Legal

Privacy Policy

Effective date: 23 October 2026 · Version 1.4

This document is a draft prepared for review. It should be reviewed and approved by qualified legal counsel before publication and may change before launch. Fields shown like [THIS] must be completed with the operating company's real details before publishing.

carseal guides a photo walk-around of your rental car at pickup and return, stores a hash of the photos you upload, and uses AI to highlight possible marks for review. This policy explains what personal data we collect, why, the legal basis for processing it, how long we keep it, who processes it on our behalf, and the rights you have over it — wherever in the world you live.

1. Who we are (data controller)

The carseal app and website (the "Service") are operated by carseal, a company incorporated in Romania (registration no. [REG. NUMBER][, VAT no. if applicable]), with its registered office at [REGISTERED ADDRESS] ("carseal", "we", "us"). We are the controller of the personal data described in this policy. Confirm the exact registered legal form (e.g. [Carseal S.R.L.]) before publishing.

For any privacy question, or to exercise your rights, contact us at privacy@carseal.ai or by post at the address above. This policy applies to the carseal mobile application (iOS and Android) and the carseal website, including independent verification pages.

2. What data we collect

We collect only what the evidence service needs to function, plus limited diagnostics. We do not sell your data. We use limited analytics and — only if you opt in (and, on iOS, allow App Tracking Transparency) — advertising-measurement tools; both are off by default and you can turn them off at any time in Settings (see Section 2.6).

2.1 Account data

Email address and, where provided, your name, obtained when you sign in with Google or Apple. We store the authentication provider ("google" or "apple") and a provider-issued account identifier. We do not receive or store your Google/Apple password.
App language preference (English or Romanian).

2.2 Rental and vehicle data you enter

The rental-company name and branch, the rental agreement number, and any notes you add.
The vehicle's licence plate, plate country, and colour.
The Vehicle Identification Number (VIN), which you may type or capture from a photo, and the decoded vehicle specification (make, model, year, body type) derived from the VIN.

2.3 Inspection evidence (the core of the service)

Photos and video keyframes of the vehicle captured during a walk-around or 360° scan, together with cryptographic hashes (SHA-256) of each file and capture timestamps.
Precise location (GPS latitude and longitude, plus accuracy) recorded per inspection and, where available, per keyframe, to evidence where and when the scan took place.
Device motion / heading data (from the compass and motion sensors) used while you scan, to guide camera coverage of each zone of the car. This is used on-device to steer the scan and is recorded as part of the scan ledger.
Vehicle condition data: odometer reading, fuel level/type, the zones covered, the scan ledger, and detected damage (type, severity, panel, confidence, and whether it appears pre-existing or new).

2.4 Disputes

If you analyse a charge from a rental company, we store the claim details you provide (such as the charged amount and currency), the comparison verdict, and any dispute document package generated for you.

2.5 Purchases

carseal sells protection credits as in-app purchases. Billing is handled entirely by the Apple App Store or Google Play; we never receive your card or payment details. We store your credit balance, the product purchased (for example a single protection or a 3-pack) and the date your last purchase was validated, so your protections are available across your devices.

2.6 Analytics and diagnostics

Firebase Analytics records a small set of in-app events (for example: a rental was created, a scan started or sealed, a report was viewed, a dispute was started) to help us understand and improve the product flow.
Firebase Crashlytics records crash and error diagnostics (device model, OS version, stack traces and app state at the time of a crash) so we can fix stability problems.
Meta (Facebook) app events — only if you opt in to analytics (and, on iOS, grant App Tracking Transparency permission), we send Meta Platforms a limited set of app events (such as app open, a paywall view, or a completed purchase) for advertising measurement, attribution and to build marketing audiences. This is off by default (in particular in the EU/EEA) and never runs until you consent; you can disable it at any time in Settings, and when you opt out we stop sending events and instruct Meta to clear the associated data.

We do not knowingly collect special-category data (such as health, biometric identifiers, or political/religious data). Please do not capture such data into the Service. Photographs of a vehicle may incidentally include faces or bystanders; you are responsible for not scanning people or property you have no right to photograph (see our Terms).

2.7 carseal Photo Check (website tool)

If you use the free photo check at carseal.ai/photo-check, we check your photos without keeping them. We store only a technical record of the check and, if you ask for the summary by email, your email address. Section 13 describes exactly what we collect, why, and how long we keep it.

3. How we use your data, and our legal basis

Under the EU General Data Protection Regulation and the UK GDPR we rely on the following legal bases (Article 6):

Purpose	Data used	Legal basis (GDPR / UK GDPR Art. 6)
Create your account and sign you in	Email, name, auth provider/ID	Performance of a contract — Art. 6(1)(b)
Produce and store tamper-evident condition evidence (the service you ask for)	Photos/keyframes, hashes, GPS, heading, VIN + spec, odometer/fuel, condition data	Performance of a contract — Art. 6(1)(b)
Detect and localise vehicle damage from photos using AI	Photos/keyframes (and the resulting damage findings)	Performance of a contract — Art. 6(1)(b); and our legitimate interest in fraud prevention and accurate damage detection — Art. 6(1)(f)
Decode a VIN into a vehicle specification	VIN	Performance of a contract — Art. 6(1)(b)
Sell and grant protection credits	Purchase/entitlement data	Performance of a contract — Art. 6(1)(b)
Understand product usage (analytics)	Firebase Analytics events	Consent — Art. 6(1)(a)
Advertising measurement, attribution and audiences (opt-in only)	Meta app events (app open, paywall view, purchase, etc.)	Consent — Art. 6(1)(a)
Diagnose crashes and keep the app stable	Crashlytics diagnostics	Legitimate interest in a working, secure product — Art. 6(1)(f) (consent where required by your platform)
Run carseal Photo Check, email you its summary, prevent abuse of the tool, produce anonymous statistics and, only if you ask, send you carseal updates	Photo Check records and, if you give it, your email address (see Section 13)	Performance of a contract — Art. 6(1)(b); legitimate interest — Art. 6(1)(f); consent — Art. 6(1)(a) for updates (details in Section 13.4)
Comply with legal obligations and defend or pursue legal claims	As relevant to the matter	Legal obligation — Art. 6(1)(c); legitimate interest — Art. 6(1)(f)

Where we rely on consent (for example analytics), you can withdraw it at any time in Settings (for marketing emails, with the unsubscribe link in every email) without affecting processing already carried out. Where we rely on legitimate interests, you may object as described in Section 8.

4. Use of artificial intelligence to detect damage

To find and locate damage on your vehicle, carseal sends inspection photos and keyframes to third-party AI providers. The committed production route as of this draft is:

OpenRouter, Inc. is the default damage-analysis processor. Inspection frames are sent to OpenRouter, which serves the open-weights Google Gemma 4 31B instruction-tuned model (google/gemma-4-31b-it) to localise and describe possible damage. OpenRouter is the commercial processor; Gemma is the model family.
Anthropic, PBC ("Claude") is used as a cheap triage / crop-verify model on some frames, and as an emergency fallback for damage analysis if OpenRouter is unavailable. It is not the default analysis provider.
Google ("Gemini") is used only for the live in-scan capture guide and for VIN / plate OCR. Gemini is not used for damage analysis on the committed path.

These providers process the images on our instruction, as our processors, to return findings or guidance to carseal. Whether a provider also uses inputs to improve its own models is governed by that provider's terms and our contract with them. This draft does not claim a written prohibition we have not quoted here. The output (damage findings, guide hints, VIN text) is stored with your inspection. AI damage detection is an automated aid that informs the evidence record; it is not a legally binding determination, it does not by itself produce legal effects, and human review remains available in a dispute (see our Terms).

We do not currently export customer photos or staff review labels to train carseal's own models. The staff training-export endpoint is frozen (TRAINING_EXPORT_ENABLED defaults to false) until purpose, lawful basis, notices, processor list, retention, and deletion lineage are written and approved.

This section does not apply to carseal Photo Check: photos uploaded there are measured on our own server and are never sent to any AI provider (see Section 13).

5. Who else processes your data (processors and sub-processors)

We share data only with service providers who process it on our behalf under contract, and only as needed:

OpenRouter, Inc. — primary damage-image analysis (Gemma 4 via OpenRouter); see Section 4.
Anthropic, PBC — triage / crop-verify and emergency analysis fallback; see Section 4.
Google LLC — Gemini for the live scan guide and VIN/plate OCR only; Firebase for sign-in, Analytics and Crashlytics diagnostics; Google Analytics for usage measurement on our website, including the Photo Check page (see Section 13).
Mailgun (Sinch), using its EU region — transactional email (including carseal Photo Check summaries and subscription confirmation emails; see Section 13) and, if you subscribe, marketing email.
Meta Platforms, Inc. / Meta Platforms Ireland Ltd. — advertising measurement, attribution and audience building, only when you opt in to analytics/tracking (see Section 2.6).
Apple Inc. and Google LLC — sign-in and in-app purchase billing (they act as independent controllers for the payment they process).
Our cloud hosting and storage provider ([HOSTING PROVIDER + REGION, e.g. Hetzner, EU]) — to run the carseal backend and store your evidence.

We use the U.S. National Highway Traffic Safety Administration's public vPIC VIN-decode service to translate a VIN into a vehicle specification. Only the 17-character VIN is sent; no personal account data is included.

We do not sell your personal data. If — and only if — you opt in to advertising measurement (Section 2.6), we share a limited set of app events with Meta for advertising attribution and audiences; you can withdraw this at any time in Settings. Apart from that opt-in, we do not share your data for cross-context behavioural advertising. We may disclose data if required by law, to enforce our Terms, or in connection with a merger, acquisition or sale of assets (in which case we will notify you and any successor will remain bound by this policy).

6. International data transfers

Some of our processors (including OpenRouter, Anthropic, Google and Apple) are based in, or process data in, the United States and other countries outside the European Economic Area and the United Kingdom. Where personal data is transferred out of the EEA or the UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum), and, where applicable, the providers' certification under the EU–U.S. Data Privacy Framework and its UK extension. You can ask us for a copy of the safeguards in place.

7. How long we keep your data

For the rental lifecycle: inspection evidence and related data are retained for as long as the associated rental is active and the evidence may be needed (pickup through return and report).
Dispute / legal window: after a rental ends, sealed evidence and related records are retained for a defined period to support any damage dispute and to allow legal claims to be made or defended — by default up to 24 months after the rental ends, or longer where a dispute or legal matter is ongoing or where the law requires.
Correction rows (dispute hold): staff and renter DamageReview rows (a before/after record of a finding correction) may be retained after account deletion as a legal/dispute hold. They are ineligible for training by default. DELETE /me forces training_eligible to false and unlinks actor identity (actor_user_id, actor_email). These rows are not used to train models.
Account data is kept while your account exists.
Analytics and crash diagnostics are retained for a limited period in line with Firebase defaults and our configuration.
carseal Photo Check: photos are never stored. Per-photo details are deleted 30 days after the check started and your email address 30 days after you first asked for the summary; after that we keep only anonymous totals. A request for marketing updates made through Photo Check that is never confirmed is deleted 30 days after the latest request. See Section 13.6.

When you delete your account, we erase your data as described in Section 8. Note that integrity of the evidence relies on sealed records being unaltered while retained; deletion removes the record entirely rather than altering it.

8. Your rights (EU / EEA and UK)

If you are in the European Economic Area or the United Kingdom, under the GDPR / UK GDPR you have the right to access, rectify, erase, restrict and object to processing of your personal data, the right to data portability, and the right to withdraw consent at any time (for example, analytics consent) without affecting prior processing. You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects; carseal's damage detection is an aid only and is not such a decision.

carseal builds two of these rights directly into the app:

Export my data — open Settings → Export my data. This calls /me/export and returns a machine-readable JSON copy of everything we hold for you: your profile, rentals, inspections (including GPS, odometer, fuel and the scan ledger), media metadata (file hashes, timestamps, locations — not the raw image bytes), detected damage, claims and dispute documents. This implements your right to data portability (Art. 20) and access (Art. 15).
Delete account — open Settings → Delete account. This calls DELETE /me and permanently erases your account, rentals, inspections, uploaded photos (best-effort on object storage), live damage findings, claims and dispute artifacts. This implements your right to erasure (Art. 17) for those records. Deletion is irreversible.

What is retained after account deletion as a legal/dispute hold: staff and renter DamageReview rows. Those rows store a before/after JSON of what the model said versus what a reviewer decided, plus opaque UUIDs (damage / inspection / media ids). They are not a training corpus: they are ineligible for training by default, and DELETE /me forces training_eligible to false and unlinks actor identity (actor_user_id, actor_email). The training-export endpoint stays frozen (Section 4); even if it were enabled, ineligible rows and rows whose photos were deleted cannot appear. If you want those hold rows erased as well, email privacy@carseal.ai.

You can also exercise any right by emailing privacy@carseal.ai. We will respond within one month. You have the right to lodge a complaint with your data protection authority: in Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP); in the UK it is the Information Commissioner's Office (ICO); in other EEA countries, your local authority.

9. Your United States privacy rights (California and other states)

This section applies to residents of U.S. states with comprehensive privacy laws, including California (CCPA as amended by the CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA) and others as they take effect.

We do not "sell" your personal information. If you opt in to advertising measurement (Section 2.6), we may "share" a limited set of app events with Meta for cross-context behavioural advertising as that term is defined under California law; this happens only with your opt-in, and you can withdraw it at any time in Settings (your right to opt out of sharing). Apart from that opt-in, we do not share your personal information for cross-context behavioural advertising. We do not use or disclose sensitive personal information for purposes that would require a right to limit.

In the past 12 months we have collected the categories of personal information described in Section 2 (identifiers such as email; commercial information such as purchases; geolocation; audio/visual information i.e. your vehicle photos; internet/usage activity i.e. analytics and crash diagnostics; and inferences in the form of damage findings). We collect it for the business purposes in Section 3 and disclose it only to the processors in Section 5.

Subject to your state's law and verification, you have the right to:

Know / access the personal information we have collected about you and how we use and disclose it;
Delete the personal information we hold about you;
Correct inaccurate personal information;
Opt out of sharing for targeted advertising — we never share for advertising unless you opt in, and you can withdraw that opt-in at any time in Settings;
Not be discriminated against for exercising your rights.

You can exercise the access, correction and deletion rights directly in the app (Settings → Export my data and Settings → Delete account) or by emailing privacy@carseal.ai. You may use an authorised agent. We will verify your request through your account sign-in. If we deny a request you may appeal by replying to our response; California residents may also contact the California Privacy Protection Agency or Attorney General.

10. Security

Uploaded photos are stored with cryptographic hashes and Merkle-rooted records in an append-only custody log. We do not currently use object-lock storage. Access to your data is restricted to your authenticated account. We apply technical and organisational measures appropriate to the sensitivity of the data, but no system is perfectly secure. If a personal-data breach is likely to result in a risk to your rights, we will notify the relevant authority and, where required, you, without undue delay.

11. Children

carseal is intended for users who are old enough to enter a car-rental agreement (at least 18) and is not directed to children. We do not knowingly collect personal data from children under 16 (or under 13 where U.S. COPPA applies). If you believe a child has provided us data, contact privacy@carseal.ai and we will delete it.

12. Users outside the EU, UK and US

If you use carseal from any other country, this policy still applies to you and we handle your data to the standard described here. You may also have rights under your local data-protection law; contact privacy@carseal.ai to exercise them and we will comply to the extent that law requires.

13. carseal Photo Check

carseal Photo Check (carseal.ai/photo-check) is a free tool on our website that checks whether your rental-car photos are sharp enough, well enough lit and of high enough resolution. You do not need an account. It measures image quality only: it does not look for damage, does not identify people, faces or number plates, and uses no AI. Where this section differs from the rest of this policy, this section applies to Photo Check.

13.1 Your photos are not kept

Each photo is sent to our own server, measured and then discarded. It is held only in memory (a file larger than 1 MB is briefly written to a temporary file, which is deleted as soon as the upload finishes) and is never saved to our database or file storage, so no one at carseal can look at it afterwards. Photos are never sent to an AI provider or to anyone else. Of the information stored inside the file, we use only the orientation tag, to know which way up the photo is; we do not use or store its location, camera details or any other metadata.

13.2 What we store about a check

For each photo: its file name, size, format (JPG, PNG or HEIC), pixel dimensions and position in your upload, the quality measurements and the result (whether it meets the criteria and, if not, why), and a SHA-256 fingerprint of the file, used only to spot the same photo being uploaded twice in the same check.
About the check: a random reference such as PC-7K2M9QXA, when it started and finished, the totals and the overall result, how you reached the page (the source, any campaign tags in the link such as utm_source, and the domain of the referring website, never its full address), your device type (mobile, tablet or desktop) and your browser language.
An access key that lets your browser continue the check. We store only a cryptographic hash of it. The key, the reference, your progress, any campaign tags from the link and, once you ask for the summary, a masked form of your email address (such as j***@example.com) are kept in your browser's session storage for that tab, which is cleared when you close it.
Website analytics: our website uses Google Analytics. On the Photo Check page it records events such as starting a check, the number of photos received and assessed, errors, and asking for the summary (including whether you ticked the updates box). It never receives your email address, file names, photos, per-photo results or the reference. Google Analytics sets cookies only if you accept them in the site's cookie banner; otherwise it receives only cookieless signals (Google Consent Mode).

13.3 If you ask for the summary by email

We store your email address with the reference of your check, whether that address had asked for a Photo Check summary before, the delivery status reported by Mailgun (for example delivered, bounced or marked as spam), the message ID, any sending error, the number of attempts, and when the email was sent, delivered or failed. We count clicks on the button in the email (with the times of the first and latest click) through our own link; Mailgun's open and click tracking is switched off for these emails. We also store the source and campaign tags of your visit, whether you ticked the box to receive carseal updates, when you first ticked it, and which version of the consent wording applied. If the hidden anti-bot field on the form is filled in, the request is ignored and nothing is stored or sent.

13.4 Purposes and legal basis

Purpose	Data used	Legal basis (GDPR / UK GDPR Art. 6)
Run the check and show you the result	Photos (in memory only), per-photo details, check details, access key	Performance of a contract — Art. 6(1)(b) (providing the free tool you ask for)
Email you the summary, resend it when you ask, and track its delivery	Email address, reference, delivery details	Performance of a contract — Art. 6(1)(b)
Prevent abuse and keep the tool available	IP address (temporarily, see below), the hidden anti-bot field, and limits on photos, on addresses per check, on summaries per address per day and on resends	Legitimate interest in a secure, available service — Art. 6(1)(f)
Produce anonymous statistics to improve the tool and measure our campaigns	Check details, totals and results, source and campaign tags, email request flags and dates	Legitimate interest in improving the tool and our marketing — Art. 6(1)(f)
Measure how the page is used (Google Analytics)	The page events described in Section 13.2	Consent — Art. 6(1)(a) for analytics cookies; legitimate interest — Art. 6(1)(f) for cookieless signals
Send you carseal updates, only if you tick the box and then confirm the separate email we send you	Email address, language, the campaign tags of your visit, consent record; our marketing emails record delivery and whether they were opened	Consent — Art. 6(1)(a), which you can withdraw at any time with the unsubscribe link in every email
Keep a suppression record so we never send marketing emails to an address that has unsubscribed, bounced or reported our emails as spam	Email address and its status	Legitimate interest — Art. 6(1)(f)

IP addresses. To enforce rate limits, our server keeps a counter for each IP address, which expires automatically within 24 hours at the latest. If a limit is exceeded, the IP address is written to our server log. Your IP address is not stored with your check or your email request.

Where we rely on legitimate interests, you may object as described in Section 8.

13.5 Who receives Photo Check data

Mailgun (Sinch), using its EU region, sends the summary email and, if you ticked the box, the confirmation email and any updates once you confirm (see Section 5).
Our hosting provider (Section 5) runs the servers that receive your photos and store the records described above.
Google receives the Google Analytics events described in Section 13.2.

No AI provider receives your Photo Check photos or any data about them. We do not sell Photo Check data.

13.6 How long we keep it

Photos: never kept (Section 13.1).
Per-photo details (file names, measurements, results and fingerprints) are deleted 30 days after the check started.
Your email address and delivery details (the message ID, sending errors and the campaign tags stored with your request) are deleted 30 days after you first asked for the summary, and the request is no longer linked to any subscription to carseal updates.
Marketing updates: if your latest request for updates was made through Photo Check and you never confirm it, it is deleted 30 days after that request. A confirmed subscription, with its consent record, is kept until you unsubscribe. If an address unsubscribes, bounces or reports our emails as spam, we keep it as a suppression record so that we never send it marketing emails again; Photo Check never deletes or reactivates such a record, so ticking the box again does not resubscribe an address that has unsubscribed.
What remains after 30 days, apart from a subscription you confirmed, is anonymous totals: the check's counts, result, issue types and advice, how the page was reached, device type and browser language, and, for an email request, its status, counters, dates, the opt-in flag and the consent wording version. The random reference and technical identifiers stay too, but with no email address attached we can no longer tell whose check it was.
Rate-limit counters expire within 24 hours (Section 13.4). Our automatic clean-up runs every few hours.

13.7 Your rights

You have the rights described in Section 8 (or Section 9 in the United States). To access or erase your Photo Check data, reply to the summary email or write to support@carseal.ai and quote the reference from that email (it starts with PC-), so we can find the right check. We will respond within one month. You can withdraw your consent to updates at any time with the unsubscribe link in every update email; this does not affect emails already sent. If you did not ask for the summary, we hold no contact details for your check. After 30 days we no longer hold your email address, so the remaining records cannot be linked to you unless you give us the reference.

14. Changes to this policy

We may update this policy. We will change the effective date above and, for material changes, notify you in the app. Continued use after an update means you accept the revised policy.

15. Contact

Questions or requests: privacy@carseal.ai, or by post to carseal, [REGISTERED ADDRESS].