Datenschutzerklarung

1. Data controller

• Operator: Dream Car Garage
• Address: Spain
• Contact email: privacy@dreamcargarage.app

2. Data we collect

We collect the following personal data:

2.1 Registration data

• Email address
• Password (stored as bcrypt hash, never in plain text)
• Name (optional)
• Username (auto-generated from email)

2.2 Google OAuth data

If you sign in with Google, we receive your name, email address, and profile picture from Google. We also store OAuth access tokens necessary for authentication.

2.3 Usage data

• Garage collections (vehicle selections, names, descriptions)
• Evolution timelines (collection stages)
• Likes and user follow data
• Scores and view counts (public garages)

2.4 Technical data

• IP address (only for login rate limiting, stored in server memory for 15 minutes)
• Cookie preferences and consent

3. Purposes and legal bases

4. Data recipients

The AI garage builder runs on our own infrastructure in the European Union (Hetzner Cloud, Germany); your message is not sent to any external AI provider and never leaves the EU.

We do not sell, rent, or share your personal data with third parties for marketing purposes other than those described above.

5. International transfers

Your database is hosted in the European Union (Hetzner Cloud, Nuremberg, Germany). The only data transferred outside the EU is:

• Google OAuth authentication data (USA) — necessary for the service you request.
• Google AdSense advertising data (USA) — currently disabled. When reactivated, only if you accept advertising cookies. Google LLC is certified under the EU-US Data Privacy Framework.
• Google Analytics GA4 data (USA) — currently disabled. When reactivated, only if you accept analytics cookies. Google LLC is certified under the EU-US Data Privacy Framework.

The AI garage builder does NOT transfer data outside the EU: inference runs on an open-source model hosted on our own infrastructure in the European Union.

6. Data retention

• Account data: while the account is active.
• Session data (JWT): 30 days.
• IP data for rate limiting: 15 minutes (in memory, not persistent).
• Consent records: for the duration of the contractual relationship plus 5 years.

7. Your rights

Under the GDPR (Articles 15 to 22) and the Spanish LOPDGDD, you have the right to:

• Access: request a copy of your personal data.
• Rectification: correct inaccurate data.
• Erasure: request deletion of your data ("right to be forgotten").
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interest.
• Restriction: request restriction of processing in certain circumstances.

To exercise any of these rights, contact us at privacy@dreamcargarage.app. We will respond within one month.

For data processed directly by Google (advertising and analytics), you can manage your preferences and request deletion through Google's privacy controls at myaccount.google.com.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD): www.aepd.es.

8. Children

In accordance with Article 7 of the Spanish LOPDGDD, children under 14 require parental or guardian consent to register on Dream Car Garage.

9. Security

We implement technical and organisational measures to protect your data, including: encryption in transit (HTTPS/HSTS), password hashing (bcrypt), security headers (CSP, X-Frame-Options, X-Content-Type-Options), rate limiting on authentication endpoints, and a restrictive permissions policy.

10. Cookies

For detailed information about the cookies we use, see our Cookie Policy.

11. Changes

We reserve the right to update this privacy policy. Any changes will be posted on this page with the revised update date. We recommend checking this page periodically.