Privacy policy
Last updated: 22 October 2026
Data controller and contact
Think AI SRL is the data controller for OBDAuto.ro. For privacy questions, to exercise your rights or withdraw a published experience, contact [email protected].
Data, purposes and legal bases
Public pages can be read without an account. Account authentication and profile information received through Base44 is used to provide the account service you request, under GDPR Article 6(1)(b). Technical data needed to deliver pages and protect the service, including IP addresses and connection details, is processed for our legitimate interests in site operation and security under Article 6(1)(f). We do not use this data for solely automated decisions with legal effects on you.
Optional statistics and withdrawing permission
Only after you accept Optional statistics do we start Base44 page-view counting and save search terms, vehicle filters, language and result counts. The legal basis is consent under GDPR Article 6(1)(a). Common email, phone, VIN and registration patterns are removed from measured terms; this does not guarantee that every free-text entry is anonymous. Do not enter personal data in searches. Search statistics are restricted to administrators. Automatic Base44 SDK initialization, attribution and heartbeat telemetry is disabled. You can reject or withdraw permission in Privacy preferences in the footer. Withdrawal stops future optional collection without affecting the lawfulness of earlier processing; contact us about deleting data already retained.
Community experiences
Submitting an experience requires sign-in. We retain the submission linked to your account for moderation, including the code, manufacturer, language, vehicle details and case description. Publication requires your explicit permission and moderation, under GDPR Article 6(1)(a). Your account name and email are not displayed in the published experience. Do not include names, contact details, registration plates or VINs. Experiences are user reports, not diagnoses confirmed by the site. You may withdraw permission and request removal at [email protected].
Optional publication of car valuations
Personal valuation history is not published automatically. Only choosing Publish valuation and confirming permission sends the previewed details for publication: make, model, engine, year, mileage, fuel, gearbox, reported condition, market, currency, original new price if supplied, result, method and publication date. Account names, email addresses and VINs are not part of the public report. If you are signed in, the platform may associate the record with your account internally. A random key is kept in your browser to withdraw the report; the server stores only its hash. Use Published from this browser to withdraw a report, including after it leaves the latest list. Clearing browser data does not withdraw the report from the site; if you lose the key, email [email protected]. Withdrawal removes the report content from the record and public list. We retain the key hash and technical operation dates to prevent an accidental republication by a delayed request. Copies already saved by other visitors cannot be automatically withdrawn.
Contact and problem reports
We use the information in your messages to respond, based on our legitimate interest in handling enquiries or, where applicable, steps requested before a contract. Content reports retain the code, manufacturer, language, category and description to verify and correct information, based on our legitimate interest in accurate content. No email address is required in a report. If you are signed in, the platform may associate the record with your account. Do not include personal data in the description.
VIN decoder and the NHTSA service
Pressing Decode sends the VIN directly from your browser to NHTSA vPIC, a US service. NHTSA also receives connection details, including your IP address; it is an external recipient with its own policies, not a service hosted by OBDAuto. The transfer is triggered only by your decoder request after the on-page notice. OBDAuto does not save the full VIN to your account, search statistics, local storage or page URL. The result remains temporarily on screen; Clear removes it. The ASTRA/FEDRO catalogue is hosted by OBDAuto: your browser requests VIN-prefix data and matches the full VIN locally, without sending it to ASTRA. CSV/PDF exports you choose contain the VIN and selected variant.
How long we retain information
Accounts are retained while the account service is used and until a deletion request is handled, except for legal obligations or data strictly needed to defend legal claims. Submissions and reports are retained as needed for moderation, corrections and evidence of the outcome; approved experiences remain public until withdrawal or justified removal. Search statistics are retained as needed for content analysis and improvement, then deleted or aggregated; the need to retain them is reviewed periodically. Base44 documentation states that its visit analytics are automatically deleted after 60 days; technical logs and backups follow separate provider rules. Messages and rights requests are retained as needed to handle them and demonstrate the response.
Providers, recipients and international transfers
We use Base44 for hosting, authentication and app records, and the domain's infrastructure and security services, including Cloudflare. Providers may receive technical information and, for the relevant features, account or submitted record data. Base44 publishes a Data Processing Addendum (DPA), its sub-processor list and declared international-transfer mechanisms. Processing may involve countries outside the EEA. Its DPA describes adequacy decisions, the EU–US framework or standard contractual clauses as applicable; contact [email protected] for information about safeguards relevant to your situation. The NHTSA integration is described separately above. We do not sell personal data.
Your rights
Subject to the GDPR conditions, you may request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interests. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. Some rights depend on the legal basis and are not absolute. Data needed to handle rights requests is processed to meet legal obligations under GDPR Article 6(1)(c).
Requesting access or deletion
Email [email protected] with your request and the relevant account or record. We verify identity proportionately to avoid disclosing or deleting another person's data. We normally respond within one month of receipt; complex requests may require up to two additional months, with notice during the first month. Switching statistics off does not automatically delete earlier records. Account erasure requires associated records to be checked separately; some provider logs or backups may follow its retention periods.
Complaints and the supervisory authority
You may complain to Romania's National Supervisory Authority for Personal Data Processing (ANSPDCP), or the competent supervisory authority in the EU country where you live or work.
Advertising and external links
No personalised advertising network is active in this version. Links to other websites, including any affiliate links, lead to services with their own privacy policies. Permission for statistics does not automatically authorise advertising or newsletters. If a new processing purpose requires permission, we will ask separately.