Privacy policy

Introduction

Welcome to AutoSuivi (auto-suivi.fr). Protecting your personal data is a priority. This privacy policy describes how we collect, use, protect and share your personal information when you use our vehicle-management platform.

Legal bases for processing

In accordance with Article 6 GDPR, your data are processed on the following grounds:

• Performance of the contract: account creation, vehicle management, services, documents, Premium subscription
• Consent: registration (Terms of Sale, terms of use and privacy policy), Google/Apple sign-in, in-browser geolocation, newsletter where applicable
• Legitimate interest: service security, fraud prevention, service-related reminder emails (can be turned off in the profile)
• Legal obligation: anonymised retention of payment logs (5 years)

Data we collect

1. Registration information

• First name and surname
• Email address
• Telephone number (optional)
• Password (hashed — never stored in plain text)
• Profile photo (optional)
• OAuth identifiers (Google, Apple) if you use those sign-in methods
• Reminder-email preference (on by default, editable in the profile)

2. Vehicle data

• Technical details (make, model, registration, mileage, powertrain, purchase date)
• Service history and reported faults
• Invoices, photos and related documents (insurance, inspection, driving licence, etc.)
• Fuel-consumption data (fill-ups, litres, stations)
• Costs and expenses linked to vehicles
• Details of garages saved by the user (third-party data you enter)

3. Payment data

Payments are processed securely by Stripe. We never store your full bank details. Only a Stripe customer identifier and transaction logs (amount, status, date) are kept for subscription management.

4. Technical data

• IP address (server and security logs)
• Browser and device type
• Sign-in timestamps
• Session, CSRF and “Remember me” cookies (if enabled)
• One-off GPS coordinates if you search for fuel stations or charge points (not stored on our servers, sent only for the query)
• Push-notification token (mobile app, if enabled)

How we use data

We use your personal data to:

• Provide the service: managing your vehicles, consumption calculations, service alerts
• Personalise the experience: recommendations based on your vehicles and habits
• Manage subscriptions: billing, automatic renewal, Premium/Freemium management
• Security: fraud detection, protection against unauthorised access
• Improve the service: anonymised statistical analysis
• Customer support: answering your questions and resolving issues

Data protection

We implement robust security measures:

• Encryption: All communications use HTTPS (SSL/TLS)
• Passwords: Hashed with bcrypt (advanced hashing algorithm)
• Secure sessions: Protection against session theft and hijacking
• Rate limiting: Protection against brute-force attacks
• Subscription integrity: SHA256 hash to detect tampering
• Restricted access: Only authorised persons access sensitive data

Data sharing

Your data are never sold to third parties. They may be shared only in the following cases:

• Stripe: Secure payment processing (PCI-DSS Level 1 certified, United States — standard contractual clauses)
• Infomaniak Network SA: Hosting of the site and data (Switzerland / EU — Infomaniak privacy policy)
• Google / Apple: Only if you choose to sign in via those services (OAuth authentication)
• OpenChargeMap: Charge-point search — GPS coordinates sent for the query, without storing your location
• Public fuel data: Station prices via French open data (roulez-eco.fr) — no personal data transmitted
• Garage you contact: If you email a fault from AutoSuivi, the vehicle information you confirm is sent to the garage’s address
• Vehicle transfer: If you transfer a vehicle to another AutoSuivi user (an explicit action on your part)
• Newsletter: Email address only if you join the mailing list (unsubscribe via a dedicated link)
• Google AdSense: Advertising network on blog pages only. No AutoSuivi account data are sent to it; Google processes browsing data on those pages under its rules for partner sites
• Legal obligation: If required by the French courts or authorities

Cookies and trackers

On the AutoSuivi service (signed-in area, registration, legal pages), no advertising, analytics or tracking cookies are set. Only cookies strictly necessary for operation are used:

• Session cookie (PHPSESSID): Keeping you signed in (exempt from consent under CNIL guidance)
• CSRF cookie: Anti-forgery security token (exempt from consent)
• “Remember me” cookie (remember_me): Optional persistent sign-in (30 days) — set only if you tick this option when signing in

On blog pages (/blog), Google AdSense ads are shown. Google and its partners may set advertising cookies to measure ad reach and, if you consent, to personalise ads. A consent window lets you accept or refuse personalised advertising, and to change that choice at any time.

You can also set your preferences directly with Google via ad settings, or read Google’s advertising policies.

The cookie-notice display preference is stored in localStorage (browser only; nothing is sent to our servers).

You can delete this data in your browser settings at any time.

Your rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access: Request a copy of your personal data
• Right to rectification: Correct inaccurate data
• Right to erasure: Delete your account and all your data
• Right to portability: Receive your data in a structured format
• Right to object: Object to the processing of certain data
• Right to restriction: Temporarily limit the processing of your data

Data retention

Your data are retained:

• Active account: For as long as your account exists
• After account deletion: Personal data deleted immediately and permanently on request (right to erasure from account settings)
• Anonymised payment logs: Kept for 5 years (legal obligation — identifying data removed)
• Security logs: Kept for a maximum of 12 months

Protection of minors

AutoSuivi is intended for people aged 18 and over. We do not knowingly collect data from minors. If we discover that a minor has provided information, we will delete their account immediately.

Changes to this policy

This policy may be updated to reflect changes in our practices or in the law. Material changes will be notified by email. The last-updated date is shown at the top of this page.