Privacy Policy

1. Data we collect

• Account data: your name, email address and a hashed password when you register.
• Profile data: phone number and Telegram username — optional, only if you add them.
• Listing data: the title, description, photos, price and location of the items you post.
• Usage data: pages visited, search queries and listing views (no direct personal identification).
• Payment data: handled entirely by Paysera — we never see or store your card details.

2. How we use your data

• To provide and operate the CarsBaltic marketplace.
• To display the contact details you choose to share with interested buyers.
• To process payments for optional listing-promotion (boost) services via Paysera.
• To send you transactional emails — listing confirmations and expiry notices.
• To keep the platform safe by preventing fraud, scams and abuse.

We rely on the following legal bases: performance of a contract (providing the service), our legitimate interest (keeping the platform safe and improving it), your consent (optional cookies and partner widgets) and legal obligation (keeping accounting records).

3. Third-party processors

We share the minimum data necessary with trusted processors who act on our instructions:

• Paysera: payment processing (PCI-DSS compliant).
• Cloudinary: secure hosting of the photos you upload.
• Neon: our PostgreSQL database hosting.
• Vercel: website hosting and content delivery.
• Google: optional sign-in with your Google account (OAuth).
• Travelpayouts / Aviasales: power the optional flight and hotel search; if you use it, that search is handled on their platform under their own privacy policy.

4. Cookies

We use strictly necessary cookies for authentication (session management) and functional cookies to remember your language preference. We do not use advertising or profiling cookies. Optional partner widgets (such as flight search) load only when you use them. You can manage cookies through our cookie banner or your browser settings, though disabling essential cookies may affect site functionality.

5. Your rights under GDPR

You have the right to:

• Access: the personal data we hold about you.
• Rectify: inaccurate data via your profile settings.
• Erase: your account and all associated data.
• Port: your data by receiving it in a portable format.
• Object to or restrict: our processing of your data.
• Withdraw consent: at any time, where processing is based on consent.
• Complain: to a supervisory authority — in Lithuania, the State Data Protection Inspectorate (VDAI), or the authority in your country of residence.

To exercise any of these rights, email us at hello@carsbaltic.com.

6. Data retention

Active listings are kept for 30 days from posting and then automatically expire. When you delete a listing or account, the associated data is removed from our database within 30 days. Payment and accounting records are kept for as long as required by Lithuanian and EU law (up to 10 years for accounting documents).

7. International transfers

Some processors (for example Vercel) may process data outside the European Economic Area. Where that happens, the transfer is protected by GDPR-compliant safeguards such as the European Commission’s Standard Contractual Clauses.

8. Data security

All data is transmitted over HTTPS. Passwords are stored only as bcrypt hashes. We do not sell your personal data, and we do not share it with third parties for their own marketing.

9. Contact & changes

For any privacy-related question or request, contact us at hello@carsbaltic.com. We may update this policy from time to time; the date at the top reflects the latest version, and we will notify registered users of material changes by email.