Privacy Policy — CarAuctionGuess
Effective date: [DATE]
Last updated: [DATE]
1. Who we are
CarAuctionGuess (the Service) is an online automotive auction-price guessing game available at https://carauctionguess.com. The controller of personal data is CARSTAR IMPORT Spółka z ograniczoną odpowiedzialnością, registered at al. Jana Pawła II 22, 00-133 Warszawa, Polska, company/registration number KRS 0001198409; REGON 542926143, tax identification number NIP 5253063950 (the Operator, we, us). Share capital: 5 000,00 PLN. Registration court: Sąd Rejonowy dla m.st. Warszawy w Warszawie, XII Wydział Gospodarczy KRS.
Privacy contact: [PRIVACY EMAIL]. Support: [SUPPORT EMAIL]. Data Protection Officer (if appointed): [DPO CONTACT OR “Not appointed”]. Do not publish this notice until these fields are completed accurately.
2. Who this notice covers
This Policy describes personal-data handling when you visit, play as a guest, register, log in, participate in game modes and leaderboards, make purchases, subscribe to PRO, contact support, or use the Service from the European Economic Area (EEA), United Kingdom, or other regions. Residents of certain non-EEA jurisdictions may have additional rights under local law; see Section 13.
3. Personal data we process
Depending on your use of the Service, we may process:
- Account and identity: account identifier, email address, display name or username, OAuth provider identifiers, selected country, avatar and customization settings. Google sign-in provides only the information permitted by the provider and scopes shown during sign-in. We do not request access to unrelated email messages, contacts, or cloud files.
- Guest sessions and device information: pseudonymous guest identifier, session tokens, device/browser information, necessary cookies or local storage, IP address and security logs, and approximate country inferred from technical information where used. We do not require precise location to play.
- Gameplay information: completed sessions, guesses, scores, timing, XP and levels, Daily Streak progress, badges, BID$ balances and transactions, game settings, friends and invitations, and ranking positions.
- Purchases and subscriptions: products purchased, payment provider transaction/customer references, amount, currency, payment and refund status, subscription status and renewal/cancellation dates. Payment card details are handled by the relevant payment provider; we do not intend to store full card numbers or CVV on our application servers.
- Communications and moderation: requests, complaints, reports, support correspondence and information needed to investigate suspected fraud, abuse or technical faults.
- Optional analytics and marketing data: events and identifiers collected only where their use requires and receives your valid consent, or another applicable lawful basis is available. The actual vendors and tracking technologies must be disclosed in the live cookie settings.
Do not infer that every category above is always collected. We process only data necessary for the relevant feature, and we must keep this notice aligned with the actual implementation.
4. Why we process data and legal bases (EEA/UK)
Where GDPR or UK GDPR applies, our purposes and legal bases are:
| Purpose | Typical legal basis |
|---|---|
| Create accounts, authenticate users, maintain guest play, deliver game services, save progress, maintain purchases and provide PRO | Performance of a contract (GDPR Art. 6(1)(b)); for strictly pre-contractual steps, same basis as applicable |
| Process payments, invoices and tax records | Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
| Protect users, prevent payment fraud, rate-limit abuse, investigate cheating and secure infrastructure | Legitimate interests (Art. 6(1)(f)), subject to balancing and safeguards; legal obligation where applicable |
| Operate public rankings, display voluntarily chosen usernames, country flags and scores | Contract (Art. 6(1)(b)) where this is integral to the requested game features, or legitimate interests (Art. 6(1)(f)) for optional presentation, subject to an actual legal-basis assessment |
| Respond to support requests and exercise or defend legal claims | Contract, legitimate interests, or legal obligation as appropriate |
| Send optional marketing messages; use non-essential analytics/advertising cookies | Consent (Art. 6(1)(a)) where required; you may withdraw consent |
We do not rely on consent for processing strictly necessary to provide a service you requested, and we do not treat acceptance of Terms as consent to unrelated marketing or tracking.
5. Rankings, usernames, country flags and simulated rivals
If you participate in public rankings, other visitors may see your chosen username, avatar, optional country, level, scores, ranks and public achievements. Do not put your real name, email address, phone number or other private information in your username. Country shown on your profile is a selected profile attribute and is not verification of nationality.
The Service may feature computer-controlled / simulated rivals with fictional usernames, countries and scores. These simulated profiles are not real people and must be identified as simulated participants in the product. Their synthetic data is not treated as personal data of real users. Official real-user competitive rankings and awards should distinguish authentic participants from simulated rivals.
6. Cookies, local storage and analytics
We use strictly necessary cookies and similar technologies to operate sign-in, session security, game progress and checkout. Where legally required, we will ask you before setting non-essential analytics, personalization or advertising cookies. You can accept, refuse, or change optional choices through Cookie Settings in the footer. Rejecting optional cookies must not prevent core gameplay. We do not use pre-ticked consent choices.
The live cookie interface should list the actual tools and their purposes, providers and expiration periods. Browser settings may also remove stored cookies. Removing necessary session data may sign you out or reset unlinked guest progress.
7. Social sign-in
If you choose Google sign-in, the provider will authenticate your account and send permitted information to us. Their independent privacy notices also apply to their processing. We do not control their sign-in and consent interfaces. You may revoke the provider's access through the provider's account settings; this does not necessarily delete the CarAuctionGuess account.
8. Payments and subscriptions
We use [CONFIRM ACTUAL ENABLED PROVIDERS: Stripe / Lovable Payments / PayU] for applicable transactions. Providers may act as independent controllers or processors depending on their role. We receive payment references and outcome notifications and use them to deliver purchased BID$, cosmetics, PRO 30-Day Passes or PRO Monthly subscriptions. Recurring payments occur only where the checkout explicitly authorizes them. See each provider's privacy notice at the point of purchase. Do not list a payment provider as active until it is actually integrated.
9. Sharing data and service providers
We disclose limited information to authorized providers as needed for hosting, authentication, database infrastructure, security, payment processing, customer support, transactional email, analytics (if enabled), and legal compliance. Typical categories may include Lovable Cloud, Google OAuth and email authentication through Lovable Cloud, [ACTUAL PAYMENT PROVIDERS], and [ACTUAL ANALYTICS PROVIDERS]. We do not sell personal data to advertisers. If actual practices differ, this statement must be corrected before publication.
10. International transfers
Some processors may access personal data outside the EEA/UK. Where restricted international-transfer rules apply, we use an applicable adequacy decision, standard contractual clauses and/or other permitted safeguards, with supplementary measures where required. Request more information through [PRIVACY EMAIL]. The applicable mechanisms and providers must be verified before publication.
11. Retention
We retain account, gameplay, payment and support information only as long as needed for the stated purpose, legal duties and legitimate dispute or fraud-prevention needs. Proposed schedule requiring validation against actual systems:
- Account and active gameplay history: while the account remains active; deletion request triggers removal or anonymization where legally appropriate.
- Guest data: until account conversion, deletion or the configured guest expiration [ACTUAL GUEST RETENTION PERIOD].
- Payment, invoice and tax records: for mandatory statutory periods under applicable accounting/tax law [COUNTRY-SPECIFIC RETENTION].
- Security and system logs: [ACTUAL RETENTION PERIOD] unless a longer period is needed for an investigation.
- Optional analytics: the duration shown in Cookie Settings and vendor configuration.
- Support history: [ACTUAL PERIOD], subject to legal claim periods.
We do not retain all user data indefinitely merely because a game account once existed.
12. Your privacy rights
Where GDPR applies, you may request access, rectification, erasure, restriction, portability and object to processing where the legal requirements are met. You may withdraw consent at any time without affecting earlier lawful processing. You may complain to a supervisory authority, including the Polish President of the Personal Data Protection Office (UODO) if competent, or the relevant authority in your EEA country. Contact [PRIVACY EMAIL]. We generally respond within one month, subject to applicable extensions and exceptions. Identity verification may be required to prevent unauthorized access.
You can also request account deletion through [ACTUAL IN-APP DELETION PATH OR CONTACT ROUTE]. Account deletion and cancellation of a paid subscription are separate actions: cancel recurring billing first or offer an integrated flow that appropriately handles active payments.
13. Non-EEA privacy rights
Where laws such as UK data-protection law, Swiss law, or US state privacy laws apply, we will provide additional rights and disclosures required in those places. Users may contact [PRIVACY EMAIL] to request information. We do not claim one generic international notice overrides mandatory local requirements. If targeting particular jurisdictions, publish appropriate regional supplements, especially if undertaking targeted advertising, selling/sharing data or processing children's data.
14. Children
Only purchases are restricted to users aged 18 and over; this is not a blanket age restriction on free gameplay or account creation. Where minors use the Service, applicable child-data protection and parental authorization requirements must be respected. The handling of children’s data and any required age or parental-consent measures require validation before this draft becomes effective.
15. Automated processing and security
Game calculations, fraud checks, ranking updates, and simulated rivals may rely on automation. We do not intend to make solely automated decisions producing legal or similarly significant effects within GDPR Article 22 without an appropriate lawful basis and safeguards. We use reasonable technical and organizational security measures, but no internet service can guarantee absolute security. Contact [SECURITY CONTACT OR SUPPORT EMAIL] to report a vulnerability.
16. Changes
We may update this Privacy Policy to reflect product, provider or legal changes. The current version and effective date will be available here; material changes affecting user rights will be communicated where legally required. Changes will not retroactively authorize data uses that require fresh consent.
17. Contact
Operator: CARSTAR IMPORT Spółka z ograniczoną odpowiedzialnością
Registered address: al. Jana Pawła II 22, 00-133 Warszawa, Polska
Privacy email: [PRIVACY EMAIL]
Support: [SUPPORT EMAIL]