1. Controller
The controller responsible for Carful is Vincent Halasz, Germany. You can contact the controller for privacy and GDPR requests at [email protected].
Last updated: July 24, 2026
Privacy Policy
2. What Carful processes
Carful is designed as a local-first vehicle companion. Depending on how you use the app, it may process vehicle profile details, mileage, distance units, VIN, engine information, photos, maintenance schedules, maintenance logs, repair and modification records, parts, links, attachments, workshop manuals, AI assistant prompts and responses, and technical data needed to operate the backend services.
3. Local storage and backend features
Core vehicle records are stored on your device. Before the first cloud or AI use, Carful creates a random anonymous installation credential, stores it in the device secure store, and asks for versioned consent. The credential scopes cloud data but does not identify you or provide cross-device recovery. With consent, relevant vehicle details, maintenance and repair data, prompts, and manuals are sent to Carful and OpenAI. Consent can be declined or withdrawn in the app.
4. AI and third-party processors
OpenAI is Carful’s AI subprocessor and may receive the content needed to answer your request, including prompts, vehicle context, repair summaries, maintenance items, and manual content. Carful requests non-persistent responses and does not retain raw prompts, but OpenAI’s separate abuse-monitoring retention may apply. Cloud deletion removes Carful records, OpenAI files and vector stores; local records remain unless you separately delete the profile.
5. Legal bases
Carful processes data to provide the app and requested features under contract performance, to operate and protect the service under legitimate interests, to comply with legal obligations, and, where required, based on your consent. You may withdraw consent where processing depends on it.
6. Retention
Local records remain until you delete them or remove the app. Authenticated cloud car data, manuals, OpenAI files and vector stores remain until deletion, consent withdrawal, or 180 days of inactivity. Carful does not retain raw prompts. Content-free security metadata is kept 30 days, detailed usage 90 days, de-identified spend totals 13 months, deletion records and encrypted backups 30 days, consent evidence 3 years, and closed support cases 90 days. OpenAI may retain API abuse-monitoring data for up to 30 days under its policy. Delete cloud data or withdraw consent in the app, or contact [email protected].
7. Your GDPR rights
Where the GDPR applies, you may request access, rectification, erasure, restriction of processing, data portability, or object to processing. You may also withdraw consent where applicable and lodge a complaint with a data protection supervisory authority.
8. International transfers
Some backend or AI providers may process data outside the European Economic Area. Where this occurs, Carful relies on appropriate safeguards such as contractual protections or other legally recognized transfer mechanisms.
9. Children
Carful is intended for people who maintain or document vehicles. It is not directed to children, and children should not use the app without appropriate parental or guardian involvement.
10. Changes
This policy may be updated as Carful evolves. Material updates will be reflected on this page.