Privacy Policy

Apollo Tech s. r. o., Karpatské námestie 10A, 831 06 Bratislava - mestská časť Rača, Slovakia. Company ID (IČO): 51097869. Commercial Register of the Bratislava III Municipal Court, section Sro, insert no. 122557/B.

The operator of the AutoNinja platform is the controller of the personal data described here. Contact: gdpr@autoninja.sk. Updated on 25 October 2026.

We obtain from you account and contact data, company and billing data, listings, photos, messages, support requests, complaints and notices of withdrawal. From your device we obtain technical data about access, IP address, browser, session and security. The payment provider passes on the status, amount and payment identifiers; we do not store the full payment card number or the security code.

If you choose to sign in with Google, we obtain the account identifier, e-mail and profile data made available for signing in. A dealer's listings may come from files or feeds that the dealer has lawfully provided. Data about interactions arises from using and running the service.

For a private seller, other people see only the first name and the initial of the last name (for example Ján N.); a dealer appears under the company name. Stripe issues the invoice for a payment on our behalf, using the name and address you enter at checkout. When you report a listing or a conversation, we process your name, e-mail and the text of the report to handle the notice and tell you the outcome (a DSA obligation).

Listings, photos, the seller's public profile and published contact details are available to visitors and search engines. Do not publish identity documents or data of previous owners. Private messages are not part of the public listing. Other users and search engines may keep copies outside our control.

Contract — Art. 6(1)(b) GDPR: account, publishing and managing listings, communication, orders and related support. Without the necessary data we cannot create an account, publish a listing or fulfil an order. You do not have to provide optional data.

Legal obligation — point (c): accounting, invoicing, consumer rights and mandatory notices. Legitimate interest — point (f): protecting users and the platform against fraud and abuse, security, diagnosing errors and defending legal claims. You can object to processing based on legitimate interest.

Consent — point (a): optional analysis of usage, including AutoNinja's own telemetry, Google Analytics 4 and Microsoft Clarity, and optional advertising uses. Refusing does not block the basic services. You can withdraw consent at any time at /cookies; the lawfulness of earlier processing is not affected.

Subscribing to the newsletter is voluntary and is confirmed by e-mail. For this purpose we process the e-mail address, language, market and a record of the request and of the confirmation of consent. Resend manages the subscriber list and sending of messages. Upstash keeps an unconfirmed request for at most 24 hours, and temporary counters to protect against abuse.

You can unsubscribe using the link in every newsletter. After you unsubscribe, we do not send newsletters; the supplier may keep the unsubscribed status to respect your choice. We keep the subscription data and the record of consent for as long as they are needed for the subscription and for respecting your preferences. You can ask for deletion or details at gdpr@autoninja.sk.

With analytics consent, AutoNinja keeps usage events in its own database, and Google Analytics 4 measures visits and actions. Microsoft Clarity creates interaction maps and session recordings: pages visited, clicks, scrolling, data about the device and interactions. Pseudonymous browser identifiers and the internal account identifier may be used to link sessions; this is not anonymous data. We deliberately do not send your name or e-mail as an analytics identifier.

Clarity may also process data under Microsoft's statement: https://privacy.microsoft.com/privacystatement. We switch optional analytics off on the sign-in, account, dealer, administration, payment, withdrawal and contractual document pages. Marketing consent is separate from analytics consent. Google information: https://policies.google.com/privacy. The list of technologies and their duration is at /cookies.

Technical validations, anti-spam protection and risk signals may prevent publication or trigger moderation. For an objection to a restriction and for human review, contact support@autoninja.sk. The ranking of listings and the effect of paid promotion are described in the terms and conditions.

We keep account data and content for as long as they are needed for the account and the services ordered. When an account is cancelled, documents and evidence needed for a legal obligation, a complaint or a dispute are assessed separately; cancellation does not mean immediate deletion of all copies. The expiry of a listing is not the same as its deletion from the account.

We delete messages 12 months after the last message in a conversation. An expired, sold or rejected listing and its photos are deleted 12 months after it ended. An account nobody has signed in to for 3 years is deleted; we send a warning e-mail 30 days before, and signing in is enough to keep it. Payments and invoices are not affected; we keep them as accounting law requires.

Accounting documents are kept for the 10 years following the year they relate to, under the Slovak Accounting Act. We keep support requests, reports, withdrawals and contractual evidence until they are handled and, where needed to defend rights, until the relevant legal period expires or the proceedings end. The existence of an accounting document does not in itself justify keeping other account data.

We keep reports of illegal content, moderation decisions and their reasons after the listing or account is deleted, usually for 1 year after the case is closed and, if there is a dispute, until it ends. A report keeps a copy of the reported listing. We keep the log of administrator actions for 3 years. We need this to show that we followed the DSA and to defend legal claims (Article 17(3)(e) GDPR).

The cleanup rule for our own telemetry is 180 days for analytics events and 30 days for web performance measurements. Security logs and backups have a separate cycle; evidence of an incident may be kept separately until the investigation or dispute ends. You can ask about the period applying to specific data at gdpr@autoninja.sk.

The lifetime of a cookie is not the retention period of reports. Clarity states 30 days for regular recordings and at most 9 months for aggregated data and saved favourite recordings. The retention of individual data in Google Analytics depends on the property setting; aggregate reports have different rules. You can ask for deletion of identifiable data within the limits of the GDPR.

If you use the available autofill by VIN, we send the VIN you enter to the supplier Vincario to identify technical data. The feature is optional; you can fill in the listing manually.

When a map is displayed, the browser loads map images from OpenStreetMap and may pass it technical network data, including the IP address and the usual request data.

Depending on the feature used, we use Supabase (accounts, database and storage), Vercel (hosting), Cloudflare (images and abuse protection), Algolia (searching public listings), Upstash (request limiting), Resend (e-mails) and Stripe (payments). Google is used for the sign-in you choose and, with consent, Analytics; we use Microsoft Clarity with analytics consent. Not every supplier receives all categories of data.

Technical error reports (page address, browser, error description) are processed by Better Stack (through the Sentry library); we deliberately do not attach your name, e-mail or IP address to them. E-mails sent to our addresses are received and forwarded by the Forward Email service. If handling your request or a security problem requires it, an authorised administrator may sign in to your account; we log every such sign-in.

Data may be available to authorised staff, accounting and legal advisers or public authorities where necessary and where there is a legal basis. For some of their own processing operations, Stripe, Google and Microsoft may also act as independent controllers; their policies describe those operations.

The main database is in the EU. That does not mean that all of the suppliers' operations take place exclusively in the EEA. Providers that also process data outside the EEA, and the transfer mechanism, are listed below. DPF is the EU-US Data Privacy Framework (a Commission adequacy decision); SCC are the standard contractual clauses in the processor contract. You can ask for the recipients, countries and a copy of the safeguards applied at gdpr@autoninja.sk.

• Vercel (hosting) — USA — DPF
• Cloudflare (images, abuse protection) — USA — DPF
• Upstash (request limiting) — USA — DPF
• Resend (e-mails) — USA — DPF
• Stripe (payments) — USA — DPF
• Google (sign-in, Analytics with consent) — USA — DPF
• Microsoft Clarity (session recordings with consent) — USA — DPF
• Supabase (accounts and database; the database is in the EU) — USA — SCC
• Algolia (search) — France and USA — SCC
• Better Stack (error reports) — USA — SCC
• Forward Email (e-mail forwarding) — USA — SCC
• OpenStreetMap (maps) — United Kingdom — adequacy decision

You have the right of access, rectification, erasure, restriction and, under the legal conditions, data portability. You can withdraw consent and object to legitimate interest processing; you can object to direct marketing at any time.

Write to gdpr@autoninja.sk. We may reasonably verify your identity; do not send us a copy of a document unless we ask. We will usually reply within one month at the latest. If the law allows an extension because of complexity, we will inform you within the first month. Requests are in principle free of charge.

You can lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, https://dataprotection.gov.sk, or with the competent authority of the state of your habitual residence, place of work or the alleged infringement. In Romania this is ANSPDCP: https://www.dataprotection.ro. The right to go to court remains unaffected.