Privacy Policy

Data controller

The controller of the personal data processed on autocena.lv is SIA "Efficient Solutions", registration number 40103800720, registered office Liepājas iela 40 k-5 - 26, Riga, LV-1002, Latvia. Privacy contact: info@hesti.lv.

Data we collect

We collect data in the following categories:

• Account data: your email address, name or first and last name, a hashed password if you sign up with email, your name, email and profile picture from Google if you sign in with Google, the account creation date, and what you use autocena for (buying, selling or as a dealer) if you tell us.
• Report inputs: the car details you enter or that come from the ad you start from (make, model, year, mileage, engine, gearbox, equipment, inspection status and condition), the ad's link and price, your free-text description, the photos you upload, and whether you are buying or selling.
• Generated reports: the AI-generated car report saved to your account.
• Free price estimates: the car details you enter in the price estimator. They are not saved to your account.
• Payment data: your token orders (package, amount, status, date) and the changes to your token balance. You enter card details on Stripe's page; they never reach our servers.
• Technical data: IP address, browser, device, the pages you visit and the page you came from, in our server logs and, if you consent, in analytics.
• Error data: details of errors on our servers, sent to Sentry with emails, access tokens and other personal data removed.
• Communications: the name, email and message you send us through the contact form or by email.
• Cookies: described in our Cookie Policy.

Why we process your data and the legal basis

We process your personal data on these legal bases:

• Contract: to provide the service you sign up for: your account and sign-in, paid car reports, token purchases and the emails that go with them (confirmation, password reset, report ready). Without this data we cannot provide the service.
• Legitimate interests: to keep the service secure (rate limiting, fraud prevention), to find and fix errors, and to understand how the site is used overall.
• Consent: for analytics and advertising cookies. You can withdraw your consent at any time; this does not affect processing before the withdrawal.
• Legal obligation: to keep accounting records of payments.

Who processes your data

We share data only with these service providers (processors), and only to provide the service:

• Vercel: hosts the website and its server logs.
• Neon: hosts our database, in the EU (Frankfurt).
• Amazon Web Services: stores the photos you upload and sends our emails, in the EU.
• Stripe: processes card payments. Stripe receives the order and the amount from us, and collects your payment details on its own page under its own privacy policy.
• Google: sign-in with Google, if you use it, and AI car report generation (Gemini).
• OpenAI and Anthropic: AI car report generation. They receive the car details, your description and your photos, not your email or name.
• Sentry: error monitoring for our servers.
• Upstash: caching and rate limiting, which uses your IP address briefly.
• The analytics and advertising providers listed in our Cookie Policy, only with your consent.

We do not sell your personal data.

Transfers outside the EU/EEA

Our database, photos and emails are in the EU. Vercel, Stripe, Google, OpenAI, Anthropic, Sentry and Upstash, and the analytics and advertising providers in the Cookie Policy, are US companies and may process data in the United States. For these transfers we rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.

How long we keep data

• Account data: while your account exists.
• Car reports and photos: while your account exists, so you can come back to them. Clearing the report form deletes the photos you uploaded in it.
• When you delete your account: your account data, reports and photos are deleted. We keep only a record that an account existed and when it was created and deleted, without your email, name or other details, and the payment records below.
• Payment records: token orders and token balance changes (amounts, dates and status, without your email or name) are kept for 10 years, as Latvian accounting law requires.
• Server logs: kept by our hosting provider for a short period.
• Error data: up to 90 days at Sentry.
• Analytics data: up to 14 months.
• Messages you send us: as long as needed to handle your request.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted. You can delete your account yourself in your profile, which deletes your car reports and photos with it;
• restrict processing;
• receive your data in a machine-readable format (portability);
• object to processing based on legitimate interests;
• withdraw consent at any time, where processing is based on consent;
• lodge a complaint with the Data State Inspectorate of Latvia (Datu valsts inspekcija).

To use any of these rights, email info@hesti.lv. We will reply within one month, as the GDPR requires.

Cookies

Which cookies we use, and why, is described in our Cookie Policy. Analytics and advertising cookies are set only with your consent, and you can change your choice at any time with "Cookie settings" at the bottom of every page.

Data security

We protect your data with HTTPS on all traffic, encryption at rest by our hosting and storage providers, hashed passwords, limited internal access, signed payment notifications from Stripe, and the removal of personal data from error reports and logs. No system is completely secure; if a personal data breach is likely to put you at risk, we will notify the Data State Inspectorate within 72 hours and tell you without undue delay, as the GDPR requires.

Contact

Privacy questions, requests about your data and complaints: info@hesti.lv. By post: SIA "Efficient Solutions", Liepājas iela 40 k-5 - 26, Riga, LV-1002, Latvia.

If you are not satisfied with our reply, you can contact the Data State Inspectorate of Latvia at www.dvi.gov.lv.

Changes to this policy

We may update this policy when our service, our practices or the law change. The date at the top shows the latest update. We will announce significant changes by email or on the site.