Get Started

Privacy Policy

Last updated: October 13, 2026

1. Who is the controller

The controller of your personal data is [FULL NAME], an individual entrepreneur (autónomo) registered in Spain, tax ID (NIF/NIE): [NIF/NIE], address: [STREET, POSTAL CODE, CITY], Spain (“we”).

For any questions about your data, or to use your rights, contact us at [email protected] or through Telegram support at t.me/CarorcaSupport. We have not appointed a data protection officer.

2. What this policy covers

This policy covers the website carorca.com and the Telegram bot @carorca_bot through which the Carorca service is provided. The payment page is run by Stripe and is subject to Stripe’s privacy policy.

3. The website

carorca.com does not use cookies and does not use analytics or advertising tools. If this changes, we will update this policy and ask for your consent where the law requires it.

When you visit the website, our hosting provider [HOSTING PROVIDER, DATA LOCATION] may automatically record technical data such as your IP address, browser type and the time of the request in server logs. These logs are used only to deliver the website and keep it secure, and are kept for [PERIOD].

4. Data we process when you use the service

  • Telegram account data that Telegram shares with the bot: your user ID, username, display name and language setting.
  • Your search filters, settings and the history of alerts sent to you.
  • Subscription data: your plan, trial and subscription dates, payment status and your customer reference at Stripe.
  • Payment data: payments are handled by Stripe. We receive only the information needed to confirm the payment, such as a transaction ID, amount, status, the email address you gave at checkout and your billing country. We do not receive full card details. If you buy as a business, we also receive the company name, address and VAT number.
  • Invoice data, if you ask for an invoice: your name or company name, address and tax ID.
  • Correspondence: the content of messages you send us by email or through Telegram support, and your email address if you write to us.

5. Data from third-party listings

The service collects publicly available listings: car offers that third parties publish on car sale websites. Listings mainly describe vehicles (make, model, price, mileage, location). A listing can also contain personal data of the person who published it, for example a name, a phone number or a location.

We use this data only to detect new and changed listings and to show them to users whose filters match them. We also use vehicle and price data from listings, which is not personal data, to calculate market estimates. We do not use personal data from listings for marketing and we do not sell it. The data comes from the public listing itself.

If your personal data appears in a listing and you want to access, correct or erase it, or object to its use, write to [email protected]. We keep this data for no longer than [PERIOD].

6. Why we process data and on what legal basis

  • To provide the service, including sending alerts and managing your subscription – Article 6(1)(b) GDPR (performance of a contract).
  • To handle payments, issue invoices and keep accounting records – Article 6(1)(c) GDPR (legal obligations under Spanish tax and commercial law).
  • To answer your questions and handle complaints and withdrawal statements – Article 6(1)(b) and (c) GDPR.
  • To detect listings and deliver them to users whose filters match, including any personal data of the person who published the listing – Article 6(1)(f) GDPR (our legitimate interest and the interest of users in finding the offers they are looking for).
  • To keep the website and the service secure, prevent abuse (for example repeated use of the free trial) and establish or defend legal claims – Article 6(1)(f) GDPR (our legitimate interest).

7. Who receives your data

We share data only with providers that help us run the service, and only as far as needed:

  • Telegram, which delivers messages between you and the bot. Your use of Telegram is also governed by Telegram’s own terms and privacy policy.
  • Stripe (Stripe Payments Europe, Ltd., Ireland, and companies in its group), which processes payments and helps prevent fraud. For some of this processing, for example to meet its legal obligations and to prevent financial abuse, Stripe acts as an independent controller; see Stripe’s privacy policy at stripe.com/privacy.
  • [HOSTING PROVIDER, DATA LOCATION], which hosts the website and the bot.
  • Tax and accounting advisers, if we use them, who are bound by confidentiality.
  • Public authorities, when the law requires it.

We do not sell your personal data.

8. Transfers outside the EEA

Telegram and Stripe may process data outside the European Economic Area (EEA). When data is transferred outside the EEA, this is done on the basis of appropriate safeguards, such as a European Commission decision that the country ensures an adequate level of protection (for example the EU–US Data Privacy Framework) or the European Commission’s standard contractual clauses. You can ask us for details at the email address above.

9. How long we keep data

  • Bot and subscription data: for as long as you use the service, and then for [PERIOD].
  • Accounting records and invoices: for the period required by Spanish tax and commercial law (up to 6 years).
  • Correspondence and complaints: for as long as needed to deal with your request, and then until the limitation period for possible claims expires.
  • Data needed to establish or defend legal claims: until the limitation period for those claims expires.
  • Website server logs: [PERIOD].
  • Personal data found in listings: no longer than [PERIOD].

10. Your rights

You have the right to:

  • access your data and receive a copy of it;
  • have your data corrected;
  • have your data erased;
  • restrict processing;
  • data portability;
  • object to processing based on our legitimate interest.

To use these rights, write to [email protected]. We reply within one month. You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), C/ Jorge Juan 6, 28001 Madrid, aepd.es, or with the supervisory authority in the country where you live or work. In Poland this is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

11. Automated decisions

The estimates in alerts (market price, resale margin, time to sell) are calculated about cars, not about you. We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you.

12. Is providing data required

Providing data is voluntary, but the service cannot work without the Telegram account data and filters described above, and we cannot sell you a subscription without the data needed for payment and accounting.

13. Children

The service is intended for people who are at least 18 years old. We do not knowingly collect data from anyone younger.

14. Changes to this policy

We may update this policy when the service or the law changes. The date of the last update is shown at the top of this page.