Privacy Policy

Who We Are

Vcar ('we', 'our', or 'us') provides a mobile application that lets you monitor and control your compatible vehicle. We act as the data controller for the personal data described here. This Privacy Policy explains what we collect, why, how we protect it, and the rights you have under the EU/UK General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK). Questions: privacy@remotecarconnect.com.

Scope

This policy covers the Vcar mobile app and the backend services that support it. It does not cover third parties we integrate with, such as your vehicle manufacturer or the app stores, which operate under their own privacy policies.

Data We Collect

• Account data: email address, name, and authentication identifiers managed by our login provider. • Vehicle data: make, model, year, and vehicle identification number (VIN). • Vehicle telemetry: precise location, odometer, battery state of charge and range, fuel level, charging status, tire pressure, lock status, and diagnostics. • Subscription data: purchase and entitlement records for in-app subscriptions (we never store your card number). • Device data: device model, operating system version, language, and app version. • Usage data: feature interactions and diagnostic logs. • Support data: messages you send us.

How We Collect Data

• Directly from you when you create an account, connect a vehicle, or contact support. • From your vehicle through the Smartcar API, after you authorize access. • Automatically from your device when you use the app.

Why We Process Your Data

• Create and manage your account and authenticate you. • Connect to your vehicle and show its status, location, and diagnostics. • Execute remote commands you request, such as lock/unlock or start/stop charging. • Manage subscriptions and process in-app purchases. • Send the alerts and notifications you enable. • Maintain security, prevent fraud and abuse, and debug issues. • Improve existing features and develop new ones. • Comply with legal obligations.

Legal Bases for Processing

Where GDPR applies, we rely on: performance of a contract (to provide the app and the features you request); your consent (for precise location, push notifications, and optional features); our legitimate interests (security, fraud prevention, and product improvement); and compliance with legal obligations. Where KVKK applies, we process personal data based on your explicit consent and the other grounds in Article 5, including processing necessary to perform a contract and for our legitimate interests where your fundamental rights are protected. You can withdraw consent at any time.

Location Data

With your permission, the app accesses your vehicle's precise location to show it on the map, calculate routes and arrival charge, and power location-based features. You can disable location access in your device settings, but some features will not work without it.

Smartcar Integration

We use Smartcar's API to connect securely to your vehicle. When you authorize a connection, Smartcar brokers access between your vehicle manufacturer and our app, and we receive only the permissions you approve. The access tokens that enable this connection are encrypted before storage and are never exposed to the app. You can revoke access at any time by disconnecting your vehicle in Settings or through Smartcar's own controls. Smartcar processes data under its own privacy policy.

Service Providers

We share data with vetted providers who process it on our behalf: • Smartcar – vehicle connectivity. • Our authentication provider – account login and identity. • Our subscription provider – in-app purchases and entitlements. • Cloud hosting and database providers – to run our backend. • Push notification providers – to deliver alerts. These providers are bound by contracts that limit how they use your data.

Sharing & Disclosure

We do not sell your personal data. We may disclose data when required by law, to protect our rights or the safety of users, or in connection with a merger, acquisition, or asset sale, subject to this policy.

International Transfers

We operate internationally, so your data may be processed in countries outside Türkiye or the European Economic Area. When we transfer personal data across borders, we apply appropriate safeguards, such as the European Commission's Standard Contractual Clauses and, for transfers from Türkiye, the conditions in Article 9 of the KVKK, including your explicit consent where required.

Data Retention

We keep account and vehicle connection data for as long as your account is active. Vehicle telemetry is cached for up to 7 days to keep the app responsive, and webhook event records are retained for up to 7 days for reliability. When you delete your account or disconnect a vehicle, we delete or anonymize the associated data, except where we must retain it to meet legal obligations.

Data Security

We protect your data with encryption in transit (TLS) and at rest. Vehicle access tokens are encrypted with AES-256-GCM and stored only on our servers. We apply access controls, monitoring, and other technical and organizational measures. No system is completely secure, but we work continuously to protect your information.

Your Rights

Subject to applicable law (GDPR Articles 15–22 and KVKK Article 11), you can: • Learn whether we process your data and access it. • Request correction of inaccurate or incomplete data. • Request deletion of your data. • Object to or request restriction of certain processing. • Request a portable copy of your data. • Withdraw consent at any time. • Disconnect your vehicle at any time in Settings. • Not be subject to decisions based solely on automated processing. To exercise these rights, contact privacy@remotecarconnect.com. We respond within the timeframes required by law.

Children's Privacy

The app is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

Changes to This Policy

We may update this policy from time to time. We will post the updated version in the app and revise the 'Last updated' date, and we will communicate material changes where required.

Contact Us

Data controller: Vcar. For privacy questions or to exercise your rights, contact privacy@remotecarconnect.com.

Complaints

If you are in the European Economic Area or the UK, you may lodge a complaint with your local data protection authority. If you are in Türkiye, you may file a complaint with the Personal Data Protection Authority (KVKK) after first applying to us.