Privacy policy
This translation is provided for information only. The French version prevails.
This policy explains which personal data VendreMonAuto processes, why, with whom it is shared and what your rights are. It is based on the Swiss Federal Act on Data Protection (FADP) and, for visitors from the European Union, on the GDPR.
Controller
[À compléter : name or company], [À compléter : address].
For any question about your data: [À compléter : contact email].
Data collected
| Source | Data | Purpose |
|---|---|---|
| Account creation (email) | Email, password (stored encrypted), display name, canton, seller type | Manage your account and identify you |
| Sign-in with Google | Email, name and profile picture provided by Google, Google identifier | Sign you in without a password |
| Profile (optional) | Phone; for dealers: company name, logo, tagline, website, address, opening hours, UID number | Let buyers contact you; present your business; verify professional sellers |
| Listings | Vehicle details, price, town and postcode, description, photos | Publish your listings. Photos are re-encoded in your browser before upload, which removes their metadata (including GPS location). |
| Vehicle identification (optional) | Identifier entered (type approval number; licence plate or registration number if the service is offered), date of the search. Results contain only technical data about the model, never data about the keeper. A licence plate or registration number is never stored in clear text (only an encrypted fingerprint used for caching). | Pre-fill the listing form; limit the number of searches per member |
| Dealer page (optional) | Information published by the dealer: company name, logo, cover photo, description, public phone and email, WhatsApp, address, opening hours, social networks, posts (photos and captions), services and prices | Present the business to the public. The address is geolocated via swisstopo to display the map. |
| Auctions | Bids (amount, date and time), automatic bidding maximum, pseudonym assigned for the auction (“Bidder 3”), outcome | Run auctions, show the bid history under pseudonyms, put the seller and the winner in touch, notify you by email |
| Payments (paid options) | Name, email, billing address, payment method (the full card number is processed by Stripe and never sent to us), purchases, amounts, subscription status | Charge featured listings and the Pro subscription, issue invoices, keep accounts |
| Messaging | Messages exchanged, sending and reading dates | Allow buyers and sellers to talk |
| Favourites and alerts | Saved listings, saved search criteria | Find your listings again; notify you of new listings by email |
| Reports | Reason, comment, reporting member | Moderate fraudulent or inappropriate listings |
| Anti-spam | Technical browser data analysed by Cloudflare Turnstile at sign-up and when sending messages | Block bots and spam |
| Audience measurement | Pages viewed, country, device and browser type, referring site. Vercel Web Analytics uses no cookies and does not store your IP address. Vercel Speed Insights also measures page loading speed, without cookies. | Understand site traffic in aggregate |
| Error monitoring | Technical description of the error, page concerned, browser and operating system | Detect and fix failures (Sentry) |
| Server logs | IP address, date and time, page requested, browser | Security and operation of the site |
What other members can see
- Your listings, display name, canton, seller type and, for dealers, your business profile are public.
- Your phone number is shown only to a signed-in member who clicks “Show number”. To prevent bulk harvesting, we record which member displayed which seller's number (30 sellers per day at most).
- Your messages are visible only to the participants of the conversation.
- Your email address is never displayed.
Recipients and processors
Your data is neither sold nor rented. It is processed by the following providers, solely to run the site:
- Supabase Inc.: database, accounts and photo storage (servers in Ireland).
- Vercel Inc. (United States): site hosting and audience measurement.
- Cloudflare Inc. (United States): Turnstile anti-spam protection.
- Resend (United States): sending notification and alert emails.
- Stripe Payments Europe Ltd (Ireland) and Stripe Inc. (United States): payment processing, invoices and subscription management.
- Functional Software Inc., Sentry (United States): technical error monitoring.
- Google (Ireland, United States): sign-in with a Google account, if you choose it.
- Federal Office of Topography (swisstopo): geolocation of a dealer page's address. Only this address is sent.
- OpenStreetMap Foundation (United Kingdom): map on a dealer page, loaded only if you click “Show map”. Your IP address is then sent to it; the United Kingdom offers a level of protection recognised as adequate by Switzerland.
- Swiss Federal Roads Office (FEDRO): open type approval data queried when you search by type approval number. Only the type approval number is sent.
Transfers outside Switzerland
Some providers are based in the United States or process data there. These transfers rely on the providers' certification under the Swiss-U.S. Data Privacy Framework, recognised by the Federal Council, or otherwise on the standard contractual clauses recognised by the Federal Data Protection and Information Commissioner. Database data (accounts, listings, messages) is hosted in the European Union, whose level of protection Switzerland recognises as adequate.
Cookies
VendreMonAuto uses only strictly necessary cookies: the Supabase session cookies (sb-…-auth-token), set when you sign in and kept until you sign out or for 400 days at most, to keep you signed in. No advertising or audience measurement cookies are used, which is why no consent banner is shown.
Retention periods
- Account and profile: until the account is deleted.
- Listings and photos: until you delete them or the account is deleted.
- Messages: as long as both participants' accounts exist; they are deleted with the listing concerned.
- Favourites and alerts: until you remove them.
- Reports: until the reported listing is deleted.
- Log of displayed numbers: 30 days.
- Bids and auction results: as long as the listing exists.
- Purchases, invoices and payment data: 10 years (legal retention period for accounting records).
- Vehicle search log: 30 days. Cached results: 90 days at most (7 days for a licence plate).
- Server logs and error reports: 30 to 90 days depending on the provider.
Your rights
You may request access to your data, its rectification, erasure or delivery in a common format, or object to a processing, by writing to [À compléter : contact email]. You can edit your profile and delete your listings directly from your account, and turn off email notifications in your profile.
If you believe your rights are not respected, you may contact the Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch.
Last updated: 27 September 2026