VEHICLE LEGACY · PRIVATE MOTORING ARCHIVE
Privacy notice
1. Data controller
Vehicle Legacy Tran, Norwegian organisation number 938639655, Rogalandgata 162B, 5522 Haugesund, Norway, is the controller of personal data in Vehicle Legacy. Contact: luxuryvehiclelegacy@outlook.com.
2. Data, purposes and legal bases
| Data | Purpose and basis |
|---|---|
| Email, user ID, sign-in account and access | Create your account and provide correct access. Necessary for the contract, GDPR Article 6(1)(b). |
| Package, price, period, order and payment status, receipts and recorded acceptance | Deliver purchases and handle refunds, (b); comply with accounting and documentation duties, (c). |
| Vehicle details, photos, documents, filenames and descriptions you provide | Store, display and export vehicle history, (b). Unnecessary information about others should be redacted or removed. |
| Sharing choices and technical information about sharing-link use | Provide sharing you request, (b); secure the service and prevent abuse, (f). |
| Support messages and attachments you send us | Help with the contract, (b); follow up closed cases when needed, legitimate interests, (f). |
| Technical fault and security logs, including times, events and, where needed, IP address/device details | Troubleshoot, detect unauthorised access and protect the service, (f). |
Our legitimate interests are secure operation, abuse prevention and necessary follow-up. We minimise data and retention and weigh our interests against your privacy. You may object to processing based on legitimate interests. Without necessary account and payment information, we cannot provide paid access.
We do not sell personal data or use vehicle archives for targeted advertising or training AI models. The service has no feature sending vehicle archives to an AI model. We do not make decisions with legal or similarly significant effects solely through automated profiling. The payment provider may carry out its own security and fraud checks.
3. Providers and recipients
- Supabase: authentication, database and private files; processor for this data.
- Stripe: payments and related checks. Stripe is a processor for some activities on our behalf and an independent controller for purposes including its own legal obligations and fraud prevention.
- Resend: sign-in, order and service emails; processor for message content and recipient data.
- Vercel: website hosting and technical delivery; processor for customer data handled on our behalf, with its own purposes for some operational and contact data.
- Microsoft Outlook.com: the support mailbox luxuryvehiclelegacy@outlook.com. Microsoft processes emails and technical data under its terms and privacy statement.
You decide whether to share vehicle history with a buyer. Private archives are not made available to other customers. Necessary data may also be disclosed to authorities where required by law, or to handle a specific legal claim. Providers may use subprocessors as described in the documents below.
4. Locations and international transfers
The primary Supabase database, authentication service and file storage are in Ireland (eu-west-1). This does not mean all processing takes place in Ireland. Supabase describes limited support and operational processing including in Singapore and the United States, and global content delivery; standard contractual clauses are included in its data processing agreement.
Resend stores email content and delivery logs in the United States and uses standard contractual clauses for EEA transfers. Vercel delivers the website through global infrastructure and describes standard contractual clauses in its agreement. Stripe describes processing including in the United States and India, with adequacy decisions or standard contractual clauses where required. Microsoft describes processing in Europe, the United States and other operational countries, using adequacy decisions and standard contractual clauses.
The documents below describe recipients, transfer mechanisms and safeguards. Contact us for information or a copy of relevant safeguards.
5. Retention and deletion
The periods below apply to operations when sales open. Sales are currently closed and automatic deletion is not enabled. It will be enabled only after backup, restoration and deletion checks are ready. You may already contact us for access or erasure; these requests are handled separately.
| Data | Retention |
|---|---|
| Vehicle archives and uploaded files | The paid period, followed by 14 days for export or renewal. Then deleted from the active service. |
| Sign-in account | 30 days after the last archive is deleted, provided no other active package or unresolved archive entitlement remains. |
| Closed support cases | 12 months from case closure. |
| Our fault and security logs | No more than 90 days from the event being recorded. |
| Our own backups | No more than 30 days from creation. Deleted information leaves our own backups no later than 30 days after deletion from the active service. |
| Accounting records and necessary purchase information | Normally 5 years after the end of the financial year. Documents you upload to your archive do not become our accounting records merely because you upload them. |
A specific legal claim or statutory retention duty may require longer retention of relevant data. We then restrict access and use, record the reason and delete the data when it is no longer needed. This does not give us a general right to retain the entire archive.
Providers’ technical copies have separate periods. Resend states 30 days for emails and logs on standard plans and 7 days for backups; after closure of our Resend account, remaining customer data may be retained for up to 90 days. Microsoft states that deleted Outlook.com messages may remain in its system for up to 30 days after Deleted Items is emptied, subject to legal exceptions. Supabase backup retention depends on the plan; Vercel and Stripe have their own operational and statutory periods. The 30-day limit for our own copies is not a guarantee covering every provider copy.
Backups are for recovery, not an accessible customer alternative after deletion. Previous deletions must be reapplied before restored data is put back into use. Revoking a sharing link does not remove copies already downloaded by its recipient.
6. Security and necessary browser storage
We use encrypted connections, private document storage and access rules to separate customers’ archives. Administrative access is restricted. No online service can guarantee absolute security. Passwords, one-time codes and complete documents must not be stored in our security logs.
Sign-in uses necessary local browser storage to retain and refresh the session. The website has no enabled marketing pixels or analytics tools. Stripe’s payment page provides its own cookie information. Any later use of non-essential tracking will be explained and require consent where legally required.
7. Your rights
You may request access, correction, erasure, restriction and data portability, and object to processing based on legitimate interests, subject to statutory limits. Contact luxuryvehiclelegacy@outlook.com. We may request necessary identity verification, but you should not send passwords or one-time codes. We normally respond within one month and notify you of any lawful extension.
You can download your vehicle history within the deadline in the purchase terms. You may complain to the Norwegian Data Protection Authority (Datatilsynet). Acknowledging this notice does not limit your rights.
8. Changes and provider documents
Changes are dated and published here. Material changes affecting you are notified appropriately. Norway is the first sales market; selecting English does not itself open sales to other countries.