Privacy policy

What we collect

Two flows, two different sets of data.

From dealers (sign-in)

• Your Google account email — verified at sign-in, used to look up your Drive folder; not stored on our side.
• Your Drive folder ID + the date you shared the folder with us (kept in a Google Sheet on our side).
• Consent records — which policy versions you accepted, and when.
• Dealership listing data (photos, prices, descriptions) — lives in your Drive folder, which you own. We read it as Viewer; we don't copy it to our own storage.

From buyers (browsing the site)

• Standard web traffic data — pages viewed, country, device type — via Vercel Analytics. No personally identifying info.
• UTM campaign parameters from the URL, stored in a first-party cookie (snagmoto_utm) so we know which ad campaign brought you. Expires after 30 days.

Cookies we set

• snagmoto_utm — UTM campaign attribution (buyers). Expires in 30 days.
• oauth_state, oauth_nonce — short-lived (10 min) anti-CSRF cookies during sign-in.
• session — your signed-in session (dealers + admins). Expires in 24 hours.

Sub-processors

• Vercel (EU/US) — hosting, Vercel Analytics, AI Gateway for description parsing.
• Google (EU/US) — Drive, Sheets, OAuth sign-in.
• Meta (WhatsApp) — when a buyer taps the WhatsApp CTA, the request goes directly to WhatsApp's servers; we don't see the message.
• Anthropic (US/EU) — Claude Haiku parses dealer listing descriptions into structured data. Listing text is sent for processing; no PII included.

Retention

We keep your folder ID and consent records as long as your folder is shared with snagmoto-sync@snagmoto.iam.gserviceaccount.com. Revoke the share and we lose access automatically; we delete the corresponding rows on the next sync.

Your rights

Access, rectification, erasure, portability. Email oleg@mlkv.org to exercise any of these.