Privacy Policy

Last updated: 13 July 2026

VitrinCar ("we", "us") operates the VitrinCar platform for car dealers and private sellers. This policy explains what personal data we process, why, and the rights you have. We process personal data in line with the EU GDPR.

1. Who we are

VitrinCar — operated by VitrinCar Technologies, Cologne, Germany. For any privacy request, contact us at privacy@vitrincar.com.

2. Data we process

Depending on how you use VitrinCar, we may process: your account details (name, email, phone, showroom name and address), the vehicle listings and media you create, your website and app usage, and, if you connect a social account, the data described in section 3.

3. Instagram & Meta data (social publishing)

VitrinCar lets a dealer connect their own Instagram professional account so the dealer can publish and manage their own content from inside VitrinCar. This uses the official Instagram Graph API. You start the connection yourself and sign in on Instagram's own login screen — we never see or store your Instagram password.

When you connect your Instagram account, and only with your explicit authorisation, we access and process:

Basic profile (instagram_business_basic) — your Instagram user ID, username and account type, shown to you so you can confirm the connected account.
Content publishing (instagram_business_content_publish) — we publish the stories and posts you choose (car designs you generated in VitrinCar) to your Instagram account, at your request.
Messages (instagram_business_manage_messages) — we display story replies and direct messages your account receives so you can read and answer them inside VitrinCar, and, only if you switch it on, help you draft replies.
Comments (instagram_business_manage_comments) — we display comments on your content so you can moderate and reply to them.

We use this data solely to provide the publishing and messaging features you activate. We do not sell it, we do not use it for advertising, and we do not share it with third parties except the infrastructure providers that host VitrinCar on our behalf. Access tokens are stored encrypted at rest and are used only to call the Instagram API for your account.

4. Legal basis

We process your account and listing data to perform our contract with you (Art. 6(1)(b) GDPR). We process Instagram/Meta data on the basis of your explicit consent, given when you connect the account (Art. 6(1)(a) GDPR); you can withdraw that consent at any time (section 6).

5. Retention

We keep your account and listing data for as long as your account is active. Instagram access tokens and connection data are kept only while the connection is active and are deleted when you disconnect the account or delete your VitrinCar account.

6. Disconnecting & deleting your data

You can disconnect your Instagram account at any time from the "Connect to Instagram" page in your Showroom panel — this immediately deletes the stored access token and connection on our side. You can also revoke access from Instagram itself under Settings → Apps and websites. To request full deletion of your VitrinCar data, use our data deletion endpoint or email privacy@vitrincar.com; we action verified requests within 30 days.

7. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict and port your personal data, and to object to processing. To exercise any right, contact privacy@vitrincar.com. You may also lodge a complaint with your local data-protection authority.

8. Changes

We may update this policy; the "last updated" date above reflects the latest version.