Privacy Policy
Last Updated:
Introduction
Carlio is committed to protecting the personal information entrusted to it. This policy explains what is collected across the website, the dashboard, and the customer, partner and task portals, and how that information is used, shared and protected.
Carlio is operated by PineBase, a company based in the Republic of Korea. PineBase is responsible for the personal information described in this policy, and references to Carlio below mean PineBase.
For account, billing and website information, Carlio decides how that information is used. For the records a dealership enters about its own clients, partners and contractors, the dealership decides how they are used, and Carlio processes them on the dealership's instructions.
Use of Carlio constitutes acceptance of the practices described in this policy. Anyone who does not accept them should not use the Service.
Information Collected
Account Information
When an account is created, Carlio collects:
- name and email address;
- a password, stored only as a one-way hash;
- a profile image, where one is added;
- basic profile details from Google, where Google sign-in is used.
Organization and Business Data
To run a dealership's operations, Carlio stores:
- business name, country, currency and logo;
- invoice and watermark settings;
- the members of the organization and their roles;
- vehicles, shipments, deals, tasks, invoices, payments and exchange rates;
- the dealership's customers and partners, with their contact details.
File Storage Data
- uploaded documents, photographs and videos;
- file metadata, such as names, types, sizes and upload dates.
Portal and Agreement Data
- the links a dealership creates for customers, partners and tasks, with their expiry dates;
- partner portal passwords, stored only as a one-way hash;
- records of subscription agreement acceptance: who accepted, when, from which network address, and which version.
Contact and Notification Data
- the name, email address and message submitted through the contact form;
- notification preferences and browser push subscriptions;
- a linked Telegram chat, where one is added.
Usage Data and Analytics
- pages viewed, features used and session data;
- IP address, browser and device type;
- server logs, including requests and response codes;
- signals used to detect automated abuse.
How Information Is Used
- to provide, maintain and improve the Service;
- to create and manage accounts, including sign-in and email verification;
- to process subscriptions and payments through Polar;
- to send account emails and the notifications each user has enabled;
- to answer contact and support requests;
- to protect the Service against fraud and abuse, including through reCAPTCHA;
- to understand how the Service is used, through product analytics;
- to meet legal, tax and accounting obligations.
Third-Party Services
Carlio uses the following providers to run the Service. Each receives only the information needed for its purpose.
- Vercel: Hosting of the website and dashboard
- Railway: Hosting of the application server, background processing and cache
- Cloudflare R2: Storage of uploaded files, in private buckets by default
- Resend: Delivery of account and notification emails
- Polar: Checkout, subscription management, billing and tax handling
- Google: Sign-in with Google, and reCAPTCHA v3 abuse protection
- PostHog: Product analytics
- Telegram: Delivery of notifications, only where a user links a Telegram chat
- ExchangeRate-API: Daily currency exchange rates; no personal information is sent
Card numbers and other payment credentials are entered with Polar and are never received or stored by Carlio.
Commitment to Privacy
- Personal information is never sold or rented.
- Dealership records, including vehicle costs, margins, customer lists and payments, are not used for advertising and are not shared with anyone the dealership has not chosen.
- No dealership data is used to train machine-learning models.
- Information is disclosed only to the providers listed above, where the law requires it, or as part of a merger or acquisition subject to the same protections.
Privacy Rights
Under the General Data Protection Regulation and similar laws, individuals have the following rights over their personal information:
- Right to Access: obtain a copy of the information held.
- Right to Rectification: correct inaccurate or incomplete information.
- Right to Erasure: have information deleted.
- Right to Data Portability: receive information in a portable format.
- Right to Restrict Processing: limit how information is processed.
- Right to Object: object to processing, including for analytics.
- Right to Withdraw Consent: where processing relies on consent.
Requests may be sent to support@carlio.app and receive a response within 7 days. A request about a dealership's records concerning its own clients is passed to that dealership, which decides on it. Notification channels can be turned off in account settings at any time.
Data Security
- information is encrypted in transit with TLS;
- passwords are stored only as one-way hashes;
- private files sit in non-public storage and are served through short-lived signed links;
- access inside an organization follows the roles its owner assigns.
The full set of practices is described on the Security page. No method of transmission or storage is completely secure, and absolute security cannot be guaranteed.
Data Retention
- Active Accounts: information is kept while the account or organization is active.
- Closed Accounts: most information is deleted within 30 days of closure.
- Legal Requirements: billing and agreement records are kept for as long as tax, accounting and contract law requires.
- Server Logs: kept for security and debugging, typically for 90 days.
International Data Transfers
Carlio's providers operate in several countries, including the United States. Information may therefore be processed outside the country in which it was collected, under safeguards such as the European Commission's Standard Contractual Clauses.
Children's Privacy
The Service is not intended for anyone under the age of 18, and information about children is not knowingly collected. Information found to concern a child is deleted on request to support@carlio.app.
Changes to This Privacy Policy
This policy may be updated to reflect changes in practice or law. A material change is communicated by email or through a prominent notice on the website, and the “Last Updated” date at the top of this page records when it was last revised.
Contact Us
Questions about this policy or Carlio's data practices may be sent to the address below or through the contact page.
Related: Terms of Service, Security