Privacy Policy

OnlyCars GmbH Rosenthaler Str. 72A 10119 Berlin Germany Represented by: Mr. Benjamin Fiege, Managing Director Email: support@onlycars.de

This privacy policy explains how personal data is processed when you use the website onlycars.de, the OnlyCars dealer web app, public vehicle and share pages, lead forms, login and payment features, and related technical services. Personal data is any information relating to an identified or identifiable natural person.

Depending on how you use the service, we process the following data in particular: - Dealer account data, such as name, company name, email address, login data, roles, and administrator status. - Dealer profile data, such as logo, website, phone number, contact email, contact person, address, and contact hours. - Vehicle data, such as make, model, price, description, CTA link, images, videos generated from them, and optionally studio images generated from them. - Usage and billing data, such as video credits, studio credits, purchased video packages, enabled additional digital features, render jobs, studio image creation jobs, credit usage, Stripe customer ID, Stripe session ID, payment status, and invoice information. - Communication data, such as email address, sending status, and technical delivery data for transactional emails such as purchase confirmations. - Lead data from prospective customers, such as name, email address, phone number, message, associated vehicle, associated dealer, privacy acknowledgment, and time of the inquiry. - Usage and performance data for public share pages, such as page views, CTA clicks, time, referrer, user agent, technical device and browser information, and IP address. - Technical operational data, such as server logs, security events, error messages, session cookies, and authentication data.

We process personal data for the following purposes: - Providing, operating, and securing the website and web app. - Registration, login, authentication, and management of dealer accounts. - Creating and managing vehicle projects. - Uploading, storing, and processing vehicle images. - Optional AI background removal for vehicle images and creation of studio images. - Creating, storing, downloading, and publishing vehicle videos and share pages. - Managing video packages, enabled studio features, credits, render jobs, studio image creation jobs, and credit usage. - Processing one-time payments, invoices, and payment records through Stripe. - Sending transactional emails, particularly purchase confirmations and legally relevant order information. - Receiving, storing, and forwarding lead inquiries to the respective dealer. - Analyzing the performance of public share pages, particularly views and CTA clicks. - Support, error analysis, prevention of misuse and fraud, and technical security. - Meeting legal obligations, particularly retention requirements under commercial and tax law.

Depending on the activity, processing is based on the following legal bases: - Article 6(1)(b) GDPR, where processing is necessary for the performance of a contract or to take steps prior to entering into a contract, for example for dealer accounts, video packages, additional digital features, video creation, studio images, downloads, and invoice processing. - Article 6(1)(a) GDPR, where consent is obtained, for example when submitting a lead inquiry through a form. - Article 6(1)(c) GDPR, where we are subject to legal obligations, such as retention requirements under tax and commercial law. - Article 6(1)(f) GDPR, where we or third parties pursue legitimate interests, for example in secure operation, prevention of misuse, error analysis, improvement of the web app, and performance analysis of share pages. Where processing is based on consent, that consent may be withdrawn at any time with effect for the future.

The web app is operated through technical service providers. Personal data may be processed in infrastructure, database, storage, authentication, and logging systems. In particular, we use the following providers: - Vercel Inc. for hosting, delivery of the web app, edge/serverless functions, and technical logs. - Supabase Inc. for authentication, database, storage, and server-side data processing. - Railway Corporation for operating the video worker and technically creating vehicle videos. - Photoroom SAS for technical background removal from vehicle images during optional studio image creation. - Stripe for payment processing, invoices, payment status, and the customer portal. - Resend for sending transactional emails, particularly purchase confirmations after the purchase of video packages or additional digital services. - Better Stack, Inc. for technical monitoring of the platform's availability and operational status. Where required, we enter into data processing agreements with service providers under Article 28 GDPR. For processing outside the EU or EEA, we ensure appropriate safeguards, particularly adequacy decisions, EU standard contractual clauses, or comparable protection mechanisms.

Dealers can register and log in using an email address and password. Login through Google may also be offered. When using Google login, you are redirected to Google. Google provides us with the data required for login, particularly your email address and, where applicable, additional profile information that you authorize Google to share. Authentication and session management are technically handled through Supabase. Technically necessary cookies or comparable storage mechanisms may be used to maintain login sessions and ensure account security.

OnlyCars sells video packages and, where enabled, additional digital services as one-time purchases. Payments are processed through Stripe. Payment data such as credit card details is processed directly by Stripe; we do not store complete card or bank account details. We receive the information required for contractual and billing purposes from Stripe, such as Stripe customer ID, checkout session ID, payment status, the type of package or add-on purchased, price ID, invoice data, and technical payment events. We use this data to add credits, enable invoicing, trace payments, and meet statutory retention requirements.

We use Resend to send transactional emails, particularly purchase confirmations after the purchase of video packages or additional digital services. This involves processing, in particular, the recipient's email address, subject, message content, sending time, and technical delivery and error data. This processing serves to perform the contract, provide order information, and document legally relevant notices. The legal bases are Article 6(1)(b) GDPR, Article 6(1)(c) GDPR, and Article 6(1)(f) GDPR.

We use Railway for the technical creation of vehicle videos. The video worker operated there processes the vehicle images, vehicle and design data, and technical job data required for each render job. Temporary video files and technical log data may be generated during processing. The completed video is then transferred to the storage we use; temporary render files are removed after the job is completed. This processing serves to perform the contract with the dealer and to operate video creation securely and in a traceable manner. The legal bases are Article 6(1)(b) GDPR and Article 6(1)(f) GDPR.

When dealers use the studio background feature, the selected vehicle image is sent to Photoroom for technical removal of its original background. OnlyCars then places the isolated vehicle into its own studio background on the server. Processing takes place only when the dealer actively starts the feature. It serves to perform the purchased digital service and to operate image processing securely. The legal bases are Article 6(1)(b) GDPR and Article 6(1)(f) GDPR.

We use Better Stack to monitor OnlyCars' availability and technical operational status. Better Stack calls a protected status endpoint at regular intervals. Only status information required for operation is transmitted, particularly availability, aggregated queue and error states, and technical worker heartbeats. Customer, lead, vehicle, image, video, and payment content is not intended for this monitoring. These requests may also involve processing technically necessary connection data such as IP address, time, requested URL, response status, and response time. This processing serves to detect outages and ensure stable and secure platform operation on the basis of Article 6(1)(f) GDPR.

Dealers can upload vehicle data and vehicle images. This data can be used to generate, store, and download videos and make them accessible through public share pages. Depending on the dealer profile, share pages may display information such as company name, logo, website, phone number, contact email, contact person, address, and vehicle data. Dealers are responsible for uploading only images, text, and other content they are entitled to use and that do not contain impermissible personal data of third parties.

When prospective customers send an inquiry through a public share page, we process the data entered in the form, particularly name, email address, phone number, and message. The inquiry is associated with the respective vehicle and dealer, stored, and displayed to the dealer in the dealer area. The privacy acknowledgment in the form is documented together with its time and text. Processing serves to handle and forward the inquiry to the dealer. Depending on the circumstances, the legal bases are Article 6(1)(a) GDPR, Article 6(1)(b) GDPR, and Article 6(1)(f) GDPR.

To analyze the performance of public vehicle pages, we store share page views and clicks on call-to-action buttons. This may involve processing technical data such as time, referrer, user agent, IP address, and browser and device information. These analyses serve to show dealers the effectiveness of their vehicle pages and videos, detect misuse, and ensure the technical functioning of share pages. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in providing traceable performance data and operating the platform securely.

OnlyCars uses technically necessary cookies and comparable storage technologies, particularly for login sessions, authentication, security, and the core functionality of the web app. Without these technologies, essential features such as login, protected dealer areas, or secure payment redirects cannot be provided. Optional analytics cookies are set only after your express consent. Your choice is stored locally in your browser for no more than 180 days. You can change or withdraw it at any time using the cookie icon. The previous “Got it” notice does not constitute consent to Google Analytics. Google Analytics 4: With your consent, we use Google Analytics from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for statistical analysis of general page views. This involves processing page categories, timestamps, browser and device information, and cookie identifiers, among other data. When connecting, Google receives your IP address for technical reasons. According to Google, GA4 does not store individual IP addresses. This does not mean that all processing is anonymous. We do not transmit account names, email addresses, form contents, vehicle IDs, or lead IDs. URL parameters and URL fragments are not sent to Analytics as the page address. Admin, sign-in, payment, lead, and individual vehicle pages are excluded. Google Signals and advertising personalization are not enabled. Google Analytics is not loaded before consent or when consent is declined. When consent is withdrawn, further collection is disabled and accessible Analytics cookies are deleted; this does not retroactively delete data already processed. The legal bases are your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Processing by Google LLC in the United States cannot be ruled out. Information about Google's data processing and transfer mechanisms is available at https://policies.google.com/privacy and https://policies.google.com/privacy/frameworks. Analytics cookies are set for no more than 180 days. In the Analytics property, event data is retained for two months and user data for 14 months; renewed user activity restarts the retention period for user data. Aggregated standard reports are exempt from these periods.

OnlyCars may provide links to external platforms, particularly social media or messaging services such as Instagram, TikTok, YouTube, Facebook, or WhatsApp. These links enable completed videos or share links to be used on the respective platforms. Opening an external link takes you away from OnlyCars. The respective providers are responsible for the processing of personal data on external platforms. OnlyCars does not currently integrate these platforms as tracking pixels or embedded social media plugins.

Technically necessary access data is processed when the website and web app are accessed. This may include IP address, date and time of access, requested URL, referrer, browser type, operating system, status codes, and comparable technical information. Processing serves to deliver the website, analyze errors, defend against attacks, prevent misuse, and ensure system stability. The legal basis is Article 6(1)(f) GDPR.

Personal data may be transferred to the following recipients or categories of recipients: - Technical service providers for hosting, database, storage, authentication, and payment processing. - Email service providers for sending transactional messages. - Dealers, when prospective customers send an inquiry about a vehicle through a share page. - Payment service providers, to the extent necessary to process payments, invoices, and payment records. - Tax advisors, authorities, or other bodies where there is a legal obligation. - Internal administrators and support personnel, to the extent necessary for operation, security, support, or troubleshooting.

Some service providers we use are based or have technical infrastructure outside the European Union or the European Economic Area, particularly in the United States. Where personal data is transferred to third countries, this takes place only on the basis of appropriate safeguards within the meaning of the GDPR, such as an adequacy decision by the European Commission, EU standard contractual clauses, or supplementary protective measures. For service providers such as Vercel, Supabase, Railway, Stripe, Resend, Better Stack, or Google, data may also be processed outside the EU or EEA depending on the specific service and configuration.

We store personal data only for as long as necessary for the respective purposes or as required by statutory retention obligations. - Dealer accounts, profile data, vehicle projects, uploaded images, and generated videos are generally stored for the lifetime of the user account, unless they are deleted earlier or legal obligations require otherwise. - Payment and invoice data is stored in accordance with retention requirements under commercial and tax law. - Lead inquiries are stored for as long as necessary for processing, recordkeeping, customer communication, and the legitimate interests of the dealer or OnlyCars. - Technical logs are generally stored only for as long as necessary for security, error analysis, and operation. Data is deleted when its purpose no longer applies and there are no statutory retention obligations or legitimate reasons for further storage.

Certain data must be provided to use OnlyCars. A dealer account cannot be provided without an email address and authentication data. Vehicle videos or studio images cannot be created without vehicle data and images. Paid video packages or additional digital services cannot be purchased without payment data. A lead inquiry cannot be meaningfully forwarded to a dealer without contact details.

Automated decision-making within the meaning of Article 22 GDPR does not currently take place. OnlyCars may use technical validations, security checks, duplicate checks for lead inquiries, and automated rendering or credit processes; these serve to technically provide the platform and do not make legally significant decisions about data subjects.

Subject to the applicable statutory requirements, data subjects have the following rights: - Right of access under Article 15 GDPR. - Right to rectification under Article 16 GDPR. - Right to erasure under Article 17 GDPR. - Right to restriction of processing under Article 18 GDPR. - Right to data portability under Article 20 GDPR. - Right to object under Article 21 GDPR to processing based on Article 6(1)(e) or (f) GDPR. - Right to withdraw consent with effect for the future. To exercise your rights, you can contact us at support@onlycars.de. We may request proof of your identity to protect your data.

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates data protection law. In particular, you may contact the supervisory authority responsible for your place of residence, your workplace, or the registered office of OnlyCars GmbH.

Please direct inquiries about privacy, data subject rights, or the processing of personal data to support@onlycars.de.

We may update this privacy policy if legal requirements, technical features, or the service providers we use change. The current version is available at https://www.onlycars.de/datenschutz.

OnlyCars uses Google's YouTube API Services for the optional channel connection and direct video uploads. This connection is separate from Google login to OnlyCars. It is established only when you initiate it in your profile and grant the requested permissions at Google. OnlyCars does not receive your Google password.

We request the youtube.readonly (view your YouTube account) and youtube.upload (manage your YouTube videos) permissions. Read access is used to identify your channel and display it in your profile. We store the channel ID, channel name, channel handle and profile image URL where applicable, and the association with your OnlyCars account. We also store granted permissions, connection timestamps, token expiration time, and encrypted access and refresh tokens. The latter allow API requests to be authorized again without requiring another Google login for each upload.

An upload starts only at your express request. OnlyCars sends the selected video, the title you confirmed, the description, and the selected visibility to YouTube. The integration is intended for vehicle videos, not for content specifically directed at children. Technically, the vehicle category and the designation “not made for kids” are sent. We also store upload progress, status, technical errors, timestamps, the video ID returned by YouTube, and the video link. An upload session is stored in encrypted form. Actual availability and visibility on YouTube are additionally subject to YouTube's reviews and restrictions.

This data is used for the channel connection you request, to perform and track the upload, and to resolve errors. Processing takes place to provide the feature you request on the basis of Article 6(1)(b) GDPR; where consent is required, on the basis of Article 6(1)(a) GDPR. We use the hosting and database providers described above for storage and technical transmission. The video and its publication details are sent to Google/YouTube. If published publicly, they are visible to other YouTube users. Google data is not sold, used for personalized advertising, or used to train general-purpose AI models.

Recipients of YouTube API data: Vercel processes channel connections, API requests, and upload requests as the hosting provider for our web app. Supabase, our database provider, stores channel details linked to your OnlyCars account, permissions, encrypted access credentials, and upload and status records. These providers process the data to technically deliver the feature for OnlyCars. Google/YouTube receives the access tokens required for authorized API requests and, when you initiate an upload, the video file and the publication details you confirmed. Other people's access to the video depends on your selected visibility setting and YouTube's rules. The preceding sections also provide information about these providers and possible international transfers.

Protection of YouTube API data: Data transfers between your browser and OnlyCars, and communications with Google/YouTube and Supabase, use HTTPS with transport encryption. Google access and refresh tokens and the YouTube upload session URL are encrypted with AES-256-GCM before storage. The encryption key material is managed on the server and is not sent to your browser. Server-side authentication and account ownership checks restrict access to connections and uploads to the authorized OnlyCars account. These measures specifically protect access credentials; they do not mean that all channel and status data is additionally encrypted at the application level.

OnlyCars' use and sharing of information from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. Further information on processing by Google is available in the Google privacy policy.

The channel connection and its access tokens are stored for the duration of the connection. You can disconnect under Profile → Social Media; this deletes the connection record, including the access tokens stored in it, from OnlyCars. You can also revoke the permission granted to Google in your Google account permissions at any time. Revoking access at Google does not automatically delete data already stored by OnlyCars. You can request deletion of any YouTube-related upload and history data still stored by contacting support@onlycars.de and use this address for privacy questions. The storage purposes and deletion rules stated above apply to other account and project data. Disconnecting does not delete videos already uploaded to YouTube; you manage or delete those directly in YouTube Studio.

October 25, 2026