Privacy policy
Last updated: 31 August 2026
Avtolov collects publicly posted car listings and compares them against each other. You do not need an account to use the site: search, listings and price comparisons are open to everyone, with no sign-in and no tracking.
This document says which personal data is processed, why, for how long, and what you can ask for. It is written to be checkable - every claim about what we store matches the actual database.
1.Who processes the data
The controller is the person or company operating the avtolov.si website.
For anything about privacy, or to exercise your rights, write to info@avtolov.si.
Before the first paying customer, this has to name the operator in full: legal name, address and company or tax number.
2.What data is processed
Without an account we collect nothing that could identify you. No analytics cookies, no advertising pixels, no visitor profiling.
When you type something in yourself, we process the following:
| Data | When it is created | Why |
|---|---|---|
| Email address, name (optional), password as a salted hash | When you create an account | So you have an account and can sign in |
| Google account data: email address, name, identifier | If you sign in with Google | Instead of a password |
| Session records (session id, expiry, the IP and browser recorded at sign-in) | When you sign in | To keep you signed in and let you revoke a session |
| Email address, the search criteria you picked | When you set up an alert for new listings | So we can send you the notification |
| Email address, signup source, optional message | When you join the waiting list | To tell you when we open |
| Salted hash of your IP address (SHA-256, truncated) | When you submit a form | Rate limiting per address; the IP cannot be reconstructed from the hash |
| Subscription status and payment provider identifiers | When you subscribe | So we know what you have unlocked |
3.Purposes and legal bases
- Performance of a contract (Art. 6(1)(b) GDPR): running your account, sign-in, subscription, and sending the alerts you asked for.
- Legitimate interest (Art. 6(1)(f) GDPR): site security, preventing form abuse, basic technical logs. The interest is a service that works and is not abused; the data involved is kept to the minimum.
- Consent (Art. 6(1)(a) GDPR): joining the waiting list. You can withdraw consent at any time through the link in every message, or by writing to info@avtolov.si.
- Legal obligation (Art. 6(1)(c) GDPR): keeping accounting records where they arise.
4.Cookies and local storage
We use only what the site needs to work. No Google Analytics, no Meta Pixel, no tag manager.
| Name | Type | What it does | Lifetime |
|---|---|---|---|
| better-auth.session_token | Cookie, strictly necessary | Keeps you signed in | Until sign-out or session expiry |
| better-auth.csrf_token | Cookie, strictly necessary | Protects against request forgery | Session |
| avtolov.cookies.v1 | Browser local storage | Records that you have seen this notice | Until you clear browser data |
5.Who we share data with
We do not sell data and we do not pass it on for advertising. It goes only to the providers we need to run the service, and only as far as they need it:
| Provider | Role | Where it processes |
|---|---|---|
| Vercel Inc. | Website hosting | EU (Frankfurt) |
| Neon Inc. | Database | EU (Frankfurt) |
| Resend (Plus Five Five, Inc.) | Sending email | USA, under standard contractual clauses |
| Google Ireland Ltd. | Google sign-in, if you use it | EU/USA |
6.Transfers outside the EU
Hosting and the database are in the European Union. Email goes through a provider based in the USA; the transfer relies on the European Commission's standard contractual clauses. Such a message contains only your email address and the content of the notification.
7.How long we keep it
- Account and everything tied to it: as long as the account exists. Deleting the account deletes the sessions, alerts and saved searches with it.
- Alerts for new listings: until you unsubscribe or delete the account.
- Waiting list: until the service opens or you withdraw consent, at most 24 months after signing up.
- Salted IP hashes from forms: 30 days.
- Accounting records: 10 years, as tax law requires.
8.Data taken from listings
Avtolov displays publicly posted listings from avto.net. Listings by private sellers can contain data relating to an individual - a seller's name, or a town. We show that data to the same extent it is publicly posted, and use it only to display the listing and to compute market statistics.
If you are a seller and do not want your listing shown on Avtolov, write to info@avtolov.si and we will remove it. Because we read listings from the source, it is also worth removing or amending the listing on avto.net itself, or it may reappear on the next pass.
Avtolov is not affiliated with avto.net, is not its partner, and does not act on its instructions.
9.Your rights
Under the GDPR you have the right:
- to access your data and receive a copy,
- to have inaccurate data corrected,
- to erasure (the “right to be forgotten”),
- to restriction of processing,
- to data portability in a machine-readable format,
- to object to processing based on legitimate interest,
- to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
10.Complaints
Send your request to info@avtolov.si. We answer within one month at the latest.
If you believe the processing breaches the rules, you can complain to the Information Commissioner of the Republic of Slovenia, or to the supervisory authority in your own country.
11.Security
All traffic to the site is encrypted (HTTPS). Passwords are stored as salted hashes and we cannot read them; if you forget yours, the only option is to reset it. Database access is limited to the application and the operator.
Nobody can guarantee perfect security. If a personal data breach occurs that is likely to result in a high risk to your rights, we will tell you, as Art. 34 GDPR requires.
12.Children
The service is not intended for people under 16, and we do not knowingly collect personal data from them.
13.Changes to this policy
We may change this policy when the service changes. The date of the last change is at the top. For significant changes that affect your rights, we notify registered users by email.
14.Contact
Privacy questions and requests to exercise your rights: info@avtolov.si.