Privacy policy

1. Data controller

The controller responsible for the processing of your personal data is Tomás Teixeira (Social Media Tomás Teixeira), Nunnenbeckstr. 51, 90489 Nürnberg, Germany. You can reach us at contact@italspec.com for any privacy-related request.

2. Categories of personal data we process

• Account data: first and last name, email address, password (stored only in hashed form), role (private seller, dealer), and preferences.
• Listing data: vehicle details, photos and videos, description, location, and the contact details you choose to publish or share with interested buyers.
• Dealer data: company name, public contact details, and business information you provide during the dealer application.
• Communication data: messages sent through our contact and inquiry forms, and email correspondence.
• Transaction data: information required to process listing and renewal payments (handled by our payment provider — we do not store full card details).
• Usage and technical data: pages visited, interactions, IP address, browser and device information, and cookie identifiers.

3. Purposes and legal bases of processing

• Providing the Platform, your account and listings, and enabling contact between buyers and sellers — performance of a contract, Art. 6(1)(b) GDPR.
• Reviewing and moderating listings, ensuring security, preventing fraud and abuse, and improving the Platform — our legitimate interests, Art. 6(1)(f) GDPR.
• Processing payments — performance of a contract, Art. 6(1)(b) GDPR.
• Sending the newsletter and search-alert emails — your consent, Art. 6(1)(a) GDPR, which you can withdraw at any time.
• Complying with legal obligations (e.g. tax and commercial law) — Art. 6(1)(c) GDPR.

We do not sell your personal data to third parties.

4. Recipients and processors

We use carefully selected service providers who process data on our behalf under data processing agreements (Art. 28 GDPR):

• Supabase — database, authentication and file storage.
• Vercel — website hosting and content delivery.
• Stripe — payment processing.
• Resend — transactional emails (confirmations, notifications).
• MailerLite — newsletter and marketing emails.
• PostHog — privacy-focused product analytics (EU-hosted).

Where you contact a seller, the contact details you provide are shared with that seller so they can respond to you.

5. International data transfers

Some of our processors may process data outside the European Economic Area (e.g. in the United States). In such cases, transfers are safeguarded by appropriate measures such as the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

6. Cookies and analytics

The Platform uses cookies and similar technologies that are strictly necessary for its operation (e.g. to keep you logged in and to remember your preferences). These do not require consent.

For privacy-focused product analytics we use PostHog (posthog.com), hosted in the European Union. PostHog helps us understand how the Platform is used — for example page views, clicks and sign-ups — so that we can improve it. We do not enable session recording. We only set these non-essential analytics cookies and begin this processing after you have given your prior consent through our cookie banner — your consent, Art. 6(1)(a) GDPR. You can accept or decline non-essential cookies at any time via the cookie banner, and withdrawing consent does not affect the lawfulness of prior processing.

7. Data retention

We keep your personal data for as long as your account is active or as needed to provide our services. When you delete your account, we delete your account, listings and associated data without undue delay, unless we are required to retain certain data to comply with legal obligations (e.g. records related to payments and taxes).

8. Your rights

Under the GDPR you have the right to:

• access your personal data (Art. 15);
• rectification of inaccurate data (Art. 16);
• erasure (Art. 17);
• restriction of processing (Art. 18);
• data portability (Art. 20);
• object to processing based on legitimate interests (Art. 21); and
• withdraw consent at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at contact@italspec.com. You also have the right to lodge a complaint with a data protection supervisory authority.

9. Security

We use technical and organisational measures to protect your data, including encrypted connections (HTTPS), access controls, and row-level security on our database. No method of transmission or storage is entirely secure, but we work to protect your data in line with the state of the art.

10. Children

The Platform is intended for users aged 18 and over. We do not knowingly collect personal data from children.

11. Changes to this policy

We may update this Privacy Policy from time to time. The current version is always available on this page.