Privacy Policy

Kupito ("we", "our", "us") is a non-commercial platform committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our platform for posting and viewing listings for the sale of vehicles (kupito.club) ("Platform").

All services are provided free of charge to users. The Platform acts as an intermediary between sellers and buyers without participating in financial transactions or charging commissions.

By using the Platform, you agree to the collection and use of your data as described in this Privacy Policy. If you do not agree with this policy, please do not use the Platform.

This Privacy Policy is an integral part of our Terms and Conditions and applies to all users of the Platform, including visitors, registered users, and users who post listings.

The data controller for your personal data in relation to the Platform is Kupito.club Project, Republic of Moldova.

Contact: support@kupito.club

Platform: kupito.club

Applicable law: Republic of Moldova. If the controller's legal details change, this section will be updated in a timely manner.

For any questions or requests regarding the processing of your personal data, please contact us at the email address mentioned above.

We collect various types of personal data to provide and improve our services:

3.1. Registration and profile data:

• First and last name (for individuals)

• Company name (for legal entities)

• Email address

• Phone number

• Optional additional contact phone number (legal entities; may be shown in listings; not verified via SMS)

• Partner program account data when enabled for a business account (partner status, free promotion balance, and listing progress toward the next free promotion)

• Password (protected with modern cryptographic hashing, never stored in plain text)

• User type (individual / legal entity)

3.2. Listing data:

• Vehicle information (brand, model, year, price, description, photos, and one optional listing video when you add it)

• Location (city)

• Other technical details about the vehicle

3.3. Communication data:

• Messenger contact preferences (Viber, WhatsApp, Telegram)

• Email notification preferences

• Communication history (if applicable)

3.4. Technical data:

• IP address

• Browser type and version

• Operating system

• Access time and activities on the Platform

• Cookies and similar technologies

• A short-lived pseudonymous identifier derived from your IP address and browser user agent when needed to apply rate limits to revealing seller phone numbers from listings without signing in

3.5. Other data:

• Phone verification information (SMS code)

• Email verification information

• Verification status (verified phone/email)

3.6. User preference data:

• Saved search filters (up to 20 filters per user)

• Name and parameters of saved search filters

• Date of creation of saved filters

• Vehicle comparison list (up to 3 vehicles; stored in the database for signed-in users, locally in the browser for guests)

• Tire listing comparison list (up to 3 tire listings; stored in the database for signed-in users, locally in the browser for guests)

We use your personal data for the following purposes:

4.1. Providing services:

• Creating and managing your profile

• Enabling posting and management of listings

• Facilitating communication between sellers and buyers

• Verifying your phone and email

• Providing security and preventing abuse

• Saving and managing your search filters

• Enabling comparison of vehicles (up to 3) and tire listings (up to 3)

4.2. Improving services:

• Analyzing Platform usage

• Developing new features and improving existing ones

• Personalizing your experience

4.3. Communication:

• Sending email notifications (only if you have explicitly enabled them)

• Responding to your questions and requests

• Notifying about important changes to the Platform or our policies

4.4. Legal and security purposes:

• Combating illegal activities

• Disclosing data to competent authorities when required or permitted by law and upon a legally valid request

• Protecting user rights and security

• Combating fraud and abuse

We process your personal data based on the following legal grounds:

5.1. Contract performance:

• Processing data necessary for providing Platform services, including registration, posting listings, and communication between users.

5.2. Consent:

• Processing data for email notifications and marketing activities (only if you have explicitly given consent).

5.3. Legal obligation:

• Processing data necessary for fulfilling legal obligations, including responding to legally valid requests from competent authorities and protecting user rights.

5.4. Legitimate interest:

• Processing data for security and abuse prevention

• Analysis and service improvement

• Protection of Kupito's and its users' rights and interests

Kupito implements reasonable technical and organizational measures to protect your personal data:

6.1. Cryptography and transmission:

• Passwords are protected using modern cryptographic hashing and are never stored in plain text

• Communication with the Platform is protected using HTTPS; data is encrypted during transmission

6.2. Technical measures:

• Secure storage of data on protected servers

• Regular security updates and patches

• Protection against unauthorized access, fraud, and abuse

• Regular database backups to limit data loss

• Limits on SMS verification attempts; temporary blocking may apply after repeated failed attempts

• Rate limits on revealing full VIN and full seller phone numbers from listings using short-lived technical counters that do not store a separate copy of your phone number

• Validation of uploaded file types and content to reduce the risk of malicious files

• HTML content sanitization (including in listing descriptions) to reduce the risk of XSS attacks

• Image metadata validation and reasonable file size limits

6.3. Organizational measures:

• Limited data access to authorized personnel only

• Staff training on data protection and security

• Strict access and authentication policies

• Periodic reviews and monitoring of security practices

• No employee can access your passwords in readable form; no employee will ask for your password

6.4. Security incidents:

• In the event of a personal data breach, we will notify the National Center for Personal Data Protection (CNPDCP) of the Republic of Moldova within 72 hours from the time we become aware of it, in line with Article 33 of Law no. 195/2024. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay.

• We will take reasonable measures to minimize risk and protect your data

Kupito does not sell your personal data to third parties. We may share your data only in the following cases:

7.1. With your consent:

• When you explicitly give consent to share data

7.2. With competent authorities:

• When required or permitted by law and upon a legally valid request

• To prevent illegal activities, within the limits of the law

• To protect user rights and security

7.3. With data processors and third parties:

Kupito uses the following third-party services that may have access to your data:

• Google Analytics: For analyzing Platform usage and improving services. Google Analytics collects anonymous statistical data about visits. For more information, see Google's Privacy Policy: https://policies.google.com/privacy

• Google AI (Gemini): When you are signed in and use the optional "AI analysis" on a vehicle listing, the Platform sends listing information already shown on that page (such as title, description, vehicle attributes, and equipment codes—not seller phone or email) to Google's generative AI to produce an informational analysis. For more information, see Google's Privacy Policy: https://policies.google.com/privacy

• Twilio: For sending SMS messages to verify phone numbers. Twilio only has access to the phone number necessary for sending SMS. For more information, see Twilio's Privacy Policy: https://www.twilio.com/legal/privacy

• EU cloud media services provider: for storing, processing/transcoding, and delivering listing photos and optional listing videos through a content delivery network; the provider is selected based on recognized security and compliance standards (including ISO 27001, SOC 2) and GDPR commitments.

• Hosting providers: For storing and processing data on servers located in the Republic of Moldova

• Third-party exchange rate service: used for daily rates to display approximate prices in the platform default currency; no personal data is sent to that service.

• Platform partners shown on the Platform (for example in the site footer): Kupito may display partner names, logos, and links based on a separate cooperation arrangement. Such display by itself does not mean that your personal data is transferred to that partner. If you click a partner link or use partner services, your further interaction is governed by that partner's own terms and privacy policy.

• Vehicle history report partners (e.g. Infocar.md): When you click "Order report" on a listing page, you are redirected to the partner's site, which compiles the report from various sources. If the listing has a VIN, it may be transmitted to the partner (encrypted) to pre-fill the report request. The partner has its own privacy policy and terms; Kupito does not control the partner's data processing.

All these partners are obligated to protect your data and use it only for the specified purposes in accordance with their privacy policies and data processing agreements.

7.4. In case of business transfer:

• In case of merger, acquisition, or sale of part of the business, data may be transferred as part of the transaction

7.5. Public information:

• Information you publish in listings (such as name, location, and messenger contact preferences) is available to Platform visitors as displayed. Phone numbers in listings may be partially masked until a visitor chooses to reveal the full number; such reveals are rate-limited to reduce abuse

• This balances buyer–seller contact with protection against automated harvesting of phone numbers

We store your personal data only as long as necessary for the purposes specified in this Privacy Policy:

8.1. Active users:

• Data is stored while your profile is active

• You can update or delete your data at any time

8.2. After account closure:

• Upon account deletion request, your personal data (name, email, phone, profile information) is immediately deleted from the database

• Your listings remain on the Platform, but all your personal data and contact information are removed from listings

• Listings are displayed without contact information and user personal data

• Some data may be stored longer if necessary for:

- Fulfilling legal obligations

- Resolving disputes

- Preventing fraud and abuse

8.3. Listings:

• Listings are stored while they are active or until the user deletes them

• After account deletion, listings remain but without contact information

• Closed or deleted listings are stored in archive for up to 1 year for security and legal purposes

8.4. Photos and images:

• Photos from listings are stored with a third-party cloud provider in the European Union and delivered through a content delivery network

• Images are processed and converted to an optimized format for improved performance

• When you enable "hide license plates", we process photos on our servers to detect license plates and overlay a permanent mask; we do not store the detected plate data.

• When a listing is deleted, corresponding images are deleted from the storage provider

• Images are stored while the listing is active or until the user deletes the listing

• Optional listing videos use the same media infrastructure as photos; video may be transcoded; temporary multipart upload fragments may be removed after a short retention period

8.5. Saved search filters:

• Saved filters are stored while your profile is active

• You can delete your saved filters at any time through the "Favorites" page → "Filters" tab

• Upon account deletion, all your saved filters are deleted from the database

8.6. Comparison, favorites, and filters for guests:

• For signed-in users, comparison lists (up to 3 vehicles and up to 3 tire listings) are stored in the database and linked to your account; for guests, the same lists may be kept temporarily in the browser's local storage until you sign in.

• On login or registration, relevant local data may be merged into your server-side account; on logout, comparison data is cleared from the local device but may remain on the server until you change it or delete your account.

• Guests may mark favorites or save a filter locally; after login or registration, those choices are transferred to the server and cleared from the browser's local storage.

8.7. Logs and technical data:

• Logs and technical data are stored for up to 12 months

8.8. Database backups:

• We perform regular database backups for security and data protection purposes

• Backups contain a copy of all data in the database, including personal data

• Backups are stored for up to 30 days, after which they are automatically deleted

• Backups are protected by encryption and stored on secure servers

• In case of a request to delete personal data, backups will be updated during the next backup creation

As a data subject, you have the following rights in accordance with the Personal Data Protection Law of the Republic of Moldova and GDPR:

9.1. Right of access:

• You can request a copy of your personal data that we process

9.2. Right to rectification:

• You can request correction of inaccurate or incomplete data

• You can update your data through your profile

9.3. Right to erasure ("right to be forgotten"):

• You can request deletion of your personal data if there is no legal basis for storing it

9.4. Right to restriction of processing:

• You can request restriction of processing of your data in certain cases

9.5. Right to data portability:

• You can request transfer of your data in a structured, commonly used and machine-readable format

9.6. Right to object:

• You can object to processing of your data based on legitimate interest

9.7. Right to withdraw consent:

• You can withdraw your consent to data processing at any time (for marketing and email notifications)

9.8. Right to lodge a complaint:

• You can lodge a complaint with the National Center for Personal Data Protection (CNPDCP) of the Republic of Moldova if you believe your rights have been violated

9.9. Automated decision-making and profiling:

• You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, where applicable law grants this right.

• You may request human review of any such decision that concerns you on the Platform.

• The optional AI-generated listing analysis is provided to help you assess a vehicle listing and does not, by itself, constitute an automated decision that produces legal or similarly significant effects about you as a person; if you believe a particular processing should be reviewed manually, contact us at support@kupito.club.

To exercise your rights, please contact us at support@kupito.club. We will respond to your request within 30 days.

Kupito uses cookies and similar technologies to improve your experience on the Platform:

10.1. Types of cookies and technologies we use:

• Essential cookies: These cookies are necessary for the Platform to function and cannot be disabled

• Functional cookies: These cookies provide enhanced functionality and personalization

• Analytical cookies: Google Analytics and Google Tag Manager use cookies to analyze Platform usage. These cookies help us understand how users use the Platform

10.2. Local storage (localStorage):

• We use httpOnly cookies for authentication session tokens (access and refresh); Google Sign-In may load the Google Identity Services script on the sign-in page when enabled; Telegram Sign-In may load the Telegram Login (OIDC) script from oauth.telegram.org when enabled; with user consent, a verified phone number may be received from Telegram during sign-in

• We use localStorage for favorites, comparison (within the limits described), and other preferences; for signed-in users, the primary source for this data is the database

• For guests, certain actions (favorites, comparison, saved filter) may be kept temporarily in the browser's local storage and migrated to the server after login or registration

10.3. Session storage (sessionStorage):

• We use sessionStorage for temporary data storage during your session

10.4. Service Worker and caching:

• We use Service Worker to improve performance and offline functionality

• Service Worker caches static resources (CSS, JavaScript, images, fonts) for faster loading

• Service Worker caches certain API responses and pages with a 1-hour lifetime

• Cached data is automatically updated every hour to ensure current information

• Cached data is stored locally on your device and does not contain personal information

• You can clear the cache through your browser settings

• Service Worker allows the platform to work in offline mode with access to cached pages

10.5. Managing cookies and local storage:

• You can manage cookies through your browser settings

• You can clear localStorage through your browser settings

• You can manage your preferences for analytical cookies through the cookie settings page: https://kupito.club/cookie-settings

• Note that disabling certain cookies or clearing localStorage may affect Platform functionality and may require re-login

10.6. Google Analytics and Google Tag Manager:

• Google Analytics uses cookies to collect anonymous statistical data

• Google Tag Manager uses cookies to manage tags and scripts on the website

• Google Analytics uses Consent Mode v2 to respect your consent - analytics is disabled by default and activated only upon explicit consent

• With your consent, Google Analytics may record aggregated events relating to: viewing listings, search and filtering, favorites, comparison, contacting the seller, creating listings, saving filters, login and registration

• All events are sent only when consent is given for analytical cookies

• You can manage your preferences for these services through the cookie settings page

• You can opt out of Google Analytics through Google Analytics Opt-out Browser Add-on: https://tools.google.com/dlpage/gaoptout

Your personal data is processed and stored on servers located in the Republic of Moldova.

Some third-party partners (Google Analytics, Twilio, and our EU-based cloud media services provider) may process data on servers located outside the Republic of Moldova. These partners are obligated to protect your data in accordance with their privacy policies and corresponding data processing agreements.

For international transfers of personal data to recipients outside the Republic of Moldova (including to the United States where applicable), we rely on appropriate safeguards under applicable law, including Standard Contractual Clauses (SCC) approved by the European Commission, together with supplementary technical and organizational measures where necessary.

Google Analytics may process data outside the Republic of Moldova. Google documentation may reference additional frameworks or certifications (such as the EU-U.S. Data Privacy Framework); these do not replace our obligations and the transfer mechanisms applicable in the Republic of Moldova.

Twilio may process data outside the Republic of Moldova where technically necessary to deliver SMS; processing is governed by Twilio documentation and applicable data protection agreements, including transfer mechanisms such as SCC where relevant.

Listing photos and optional listing videos are stored, processed/transcoded, and delivered through a cloud provider in the European Union and a content delivery network; the provider is selected based on recognized security and compliance standards (including ISO 27001, SOC 2) and GDPR commitments.

If in the future we need to transfer your data outside the Republic of Moldova, we will ensure appropriate protection measures in accordance with applicable data protection laws.

All data transfers will be conducted in accordance with applicable data protection laws and with corresponding contractual clauses for data protection.

Kupito reserves the right to modify this Privacy Policy at any time. Modified policies will be published on the Platform with a last updated date.

Continued use of the Platform after publication of modified policies is considered acceptance of the new policies.

It is recommended to regularly check this Privacy Policy for any changes.

For important changes, we will notify you by email or through an announcement on the Platform.

If you have questions, comments, or requests regarding this Privacy Policy or the processing of your personal data, please contact us at:

Email: support@kupito.club

Platform: kupito.club

We will respond to your request as soon as possible, no later than 30 days from the receipt of your request.