Privacy policy

1. What this policy covers

This policy describes personal data for which Oleks Tech OÜ is the controller — meaning we decide why and how it is processed. That is: the people who run a dealership using miraride, the people who write to us, and the visitors to this website.

It does not describe what a dealership does with its own customers' data inside miraride. We do not decide that; the dealership does. See the next section.

2. Two roles, kept separate

We are the controller for your dealership's account, your billing records, and your correspondence with us. We decide why we hold those and we answer for them.

We are a processor for everything you store about your own customers — their names, contact details, driving licence details, rental agreements, and documents. There you are the controller, we act only on your instructions, and the data processing agreement sets out the terms in the form Article 28 of the GDPR requires.

If you are a car buyer or renter who dealt with a dealership that uses miraride, the dealership is your point of contact. Write to us anyway if that is easier — we will tell you who the controller is and pass your request to them rather than leave it unanswered.

3. What we collect

As controller, we hold:

• Account data: name, email address, the language you work in, your role in the dealership, and a cryptographic hash of your password — never the password itself.
• Dealership data: business name, legal identity, address, contact details, and the domain you connect.
• Billing data: the invoices we issue you, what they were for, and whether they were paid.
• Correspondence: the emails you send us and our replies, including any security or data protection request.
• Technical data: server logs holding an IP address, a request identifier, a timestamp, and a user agent, kept for security and fault diagnosis.
• Demo data: the business and personal names entered for the demonstration; separate security and technical request data are described above.
• Workspace discovery: the email address you submit is used only to look up eligible real dealerships and, when there is a match, send a one-hour read-only link. We store only a digest of that link, not the link itself; unknown addresses are not retained.
• Security and signup data: MFA status and recovery-code digests, server-owned acceptance timestamps, signup offer state, and Cloudflare Turnstile results used to protect public forms.
• Content notices: the reported on-platform URL, explanation, optional legal basis, identity and contact details where supplied, receipt, human review, decision, reasons, notifications, and redress record.

4. Why we process it, and on what legal basis

Every purpose below is tied to a lawful basis under Article 6 of the GDPR.

• To provide accounts and service — Article 6(1)(b) for a contracting individual; Article 6(1)(f), our legitimate interest in administering the business relationship, for representatives and team members of a business customer.
• To invoice you and keep accounting records — legal obligation under Estonian accounting and tax law (Article 6(1)(c)).
• To keep the service secure, investigate abuse, and diagnose faults — our legitimate interest in a service that stays available and is not attacked (Article 6(1)(f)).
• To answer your messages and tell you about changes that affect your use of the service — performance of the contract, and our legitimate interest in communicating with business customers (Articles 6(1)(b) and 6(1)(f)).
• To create and clean up demonstration dealerships — our legitimate interest in letting a prospective customer evaluate the product without an account (Article 6(1)(f)).
• To receive, assess, decide, and communicate illegal-content notices — compliance with our Digital Services Act duties (Article 6(1)(c)).

5. Cookies and this website

Ordinary browsing sets no cookies unless you explicitly choose a language. That choice sets one functional, host-only language cookie for up to one year; it does not follow you to another dealership address. Starting signup, requesting a workspace link, or submitting an illegal-content notice sets a strictly necessary CSRF cookie; protected public forms also load Cloudflare Turnstile to prevent automated abuse. We run no analytics, advertising tags, tracking pixels, or session recording, so there is no optional tracking consent banner.

Inside the product, two cookies are set once you sign in: an HTTP-only session cookie and a readable cross-site request forgery token that the client must return with mutations. Both are strictly necessary, both are marked secure outside local development, both use SameSite=Lax, and neither has a cookie domain configured — so a session issued for one dealership's address is not readable at another's.

Local storage keeps your requested theme, explicitly remembered workspace address, favourites and comparisons to supply those functions; it contains no discovery or signup tokens and is not used for marketing or measurement. You can remove it through browser settings. A validated coarse country hint may suggest an initial language and setup country; you can change them. It does not determine pricing or substitute for the dealership country you save.

If we ever add analytics, we will say so here before it is switched on, and we will choose an arrangement that does not require reading or writing anything on your device — or we will ask for consent.

6. Who else sees it

We do not sell personal data, we do not share it with advertising networks, and we do not use it to profile you.

We use a small number of sub-processors to run the service — hosting, storage, and email. Each one is named on our sub-processor page along with what it is used for, where it is, and the basis for any transfer.

Optional AI actions send submitted material and the context needed for vehicle extraction, translation or blank document-template assistance, plus a pseudonymous safety identifier, to OpenAI. Requests use store=false, which does not mean zero retention. API input is not used for training by default; standard abuse logs may be held up to thirty days, with longer retention where required by law or reasonably necessary to protect OpenAI’s services or third parties from harm. Do not submit unnecessary personal or confidential material.

Address suggestions use our server to send the typed query, language, country filters, session token and selected place identifier to Google Maps Platform. We do not forward your browser IP address to Google for this lookup. Google processes the server request under its own privacy terms as an independent controller. Manual entry is available.

We disclose personal data to a public authority only where we are legally required to, and we will tell you when we are permitted to tell you.

7. Transfers outside the EEA

Our primary application, database and background processing are hosted in Germany. This is not a promise of exclusively EU processing: global edge delivery, email and optional providers may process data outside the EEA as described on the provider page.

Some providers are established in or can process from the United States. Where a transfer of personal data outside the European Economic Area occurs, it relies on the European Commission's Standard Contractual Clauses together with the supplementary measures described in our security documentation, and on an adequacy decision where one applies. The provider page states the mechanism and role for each one.

8. How long we keep it

We do not keep personal data longer than the purpose requires.

• Closure evidence: three years after deletion or cancelled closure. If renewal cancellation remains unresolved, we retain the minimum subscription evidence needed to resolve it. Deletion-replay instructions contain restricted identifiers and expire after the ninety-day replay horizon; storage failures are retried.
• Operational dealership data remains while the account is maintained, including during billing suspension. An owner can request closure; active tenant data is then erased after the applicable thirty-day retrieval period unless a specific duty requires retention. Cancelling recurring billing alone does not close the account. Retention needs are reviewed for inactive accounts.
• Completed or expired signup requests and closed invitations: thirty days. Used or expired password-reset and session-handoff tokens: twenty-four hours.
• Immutable legal acceptance evidence: three years after termination. It contains the accepted versions, bundle hash, locale, time, actor and encrypted organization identity snapshot, but no IP address.
• Our own accounting and tax records: seven years from the end of the applicable financial year or statutory starting point. This Estonian provider duty is not a retention rule for every dealership’s own issued records.
• Correspondence: three years from the last message in the thread.
• Illegal-content notices and decision records: while the notice is being handled and for three years after the final decision, so we can demonstrate compliance and address redress or legal claims.
• Application and security logs: no more than ninety days. Scrubbed Sentry error events: no more than thirty days.
• Demonstration dealerships and sessions: deleted automatically when the demonstration period expires and always within twenty-four hours.
• Encrypted database backups: four full weekly recovery sets and their associated WAL. Old sets expire after verified replacement backups; failures require operator attention. They are used for recovery, not ordinary access, and restored erasures are replayed. This is a recovery-set schedule, not a guaranteed thirty-day deletion ceiling.

9. How we protect it

We use authenticated field encryption for designated contact, identity and confidential fields; not every field or file uses that field-encryption scheme. Access controls, tenant scoping, TLS, private file storage and scrubbed diagnostics provide further protection. Technical logs can include security identifiers such as IP addresses; application logging must exclude contact details, credentials and document payloads.

Our security documentation describes the technical and organisational controls used to protect account and customer data.

10. Your rights

Under the GDPR you may ask us to give you a copy of your personal data, correct it, erase it, restrict how we use it, or provide it in a portable format. You may object to processing we base on our legitimate interests, and where we ever rely on consent you may withdraw it at any time without affecting what came before.

Contact us using the address below. We respond without undue delay and normally within one month. Where legally permitted for complexity or number of requests, we may extend by up to two further months and explain within the first month. Proportionate identity verification may be needed. Requests are normally free; statutory exceptions for manifestly unfounded or excessive requests and lawful retention apply. If we cannot act on your request, we explain the reasons and your right to complain to a supervisory authority and seek a judicial remedy.

If you think we have handled your data badly, please tell us first — but you have the right to go straight to a supervisory authority. Ours is the Estonian Data Protection Inspectorate, and you may also complain to the authority in the country where you live or work.

11. Automated decisions and profiling

We make no decisions about you by automated means that produce legal effects or similarly significantly affect you, and we do not profile you. The software computes rental prices and settlement figures from rules the dealership configured; that is arithmetic on a contract, not a decision about a person.

Optional AI features are user-initiated suggestions whose results remain unpublished until reviewed and accepted by a person. They cannot issue documents, publish listings, save output automatically, or decide a person's rights or access.

12. Children

miraride accounts are intended for professional users. If you believe data about a child was submitted improperly, contact us. We assess the request in our relevant controller or processor role, including any applicable retention duty.

13. Changes to this policy

When this policy changes, the version and date at the top of the page change with it. If a change materially affects how we handle your personal data, we will email you before it takes effect. Previous versions are available on request.

14. Dealer-selected marketplaces

When a dealer connects OLX or another supported channel and reviews an outgoing operation, listing material and designated public contact details are transmitted to that channel. The marketplace’s own privacy terms govern its independent processing. Customer records, private notes and payment credentials are not intended listing data. Dealers must choose lawful public contacts and authorised images.