closed. For the period applicable to a particular set of data, ask for details at info@autoninja.ro.

The lifetime of a cookie is not the retention period of reports. Clarity states 30 days for regular recordings and up to 9 months for aggregated data and favourite recordings. For Google Analytics, the retention of individual data depends on the property setting; aggregate reports have different rules. You can ask for deletion of identifiable data, within the limits of the GDPR.

If you use autofill by VIN and the feature is available, the VIN you enter is sent to the provider Vincario to identify technical data. Use is optional; you can fill in the listing manually.

We may machine-translate a listing's description into the site's other languages. Anthropic (USA) does this as our processor, under SCCs. We send only the description text, with phone numbers, e-mails and links removed, never the seller's name or account data. Anthropic doesn't use the text for training and deletes it within 30 days. We store the translation with the listing and delete it together with the listing. The original text is always available via Show original. Legal basis: legitimate interest, so buyers can understand the listing in their language.

The technical providers used, depending on the feature, include Supabase (accounts, databases and storage), Vercel (hosting), Cloudflare (images and anti-abuse protection), Algolia (searching public listings), Upstash (request limiting), Resend (e-mails) and Stripe (payments). Google is used for the sign-in chosen by the user and, with consent, Analytics; Microsoft Clarity is used with analytics consent. Not every provider receives all categories of data.

Technical error reports (page address, browser, error description) are processed by Better Stack (through the Sentry library); we deliberately do not attach your name, e-mail or IP address to them. E-mails sent to our addresses are received and forwarded by the Forward Email service. If handling your request or a security problem requires it, an authorised administrator may sign in to your account; we log every such sign-in.

Data may be accessible to authorised staff, accounting and legal advisers or authorities, where necessary and where there is a legal basis. Stripe, Google and Microsoft may also act as independent controllers for some of their own processing; their policies describe those operations.

The main database is in the EU. That does not mean that all of the providers' operations take place exclusively in the EEA. Providers that also process data outside the EEA, and the transfer mechanism, are listed below. DPF is the EU-US Data Privacy Framework (a Commission adequacy decision); SCC are the standard contractual clauses in the processor contract. You can ask for information about the recipients, countries and a copy of the applicable safeguards at info@autoninja.ro.

• Vercel (hosting) — USA — DPF
• Cloudflare (images, abuse protection) — USA — DPF
• Upstash (request limiting) — USA — DPF
• Resend (e-mails) — USA — DPF
• Stripe (payments) — USA — DPF
• Google (sign-in, Analytics with consent) — USA — DPF
• Microsoft Clarity (session recordings with consent) — USA — DPF
• Supabase (accounts and database; the database is in the EU) — USA — SCC
• Algolia (search) — France and USA — SCC
• Better Stack (error reports) — USA — SCC
• Forward Email (e-mail forwarding) — USA — SCC
• Anthropic (automatic translation of listing descriptions) — USA — SCC

You have the right of access, rectification, erasure, restriction and, where the legal conditions are met, portability. You can withdraw consent and object to processing based on legitimate interest; you can object to direct marketing at any time.

Write to info@autoninja.ro. We may request proportionate verification of your identity; do not send a copy of your ID on your own initiative. We usually reply within one month at the latest. If the law allows an extension because of complexity, we inform you within the first month. Requests are in principle free of charge.

You can lodge a complaint with ANSPDCP, https://www.dataprotection.ro, with the Slovak authority, https://dataprotection.gov.sk, or with the competent authority of the state of your residence, place of work or the alleged infringement. The right to bring court proceedings remains unaffected.