How we handle your data.

1. Who we are

Autoflip is gevestigd in Belgium. Voor vragen over je privacy: hallo@autoflip.eu. We are the data controller for the processing described below. If you want our full company details, we send them on simple request via that address.

2. Which data we collect

From you as a user we keep:

• Email address (to log you in and send invoices)
• Plan choice and subscription status
• Your filter rules (brand, price, year, etc.)
• Telegram chat ID (to be able to send you alerts)
• Match history (which listings you received, max. 7 days)
• Message preferences
• Payment reference (Mollie customer ID - we never see a card number)
• Phone number (given at signup, so we can reach you about your account)
• The IP address of your signup (once, to prevent anyone creating unlimited trial accounts)
• Your invoice details if you fill them in yourself (company name, address, VAT number) plus your invoices

During your use we register no analytics cookies, no IP addresses for tracking and no profiles. We do keep a short technical access log for security (max. 30 days).

3. Listing and seller data from the platforms

Per advertentie slaan wij de generieke kenmerken op (merk, model, prijs, jaar, km, locatie-stad, brandstof, type verkoper als categorie). Deze advertentiegegevens worden na automatically deleted after 7 days. Beschrijvingsteksten en contactgegevens (telefoon/e-mail) van adverteerders halen wij not op.

Wij bewaren no names, profiles or contact details of advertisers en wij benaderen adverteerders niet.

4. If you are a partner

Meld je je aan voor het partnerprogramma, dan bewaren wij daarnaast: je naam, e-mailadres, telefoonnummer, land, je aanbrengcode en, als je die invult, je IBAN, de naam op je rekening en je btw-nummer. Rechtsgrond: performance of the contract (art. 6(1)(b) GDPR). For the payouts the statutory retention obligation.

Van een klant die via jouw link binnenkomt leggen wij vast dat hij aan jou is toegewezen, samen met het IP-adres van die aanmelding. Dat IP gebruiken wij uitsluitend om te herkennen of iemand zichzelf aanbrengt. In je partnerdashboard zie je van je aangebrachte klanten alleen een masked email address, never the full address.

If you click a partner link, we set a cookie (af_ref) that keeps for 90 days which partner you came in through. That cookie contains only the partner's code and no personal data.

5. Legal basis

• Performance of the contract (Art. 6(1)(b) GDPR) - om de dienst te leveren waar je voor betaalt
• Legal obligation (Art. 6(1)(c)) - voor facturatie en boekhouding
• Legitimate interest (Art. 6(1)(f)) - voor beveiliging en fraude-preventie

6. Who else sees your data

Not every party below has the same role. That difference determines what we can enforce for you, so they are listed separately.

Processors: they act solely on our instruction

These parties may use your data only for what we instruct them to do. None of them may do anything else with it. With each of them we have a data processing agreement.

Independent controllers: they decide themselves what they do with your data

These parties are not our processors. They also process data for their own purposes and determine the purpose and means themselves. We cannot conclude a data processing agreement for that, because none exists for these services. What they do with your data is set out in their own privacy statement.

No data of yours

Voor het doorzoeken van de advertentieplatforms gebruiken wij Webshare (proxydiensten, EU en VS). Daar gaat geen enkel gegeven van jou doorheen: die verbindingen halen uitsluitend openbare advertenties op.

Statistics and session recordings. PostHog and Microsoft Clarity are only loaded once you tick the Statistics category in the cookie banner. If you do not, nothing about you is measured. PostHog registers which steps you take and recognises you by an internal customer number, never by your email address or phone number. Clarity makes a rendering of mouse movements, clicks and scrolling; no image or sound of you is recorded. Clarity deliberately does not op je dashboard, je accountpagina of de partnerpagina's, omdat daar je factuur- en contactgegevens in beeld staan. De koppelcode voor Telegram wordt in de opname afgeschermd. Microsoft verwerkt deze gegevens in de Verenigde Staten; de grondslag daarvoor is het EU-VS Data Privacy Framework, waarvoor de Europese Commissie een adequaatheidsbesluit heeft genomen. Je kunt je toestemming op elk moment intrekken via de link onderaan elke pagina.

For Clarity, Microsoft is not a processor but an independent controller. That is an essential difference: Microsoft also processes the data coming in via Clarity for its own purposes, including improving its services. Microsoft determines the purpose and means itself. We therefore do not conclude a data processing agreement with Microsoft for Clarity; Microsoft does not offer one for this service. What Microsoft does with that data is set out in the Microsoft privacy statement. That is precisely why we load Clarity only after your explicit consent. On the pages that show your invoice and contact details it never runs.

7. Retention periods

• Account and filters: as long as your account is active + 30 days after cancellation
• Listings and match history: max. 7 days, then deleted automatically
• Payment and invoice data: 7 years (statutory tax retention obligation)
• Access logs: 30 days
• Partner data and payouts: as long as you are a partner, then 7 years for the bookkeeping

8. Your rights

Under the GDPR you have the right to:

• Access - download al jouw data via je dashboard ("Data-export · GDPR")
• Rectification - pas je gegevens aan in je dashboard
• Erasure - "Verwijder account" in je dashboard wist alles binnen 24u
• Restriction and objection - write to hallo@autoflip.eu
• Portability - data-export geeft je een JSON-bestand om te migreren
• Lodge a complaint - with the Data Protection Authority (BE) or Dutch Data Protection Authority (NL)

9. Cookies

Wij plaatsen één functionele cookie (sessie-token om je ingelogd te houden). Geen tracking, geen marketing, geen analytics. Zie het volledige cookie statement.

10. Changes

For material changes we email you 14 days in advance. Continued use after that period means acceptance. Otherwise you can terminate your account free of charge.