Legal

Privacy Policy

Last updated: 15 October 2026

1. Controller

The controller for the processing of personal data on merrvetura.com and in the MerrVetura app is:

Berat Murati, Berlin, Germany
Email: info@merrvetura.com
Address and phone: see the Imprint

Which law applies. Because we are based in Germany, all processing is governed by the General Data Protection Regulation (GDPR), supplemented by the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG) — whether you live in Germany, in Kosovo or elsewhere. For users in Kosovo we also observe the Kosovo data protection law, Law No. 06/L-082; its corresponding provisions are given in brackets after the GDPR articles.

2. Supervisory authority

The competent authority is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin — datenschutz-berlin.de. If you believe we process your data unlawfully, you can complain there at any time — or to any other data protection supervisory authority in the European Union, in particular in the country where you live or work (Art. 77 GDPR).

If you live in Kosovo, you can also contact the Information and Privacy Agency (AIP) of the Republic of Kosovo, Prishtina — aip.rks-gov.net.

3. What data we process

Each entry states the purpose, the legal basis and how long we keep it. The legal bases are:

  • performance of a contract — Art. 6(1)(b) GDPR (Art. 5(1)(1.2) of Law 06/L-082);
  • legitimate interest — Art. 6(1)(f) GDPR (Art. 5(1)(1.6)); the interest is stated with each purpose;
  • consent — Art. 6(1)(a) GDPR (Art. 5(1)(1.1)).
  • Account data — display name, email address, phone number, city, language, WhatsApp and Viber flags, account type (private or dealer). Purpose: running your account and making you reachable for buyers. Basis: performance of a contract. Retention: until the account is deleted.
  • Sign-in with Apple or Google — if you choose it: an identifier from the provider, your email address (with Apple, if you wish, an address relayed by Apple) and your name (Apple only sends it on the first sign-in). With Apple we also store an access token that we only use to disconnect your Apple sign-in when you delete your account. Purpose: signing in without a separate password. Basis: performance of a contract. Retention: until the account is deleted.
  • Listings — vehicle details, price, description, photos and videos. Purpose: publishing your offer. Basis: performance of a contract. Retention: until the account is deleted; expired and deleted listings and their photos are removed for good after 12 months.
  • Messages — the content of chats between buyers and sellers. Purpose: communication through the platform. Basis: performance of a contract. Retention: as long as the account exists. We keep them deliberately, because in a dispute over a car purchase they are often the only evidence.
  • Favourites and saved searches — saved listings, filters, notification setting. Purpose: finding things again and alerting you to new matches. Basis: performance of a contract. Retention: until you delete them or the account ends.
  • Search log — the filters used and the number of results, with no link to your account. Purpose: understanding what people look for in Kosovo and where our supply falls short. Basis: legitimate interest. Retention: cleared automatically at regular intervals.
  • Contact events — the fact that a signed-in user clicked “Call”, “WhatsApp” or “Message”, with the channel, the date and a link to the account. We do not count clicks without sign-in. Purpose: showing sellers how many contacts a listing produces, and limiting abuse. Basis: legitimate interest. Retention: until the listing is deleted.
  • Reviews — stars, text, the dealer’s reply and your display name. Purpose: guidance for other buyers. Basis: legitimate interest. Retention: until you delete the review or the account ends.
  • Vehicle documents — sale contract, registration, customs papers, service and inspection records that a dealer files against a vehicle. These files regularly contain names and details of third parties. Purpose: keeping a vehicle’s paperwork together. Basis: performance of a contract. Retention: until the dealer deletes or archives them.
  • Push identifiers — the device identifier issued by Apple or Google, with platform and last contact. Purpose: alerts about new messages and search matches. Basis: your consent. Retention: until you turn notifications off in your device settings or the account ends.
  • Email log — recipient address, type of message and whether delivery succeeded. Purpose: checking whether a confirmation or password email arrived. Basis: legitimate interest. Retention: 90 days.
  • Audience and speed measurement — see section 6.

We collect no special categories of data — nothing about origin, religion, health, politics or sexual orientation. We do not sell data and do not share it for advertising.

Data in the dealer cockpit

Dealers keep their own customer records in the cockpit: name, phone number, notes, search requirements, appointments and trade-in requests. Responsibility here is split, as follows:

  • We are the controller for the handover itself. When you click “Call”, “WhatsApp” or “Message”, or write to a dealer, we automatically create a contact record there with your display name and — if you provided one — your phone number. That is our decision, not the dealer’s. The basis is the contact you initiated yourself (Art. 6(1)(b) GDPR; for the transfer to Kosovo see section 5); we tell you explicitly before your first contact and record your acknowledgement. If you would rather not, remove the phone number from your profile — then none is passed on.
  • The dealer is the controller for everything after that: the notes it writes about you, records it enters by hand, and how long it keeps the data. For that part we act only on its instructions.

So address access and erasure requests to the dealer. Write to us anyway if you get nowhere — we pass the request on and delete what is in our hands.

4. Who receives data

We use the following providers. They process data only for us and on our instructions; with Supabase, Vercel and Resend we have a data processing agreement under Art. 28 GDPR for this:

  • Supabase Pte. Ltd. (Singapore; database and files are held on servers in Frankfurt, European Union) — database, sign-in and file storage. Account, listing, message and document data lives here.
  • Vercel Inc. (USA) — running the website. Our server functions run in Frankfurt; requests are received by Vercel’s global network at the nearest location. Processes technical request data such as IP address and browser identifier, plus the measurements in section 6.
  • Resend (Plus Five Five, Inc., USA) — sending our account emails. Receives your email address and the content of the message concerned.
  • Google LLC / Firebase (USA) — delivering push notifications to the iOS and Android app. If you have enabled push, it receives your device’s push identifier and the notification text.

Sign-in with Apple or Google. When you sign in with Apple (Apple Inc., USA) or Google (Google LLC, USA), these providers do not act on our behalf but under their own responsibility and their own privacy policies. We only receive the details listed in section 3 from them. When you delete your account, we disconnect it from Apple; for Google you can remove the access in your Google Account.

Maps (Google Maps). For dealers you can show a map of their location in the listing and on the dealer page. The map only loads when you tap “Show map”; until then nothing is sent to Google. Your device remembers that tap; after that maps load right away until you turn it off in section 7. After you tap, your device loads the map directly from Google (Google Ireland Limited, Ireland, or Google LLC, USA). Google receives your IP address, details about your browser and device and the address shown, and may set cookies. Google acts under its own responsibility and its own privacy policy (policies.google.com/privacy).

Beyond that we disclose data only where the law obliges us or where an authority or court lawfully requires it.

What you write into a listing yourself — vehicle details, photos, your display name and, if you provided it, your phone number — is publicly visible to every visitor and may be indexed by search engines. Think carefully about which contact details you give.

5. Transfers outside the European Union

Some recipients are outside the EU. For each transfer, the basis under Chapter V GDPR is given here.

  • Vercel Inc. (USA) — is certified under the EU-U.S. Data Privacy Framework; for certified companies the European Commission’s adequacy decision applies (Art. 45 GDPR). Our contract with Vercel also contains the European Commission’s standard contractual clauses.
  • Resend (Plus Five Five, Inc., USA) — to send our account emails, your email address and the content of the sign-up confirmation or password reset go there. Resend is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); the contract also contains the standard contractual clauses. Under Kosovo law the transfer is necessary to perform our contract with you (Art. 49(1)(1.3) of Law 06/L-082).
  • Supabase Pte. Ltd. (Singapore) — the data is held in Frankfurt. Where Supabase or its sub-processors access it from outside the EU, for example for maintenance, backups or logs, the European Commission’s standard contractual clauses apply, which form part of our contract (Art. 46(2)(c) GDPR).
  • Sign-in with Apple or Google — if you choose this sign-in, we exchange data for it with Apple or Google: the sign-in code and, with Apple, the access token when you delete your account. You choose this route yourself; signing in with email and password works without it. The transfer is necessary for the sign-in you chose (Art. 49(1)(b) GDPR; Art. 49(1)(1.3) of Law 06/L-082). Google LLC is also certified under the EU-U.S. Data Privacy Framework; Apple states that it safeguards transfers from the European Economic Area with standard contractual clauses.
  • Maps (Google Maps) — if you tap “Show map”, data may go to Google LLC in the USA (see section 4). This only happens after you have tapped “Show map” once and rests on your consent given by that tap, which you can withdraw at any time in section 7. Google LLC is certified under the EU-U.S. Data Privacy Framework. Without it the map stays off; the address and “Directions” work without it.
  • Google LLC / Firebase — for push notifications, your device’s push identifier and the notification text go there, and only if you enabled push. Push rests on your consent, which you can withdraw at any time in your device settings. Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).
  • Sellers and dealers in Kosovo — there is no European Commission adequacy decision for Kosovo. When you write to a seller through the platform, your message reaches them with your display name; for dealers we also create the contact record from section 3. The transfer is necessary for the contact you initiated yourself (Art. 49(1)(b) GDPR).

6. Audience and speed measurement

We use Vercel Web Analytics to see which pages are opened. It records the time, the page opened, the referring source, filtered address parameters, country and region, device type, and browser and operating system with version. A visitor is derived from a check value that Vercel discards after 24 hours, so recognition across days or across other websites is not possible. Basis: legitimate interest — we want to understand which pages are used.

With Vercel Speed Insights we measure how fast our pages load. For each page view it records the page, loading-time metrics (such as when the first content appears), the connection type (such as 4G), browser, device type, operating system and country. No identifier is created that would let a visit be followed across several pages. Basis: legitimate interest in a fast, working website.

Both measurements work without cookies and store nothing on your device.

Meta Pixel — only with your consent: On public entry pages, the listing form and the dealership page, we use the Meta Pixel to measure Facebook and Instagram advertising and optimise it for published listings and completed dealership registrations. The pixel loads only after you accept the ad measurement notice. Declining does not affect your use of the platform.

The recipient is Meta Platforms Ireland Limited. Meta receives page views, timestamps, browser and device information, the IP address and, where applicable, cookie identifiers, plus the events “listing published” and “dealership registration completed”. We do not pass names, telephone numbers, email addresses, messages or form entries to the pixel. Automatic advanced matching and automatic event detection are not used. Meta may link this information to your Facebook or Instagram account and process it for ad measurement and personalisation; processing by Meta in the USA is possible. See Meta’s Privacy Policy for details. Our use of the pixel is based on your consent, Art. 6(1)(a) GDPR. You can withdraw it at any time via “Privacy settings” in the footer; we then stop sending further pixel events.

The pixel is not used in the app wrapper or on account, sign-in, messaging or CRM pages. We do not use a Google Ads pixel.

7. What is stored on your device

For the platform to work we store a few values in your browser. Apart from sign-in these are not classic cookies but local storage — the values stay on your device and are not transmitted to us unless stated otherwise below.

Cookies

  • Sign-in session (Supabase, name starts with sb-) — keeps you logged in. Without this cookie there is no account.
  • mv_app — recognises that you use the app rather than the website. 180 days.
  • mv_mode — remembers dealer or buyer view. 1 year.
  • mv_onb, mv_city — remember that you finished the welcome flow, and the city you chose. 1 year.

Local storage — stays until you clear it

  • mv-compare — your comparison list.
  • mv-onboarding, mv-mode — your answers from the welcome flow and the chosen view.
  • mv-guest-draft and mv-guest-photo-… — a listing you started along with its photos, if you begin without an account. The photos sit in your browser’s database and reach us only when you publish.
  • mv-ken-history — your recent questions to the search assistant.
  • mv-app-banner-dismissed, mv-push-dismissed, mv-listing-published — remember which notices you dismissed.

Session storage — gone when you close the tab

  • mv-anon-id — a random number that is only created when you report a reel without signing in. It reaches us only as a check value combined with the day’s date, so the same report does not count twice, and allows no re-identification.
  • mv-contact-draft:… — a message you started, so it survives signing in.
  • mv-capture-session — the daily counter in dealer quick capture.

The values described above are necessary for the features you are using. Separately, we remember acceptance or refusal of ad measurement inmv-marketing-consent-v1 for 180 days. After consent, the Meta Pixel may set _fbp and _fbc cookies (up to 90 days). Session storage mv-meta-conversions-v1 prevents the same successful action from being reported more than once. On withdrawal, we delete pixel cookies on our domain and stop further events. You can clear storage at any time in your browser settings.

With your consent

  • mv-maps — that Google Maps load right away for you (local storage, see section 4). It is set when you first tap “Show map” and stays until you turn it off here or clear the storage.Google Maps only load after you tap “Show map”.

8. Your rights

Under the GDPR — and for users in Kosovo equally under Law 06/L-082 — you have the right:

  • to request access to the data we process about you, and a copy;
  • to request rectification of inaccurate or incomplete data;
  • to request erasure of your data;
  • to request restriction of processing;
  • to object to processing based on legitimate interests;
  • to receive your data in a machine-readable format (portability);
  • to withdraw consent you gave — for push notifications, say — without making the earlier processing unlawful;
  • to complain to a supervisory authority (Art. 77 GDPR, see section 2).

Delete your account: you can do this yourself — in your profile, at the bottom, under “Delete account”. That removes your account, listings, messages, favourites and saved searches. If you prefer, write to info@merrvetura.com instead; we will do it within 30 days.

Export your data: also in your profile. You receive your account, listing, message and favourite data as a machine-readable JSON file.

For anything else an email to info@merrvetura.com is enough. We reply within one month.

9. How long we keep data

In summary; for detail see section 3:

  • Account, messages, favourites and saved searches: until you delete the account.
  • Expired and deleted listings with their photos: another 12 months, then removed for good.
  • Email log: 90 days.
  • Search log: cleared automatically at regular intervals.
  • Our host’s server logs: short technical periods, deleted automatically.

We keep data longer only where the law requires it or where we need it to defend or pursue legal claims.

10. Changes to this policy

We update this policy when the processing changes. The date at the top shows the current version. For material changes we also tell you by email or inside the platform.

11. Contact

Privacy questions: info@merrvetura.com