Privacy Policy

Who is responsible for your data

The controller of your personal data is VIRALITY sp. z o.o., ul. Borowa 1C, 35-232 Rzeszów, Poland, entered in the Polish National Court Register (KRS) under number 0001096055, NIP 5170446022, REGON 528157879, share capital PLN 5,000.

For anything about your data, contact us through the /support command in @carcinemappbot on Telegram, or a letter to VIRALITY sp. z o.o., ul. Borowa 1C, 35-232 Rzeszów, Poland.

What we do not do

We do not use analytics, advertising or tracking tools on carcinema.app or in the car app. We do not sell personal data, and we do not use it to build advertising profiles.

What we keep and why

• Your account. If you use Telegram: your Telegram user id, first and last name and username, as Telegram passes them to our bot. If you use email: your email address. For both: when the account was created, who invited you (if anyone), whether you turned off reminder messages, and whether your car uses the older MCU1 browser. We need this to provide your account (performance of our contract with you).
• Your library. The links you send, and for each video its title, thumbnail, length, status and when it was added and last played. This is the service you asked for (contract). When you delete a video we keep a short record of the deletion (title and video id) while your account exists, so that we can answer questions about it.
• Purchases and hours. Every purchase, use of hours, referral reward and refund, with the payment id from Telegram or Paddle and the amount. We need this to run your balance (contract) and must keep it for tax and accounting (legal obligation).
• Messages to support. What you write through /support is forwarded to our team on Telegram together with your name, username, account id and balance, so we can answer you (contract and our legitimate interest in solving problems).
• Technical reports. If the car app fails to start, or you open the diagnostics page, your browser sends a report with your IP address, browser user agent, screen size, language and the results of feature tests. When a video fails to download, we log your account id, the link and the error. We use these to fix faults (legitimate interest), and delete them after 90 days.
• Server logs. Our web server records requests (IP address, time, address requested, user agent) to keep the service secure and working (legitimate interest). They are deleted after 90 days at most.

Where we rely on legitimate interest, you can object, and we will stop unless we have a compelling reason to continue.

Messages from the bot

Besides replies to what you do, the bot may send you a small number of reminder messages, for example if you never added a video. Each reminder is sent at most once and has a button to stop all of them. Receipts and messages about your own videos are not reminders and keep coming.

Who we share data with

We use the following providers. Each receives only what it needs for its part:

• Hetzner Online GmbH (Germany): hosts our server and database in Finland.
• Cloudflare, Inc.: stores the converted video files (named by video id, with no personal data) and runs our domain’s DNS.
• Telegram: carries every message between you and the bot, and processes payments in Telegram Stars.
• Paddle.com: processes card payments as Merchant of Record. When you pay by card, Paddle receives your account id (for Telegram accounts this contains your Telegram user id) and, if you signed in by email, your email address. Paddle collects your payment details itself; we never see your card. Paddle’s own privacy notice applies to what it collects.
• Resend: sends the sign-in emails, so it receives your email address and the sign-in link.
• goQR.me (api.qrserver.com): draws the QR code shown on the car screen when you sign in. It receives a one-time pairing address that expires after 5 minutes and identifies no one.
• YouTube: when we fetch a video, YouTube receives the video link from our servers and the internet connections we use for fetching. No information about you is sent. Video thumbnails are loaded by your own browser from YouTube’s image servers, so YouTube sees your device’s IP address when they are shown.

Some of these providers are outside the European Economic Area or may access data from outside it. Where that happens, the transfer is covered by the European Commission’s adequacy decisions (including the EU-US Data Privacy Framework) or by its Standard Contractual Clauses.

We may also disclose data where the law requires it, for example to a court or an authority.

How long we keep it

• Account and library: while your account exists. Deleted when you ask us to delete your account.
• Purchases and hours: 5 years from the end of the year of the purchase, as Polish tax law requires, even after the account is deleted.
• Technical reports and server logs: 90 days.
• Backups: our backups are replaced in rotation, so deleted data disappears from them within 30 days.

Cookies and storage in your browser

We use only what the service needs to work, so there is no cookie banner:

• token: keeps you signed in, for 90 days. signed_in: tells our pages that you are signed in, so they show the right button, for 90 days.
• lang: remembers a language you picked, for a year. login_nonce: ties an email sign-in link to the browser that asked for it, for 15 minutes.
• In local storage, the car app keeps a copy of your library list, so it can open without a signal, and the point where you stopped each video, so you can resume. Signing out deletes the library copy.

The card checkout on carcinema.app/buy is provided by Paddle and may use its own cookies, described in Paddle’s privacy notice.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to its use, and to receive a copy of the data you gave us in a portable format. To use any of these rights, contact us through the /support command in @carcinemappbot on Telegram, or a letter to VIRALITY sp. z o.o., ul. Borowa 1C, 35-232 Rzeszów, Poland. We answer within one month. Deleting an account removes the account, its library and its messages; we keep only what the law requires us to keep (see above).

You may also lodge a complaint with a data protection authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa). You may also go to the authority in the country where you live.

Children

CarCinema is not meant for children under 16, and we do not knowingly keep their data.

Changes

When we change what data we keep or who we share it with, we update this page first. The date at the top shows the current version.