Legal
Privacy policy
Updated 9 September 2026
This policy describes the personal data CarRange AI processes based on the current application. It is not counsel-approved. Items that cannot be determined from the code are marked REVIEW REQUIRED. For consumers in Germany, the German version prevails.
1. Controller
Controller under the GDPR: Ertem Cabbar, sole trader (Einzelunternehmen / Einzelunternehmer), trading as CarRange AI, Wassertorstr. 2, 10969 Berlin, Deutschland.
Contact: support@carrangeai.com, phone: +49 174 9076741
REVIEW REQUIRED: Add a data protection officer if one is appointed or legally required.
2. Overview
CarRange AI lets users upload vehicle photos and optional videos and generate AI presentations (CR Video, CR View, CR Edit, CR Background, CR Listing Poster). We use:
- Website hosting: Vercel
- Account, database and file storage: Supabase
- Payments and subscriptions: Stripe
- Image AI: OpenAI
- Video AI: Runway
3. Hosting (Vercel)
Purpose: serving the website and APIs; security and access logs.
Data: IP address, time, URL, user agent, error logs.
Legal basis: Art. 6(1)(b) and (f) GDPR (REVIEW REQUIRED for log retention).
Third country: Vercel is US-based (REVIEW REQUIRED: transfer tool).
4. Account (Supabase Auth)
Purpose: sign-up, sign-in, session, password reset.
Data: email, password hash, user id, session cookies, optional display name.
Legal basis: Art. 6(1)(b) GDPR.
5. Projects, photos and videos
Purpose: storing vehicle projects and source media for the five products.
Data: project metadata you enter, uploaded photos, optional 360° videos, filenames, storage paths.
Recipient: Supabase Storage (private buckets).
Legal basis: Art. 6(1)(b) GDPR.
6. AI-generated images and videos
Purpose: creating the requested output.
Data: selected source media, prompts, generated files, provider task ids.
Recipients: OpenAI (image products) and Runway (video products), only when that product is used.
Third country: both providers are US-based (REVIEW REQUIRED).
7. Payments (Stripe)
Purpose: monthly Basic / Pro / Ultra subscriptions, CR Credit grants, optional credit packs, invoices, plan changes, cancellations.
Data: Stripe customer and subscription ids, plan, payment status, invoice references. Card data is collected by Stripe, not stored on our servers.
Legal basis: Art. 6(1)(b) and (c) GDPR.
8. CR Credits
Purpose: wallet balance, spend, purchase grants, refunds after failed jobs.
Legal basis: Art. 6(1)(b) GDPR.
9. Technical logs
Purpose: debugging and abuse prevention. Server logs omit API secrets. Cancellation and withdrawal forms store a hash of the caller IP (not the raw IP) with the notice.
Legal basis: Art. 6(1)(f) GDPR (REVIEW REQUIRED).
10. Cookies and local storage
No analytics or marketing cookies are used.
Necessary auth cookies from Supabase keep you signed in.
Language preference is stored in a cookie and in localStorage/sessionStorage.
Workspace drafts may be stored in localStorage.
REVIEW REQUIRED: whether the language cookie needs consent. No cookie banner is shown because no non-essential trackers were found.
11. Your rights
Access, rectification, erasure, restriction, portability and objection as provided by the GDPR. Contact support@carrangeai.com. You may lodge a complaint with a supervisory authority.