Privacy Policy
Last updated: 2026-10-01
This Privacy Policy explains how METACODER SRL (“we”, “us”), the operator of the CarMaster platform, collects and processes personal data when you use the CarMaster driver and business apps and this website.
Who we are
CarMaster is operated by METACODER SRL, a company registered in Romania (trade registry no. J16/1394/15.07.2016, tax ID 36322147), with its registered office at Str. Magnolia, Nr. 1, Bl. 2, Sc. A, Et. 1, Ap. 6, Com. Pielești, Jud. Dolj, Romania. For any privacy question you can contact us at cm.metacoder@gmail.com.
What we collect
- Account details - your name, email, and phone number, provided when you register.
- Vehicles - the vehicles you add (manufacturer, model, year, license plate, and optional VIN).
- Service activity - bookings, towing requests, work stages, and the messages and photos you exchange with a shop or driver.
- Location data - only if you allow it, and only while the app is open, your device’s position: shown to you on the map, used to sort nearby locations, and used to set a tow pickup point, which is sent to the towing business you choose. In the business app it also places the pin of a location you add or edit; the pin you save becomes that location’s public position on the map.
- Tow drivers’ position - while an employee of a towing business marks themselves available, the app sends their position so a tow request can be dispatched and followed: their company’s dispatchers see it live, and so does the customer of a tow they have accepted. It is sent only while the app is open, never in the background, and stops when the driver marks themselves unavailable, closes the app or withdraws the permission.
- Ratings - the score and comment you leave after a job. The comment appears publicly on the location’s page, signed with your first name and last initial.
- Ratings service businesses give you - after a booking or tow is finished, the business can rate you from 1 to 5 stars, mark whether you were late, did not pay or behaved rudely, and add a short review. See Ratings service businesses give you.
- Technical data - basic device and log information needed to operate and secure the service.
How we use it
We process this data to provide the service: to create and manage your account, take and fulfil bookings and tow requests, enable chat between you and a service business, send you notifications about your activity, and keep the platform secure. Authentication is handled by our identity provider (Keycloak).
Legal bases
We process personal data to perform our contract with you (providing the app), on the basis of your consent (for example device location and push notifications, which you can withdraw at any time), and for our legitimate interests in operating and securing the service.
Ratings service businesses give you
After a booking or tow request is finished, the business that did the work may rate you once for that job: a score from 1 to 5 stars, whether you were late, did not pay or behaved rudely, and an optional short review. Missed appointments that were cancelled automatically because you did not arrive are counted too.
- Why: so that service businesses can know what to expect before accepting a job, which is their legitimate interest (GDPR Art. 6(1)(f)).
- Who sees it: only managers and administrators of service businesses on CarMaster that you have a booking or tow request with. They see the average, the counts and the written reviews, but never which business wrote a rating. The ratings are not shown in the driver app and are never published.
- Your rights: the ratings are included in your data export, with the location that gave each one. You can object to a rating, or ask for it to be corrected, by writing to us; if the objection is justified we remove it, and it then no longer counts anywhere.
- Retention: each rating is deleted 3 years after it was given, and all of them are deleted when you delete your account.
Sharing
A booking or tow request is shared with the service business you choose, so they can fulfil it. We do not sell your personal data.
We use the following processors, strictly to operate the service:
| Provider | What it processes | Where |
|---|---|---|
| Keycloak (self-hosted) | Authentication: email address, name | EU |
| Own hosting (Kubernetes) | All application data | EU |
| SeaweedFS (self-hosted) | Photos you upload | EU |
| Centrifugo (self-hosted) | Real-time delivery of messages and notifications | EU |
| Mailgun EU | Email delivery: recipient address, message content | EU |
| smslink.ro | SMS delivery: phone number, message content | Romania |
| Google Firebase Cloud Messaging | Push notifications: device token, notification title and text | USA |
| Oblio | Invoicing subscribed businesses: the business’s billing details | Romania |
Transfer outside the EU. Push notifications are delivered through Google Firebase Cloud Messaging (Google LLC, USA), on the basis of the standard contractual clauses adopted by the European Commission. You can turn push notifications off at any time from the app or device settings without losing access to the service.
Lock-screen notifications. A notification’s text can include the sender’s name and an excerpt of the message received, a licence plate or vehicle description, and a location name. The operating system may display it on the lock screen, so it can be read by anyone holding the device, and the content passes through Google Firebase Cloud Messaging to be delivered. You can turn push notifications off in the app or device settings, or hide notification content on the lock screen in your device’s privacy settings.
Invoicing. For subscribed businesses, invoices are issued through Oblio and transmitted electronically to ANAF via the e-Factura system, as required by law. This concerns the business’s data, not individual customers’.
Maps and directions. Maps in the apps are loaded from the OpenStreetMap tile servers (OpenStreetMap Foundation, United Kingdom), which receive your IP address and the area of the map being displayed, but not your account details. When you tap a directions button, the destination’s coordinates are handed to a navigation app of your choice (for example Google Maps, Waze or Apple Maps), which processes them under its own privacy terms.
Retention
We keep your data for as long as your account is active, with the following exceptions, which apply automatically:
- Notifications: read notifications are deleted after 90 days, unread ones after one year, and notifications you delete are removed permanently after 30 days.
- Chat conversations: a conversation with no new message for 24 months is deleted, together with its messages and images. Support conversations with the platform team are not included.
- Bookings and tow requests: 3 years after they end, we delete their free-text details (your notes, the reason a time was declined or a booking cancelled) and, for tow requests, the pickup and destination addresses and the truck’s last recorded position; the pickup and destination coordinates are kept only to a precision of about 110 metres. The booking stays in the shop’s history without them.
- Client profiles created by a shop: if a shop recorded your contact details and the profile was never claimed and shows no activity for 24 months, the name, phone number and email are deleted.
- Devices: a device’s notification token is removed after 180 days without use.
- SMS: verification codes are deleted after 30 days, and delivery confirmations after 7 days.
- Ratings service businesses give you: deleted 3 years after they were given.
- Invoices: invoices issued to shops are kept for as long as the law requires, independently of the above.
When you delete your account, we erase or anonymise your personal data as described in our GDPR notice.
Your rights
You can access, correct, export, or delete your personal data. The apps include built-in data export and account deletion on your profile page. See the GDPR notice for details and how to exercise each right.
Changes
We may update this policy. Material changes will be reflected here with a new “last updated” date.