Legal
Privacy Policy
Your privacy matters. We only collect what's necessary to make the service work, and we never sell your data.
1. Data controller
ARSTDATA LABS SL (trading as "ARST Data"; "ARST" or "we"), Spanish tax ID (NIF) B88701362 (contact: info@arstdata.com), is the data controller for the personal data collected through this website.
Contact email: info@arstdata.com
2. Data we collect
We collect the following personal data:
- Registration data: full name and email address, to create and manage your account.
- Usage data: pages visited, session duration and traffic source (via Google Analytics, only with your consent).
- Billing data: handled entirely by Stripe. ARST does not store card data.
- Contact data: name, company and message if you write to us through the contact form.
- Valuation history (
valuation_log): every time you request a valuation we store your user ID and your email address alongside the vehicle you queried (make, model, year, mileage and fuel type) and the result returned (price range, confidence level, model level and sample size). The record is written to the database of the country you queried. Purpose: delivering the service, being able to reconstruct and explain a valuation if you challenge it, and keeping track of the credits consumed. Legal basis: contract performance (Art. 6.1.b GDPR). - Account security log (
audit.log): we record the relevant events on your account — sign-up, email verification, log-in and log-out, failed log-in attempts, and password reset requests or changes — together with your email, your user ID and the IP address the event came from. Purpose: service security, detection of unauthorised access, and being able to evidence what happened and when. Legal basis: legitimate interest in protecting accounts and the platform (Art. 6.1.f GDPR). - Welcome bonus, once per mailbox: we keep an encrypted fingerprint (HMAC) of your email, never the email itself, so that the welcome credits are given only once per mailbox, also if you delete your account and sign up again. Purpose: fraud prevention. Legal basis: legitimate interest (Art. 6.1.f GDPR). Kept with no time limit, since its purpose is to stop the bonus being repeated.
- Credit movements (
token_ledger): every purchase and every consumption of credits is recorded with your user ID, the amount, the reason, the Stripe payment reference and the resulting balance. Purpose: managing your balance and evidencing charges and usage. Legal basis: contract performance (Art. 6.1.b GDPR).
3. Purpose and legal basis
| Purpose | Legal basis |
|---|---|
| Managing your account and access to the service | Contract performance (Art. 6.1.b GDPR) |
| Sending transactional emails (verification, invoices) | Contract performance (Art. 6.1.b GDPR) |
Calculating and recording your valuations (valuation_log) | Contract performance (Art. 6.1.b GDPR) |
Managing your credit balance and its movements (token_ledger) | Contract performance (Art. 6.1.b GDPR) |
Logging account security events with IP (audit.log) | Legitimate interest in security (Art. 6.1.f GDPR) |
| Encrypted fingerprint of the email to give the welcome bonus only once | Legitimate interest in preventing fraud (Art. 6.1.f GDPR) |
| Web analytics (Google Analytics) | Consent (Art. 6.1.a GDPR) |
| Responding to contact inquiries | Legitimate interest (Art. 6.1.f GDPR) |
4. Recipients and data processors
We do not sell your data and we do not share it with third parties for advertising purposes. To run the service we rely on the following providers, which process personal data on ARST's behalf as data processors (Art. 28 GDPR):
| Processor | What it processes | Location |
|---|---|---|
| Hosting provider | Hosts the servers and databases: your account, valuation history, credit movements and security logs, plus backups. | European Economic Area — no international transfer |
| Email provider | Email delivery: your email address and the content of the messages we send you (account verification, password reset, service notices). | European Economic Area — no international transfer |
| Stripe (payments) | Payment gateway: name, email, card details and billing data, which you enter directly in their environment. ARST never sees or stores the card number. | Stripe Payments Europe, Ltd. (Ireland), with processing by Stripe, Inc. in the USA |
| Google (Google Analytics 4) | Browsing data and the analytics cookie identifiers. Only if you accept analytics cookies. | Google Ireland Ltd. (Ireland), with processing by Google LLC in the USA |
Stripe's and Google's transfers to the United States rely on the EU-US Data Privacy Framework, declared adequate by the European Commission (Implementing Decision (EU) 2023/1795): both companies are certified under it, so the transfer requires no additional authorisation.
Beyond these processors, we only disclose personal data where a legal obligation requires it (for example, to the Spanish tax authorities) or where a court or competent authority requests it.
5. Data retention period
Account data is kept for as long as you maintain an active account. After closing your account, it is deleted within a maximum of 90 days, unless a longer legal retention obligation applies (e.g. billing data: 5 years under Spanish tax law).
Web analytics data is kept for the period configured in Google Analytics (14 months by default).
6. International transfers
Google Analytics transfers data to Google LLC servers in the US under the EU-US Data Privacy Framework, which the European Commission has declared adequate (Decision 2023/1795). Stripe processes payments under equivalent safeguards.
7. Your rights
Under the GDPR and the LOPDGDD (the Spanish data protection act), you have the right to:
- Access your personal data
- Rectify inaccurate data
- Request erasure (the "right to be forgotten")
- Object to processing or request its restriction
- Data portability
- Withdraw your consent at any time (without affecting the lawfulness of processing carried out before you withdraw it)
To exercise these rights, write to us at info@arstdata.com. You can also file a complaint with the Spanish Data Protection Agency (AEPD).
8. Security
Passwords are stored hashed with a strong hashing function. Communications always run over HTTPS with TLS 1.2+. We perform regular backups and restrict access to data.
9. Cookies
See our Cookie Policy for detailed information about the cookies we use.
10. Changes to this policy
We may update this policy periodically. We will notify you by email if the changes are significant. The last-updated date appears at the top of this page.