Privacy Policy

1. Data controller

GBO Eesti OÜ, Estonia, is the controller for account and platform data. For customer records that a workshop enters into CarsEXP (its clients, vehicles, orders and invoices), the workshop is the controller and CarsEXP acts as a processor on its behalf.

Contact: info@carsexp.com.

2. Data we process

Account data: name, e-mail address, phone number, role in the workshop, sign-in credentials (passwords are stored only as salted hashes; passkeys use public-key cryptography).

Workshop operational data: clients, vehicles (including licence plates and VIN), repair orders, inspection reports with photos, invoices and payment records.

Technical data: server logs (IP address, time, requested endpoint) kept for security and troubleshooting, and an audit log of significant actions inside the platform.

3. Camera, photos and on-device processing

The mobile apps use the camera to scan licence plates and part barcodes and to attach photos to vehicle inspection reports. Text and barcode recognition run on the device; camera frames are not sent to our servers. Only photos you explicitly attach to an inspection or profile are uploaded and stored with the workshop’s data.

The apps do not access your location, contacts or microphone recordings, and do not use advertising identifiers or third-party advertising or analytics SDKs.

4. Purposes and legal bases

We process data to provide the service (contract performance, GDPR Art. 6(1)(b)), to secure and audit the platform (legitimate interest, Art. 6(1)(f)), and to meet accounting and tax obligations for invoices (legal obligation, Art. 6(1)(c)).

5. Storage, processors and transfers

Data is hosted on servers in the European Union. We use a small number of infrastructure processors (hosting, e-mail and messaging delivery) bound by data-processing agreements. We do not sell personal data and do not transfer it outside the EU/EEA unless an adequate safeguard under GDPR Chapter V applies.

6. AI assistant

The AI assistant in CarsEXP answers questions about the workshop’s own data (orders, vehicles, stock, figures) and can translate texts. Figures in its answers come from the workshop’s database, not from the model. AI answers may still be inaccurate — check them before acting on them.

When the AI features run on an external model provider (currently Anthropic, see the list of subprocessors), your question and the data needed to answer it — for example order lines, vehicle details or customer contact data — are sent to that provider. Before the first such request the app asks each user for consent; consent can be withdrawn at any time in the app settings. The provider processes the data under a data-processing agreement and does not use it to train its models. When the workshop uses a model hosted on our own servers, the data does not leave CarsEXP servers.

You can report an inappropriate, harmful or inaccurate AI answer directly in the app. The report — the question, the answer and your comment — is sent to the CarsEXP team, used only to review the answer and improve the service, and deleted once it is no longer needed.

7. Retention

Account data is kept while the account is active. Invoicing records are kept for the period required by accounting law (in Estonia, 7 years). Server logs are rotated on a short cycle. When a workshop terminates its contract, its tenant data is deleted or returned in accordance with the service agreement.

8. Your rights

You have the right to access, rectify, erase and port your data, to restrict or object to processing, and to lodge a complaint with a supervisory authority (in Estonia: Andmekaitse Inspektsioon). To exercise these rights, or to request deletion of your account, write to info@carsexp.com — we respond within 30 days.

If your data was entered by a workshop you are a customer of, we will coordinate the request with that workshop as the controller.

9. Cookies

The web application uses only strictly necessary cookies: a session cookie for signing in and a language-preference cookie. No advertising or cross-site tracking cookies are used.

10. Changes

We will post any changes to this policy on this page and update the date above. Material changes will be announced in the application.