Privacy policy

VINVARO ("we") provides the VINVARO platform at app.vinvaro.com and the VINVARO mobile app, and runs the website vinvaro.com. Privacy questions can be sent to info@vinvaro.com.

We have two roles. For the website, accounts, billing and support we are the controller. For the data a dealer records in VINVARO, such as vehicles, customers, messages and contracts, the dealer is the controller and we are the processor. That processing is governed by a data processing agreement, which is part of our terms of service.

• Website visitors: what you enter in the contact or demo form (name, email address, company, phone number, message, chosen demo time) and anonymous visit statistics.
• VINVARO users: name, email address, password (stored only in hashed form), profile photo, role and permissions, language and display preferences, and a log of who changed what and when.
• Billing: the dealer's company details, usage per period and the invoices.
• Dealer data: vehicles, contacts and their contact details, inquiries, appointments, email and WhatsApp messages, contracts, invoices, photos and documents the dealer records.
• Connected accounts: when a user connects Gmail, Outlook, WhatsApp or a calendar, we store the access tokens (encrypted) and the email address or number of that account. See also section 4.

• Providing VINVARO to the dealer and its users (performance of the contract).
• Answering contact requests and scheduling demos (legitimate interest, or at your request).
• Billing and meeting legal retention duties, such as the seven-year tax retention period (legal obligation).
• Security, preventing abuse and improving the service with anonymised statistics (legitimate interest).

A user can connect a Google or Microsoft account themselves. We only request the permissions needed for the feature the user turns on:

• Gmail (gmail.send) and Outlook (Mail.Send): sending email on the user's behalf from VINVARO, for example replies to customers and documents. We don't read your mailbox through Gmail; incoming email only arrives when you forward it to your VINVARO inbox address yourself.
• Outlook (Mail.ReadWrite): fetching new messages in your inbox so you see customer conversations in the shared VINVARO inbox.
• Google Calendar (calendar.events) and Outlook calendar (Calendars.ReadWrite): adding, updating and removing appointments such as test drives and handovers in your own calendar, and showing busy times so you don't double-book.

VINVARO's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. This means: we use this data only for the features above, which the user turns on; we don't sell it, use it for advertising or use it to train AI models; and humans don't read it unless the user consents, it is needed for security, or the law requires it.

You can disconnect at any time in VINVARO (Settings › Integrations or Inbox) or in your Google or Microsoft account. We then delete the access tokens.

We use carefully selected suppliers with whom we have data processing agreements. Data is stored within the European Economic Area wherever possible.

• Supabase: database, storage and sign-in (servers in Ireland).
• Vercel: hosting of the website and the app, and anonymous visit statistics.
• Resend: sending and receiving email (EU, Ireland).
• Google: business email, address search (Places) and, if you connect them, Gmail and Google Calendar.
• Microsoft: Outlook and the Outlook calendar, if you connect them.
• Meta: WhatsApp Business, if the dealer connects WhatsApp.
• AI providers through Vercel AI Gateway: for labels, lead scores, reply drafts and reading documents. They don't use the data to train their models.
• Netherlands Chamber of Commerce (KVK), RDW and the EU (VIES): for company, vehicle and VAT data.
• Marketplaces such as mobile.de and AutoScout24: only the listing data of vehicles the dealer publishes.

Where a supplier is based outside the EEA, we put appropriate safeguards in place, such as the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.

• Contact and demo requests: up to two years after the last contact.
• Account data: as long as the account exists, then at most three months in backups.
• Dealer data: as long as the subscription runs. After cancellation the dealer can export everything; we then delete the data within three months.
• Invoices and the related records: seven years (tax retention duty).

Connections are encrypted (HTTPS). Passwords and access tokens of connected accounts are stored encrypted. Dealers' data is strictly separated: staff only see their own company's data, and only what their role allows. Changes are logged.

The website uses no tracking or advertising cookies. Vercel's visit statistics are anonymous and work without cookies. The demo form keeps your answers temporarily in your own browser, so you can continue later.

The VINVARO app only uses necessary cookies: to keep you signed in and remember your language and display choice.

You have the right to access, correct, delete, restrict and port your data, and to object to processing. Email us at info@vinvaro.com; we reply within one month. If it concerns data a dealer records about you, we forward your request to that dealer or help it handle your request.

Not happy with how we handle your data? You can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

We may update this privacy policy. The date at the top shows when that last happened. We inform users in advance of important changes.