Published: September 8, 2022 · Last updated: September 29, 2026

Last updated: 1 October 2026

This policy explains what personal data Carhacker OÜ collects when you use https://iamcarhacker.com (the “Website”), why, and what rights you have.

1. Controller

Carhacker OÜ, Sepapaja tn 6, 15551 Tallinn, Estonia, registry code 17463840. Email: info@iamcarhacker.com

2. What we collect and why

2.1 Account

Email address, username, display name, password (stored only as a hash), and anything you add to your profile (bio, photo). Why: to run your account and give you access to what you bought. Legal basis: contract.

2.2 Purchases and credits

What you bought, when, the amount, your credit balance and credit history, and the name, email and billing address you enter at checkout. Card and PayPal details are handled by the payment processors, we never see them. Why: to deliver purchases, handle refunds and keep accounting records. Legal basis: contract and legal obligation (accounting law).

2.3 Car Electrician Course

Your enrollment and lesson progress. Legal basis: contract.

2.4 Online tools

  • Uploaded files: processed on our server. The unique part of the VIN (the last 8 characters) is masked in your browser before upload and again on the server. We keep the masked files to improve module support. A masked file does not identify you or your vehicle.
  • Result delivery: the email address you enter, the tool and module used, the date, and whether you agreed to receive our newsletter. We send the result to that address and one follow-up email about 24 hours later asking whether the result worked. Legal basis: contract (delivering the result) and legitimate interest (checking tool quality).

2.5 Community

Questions, answers, votes, shared links, experience reports and images you post, and contact requests. Posts are public (shared links only in part) and shown with your display name. Images you upload with an experience report are stored privately until approved, are resized and have location and camera data (EXIF) removed. When you send a contact request, your email address is sent to the member you contacted. Legal basis: contract.

2.6 AI assistant

The messages you send, the answers, a random session ID, the page you asked from and which links you clicked in the answers. Messages are sent to our AI provider to generate the answer. Why: to answer you, prevent abuse and improve the assistant. Legal basis: legitimate interest. Do not enter personal data, VINs or payment details into the chat.

2.7 Newsletter

Email address, the tags that show what you are interested in (for example which tool you used), and whether you open or click our emails. Only with your consent, which you can withdraw with the unsubscribe link in every email. Customers may get emails about similar products, and can opt out at any time.

2.8 Contact by email

What you write to us and your email address, to answer you.

2.9 Usage data and cookies

Your browser, device, pages visited, the page you came from, and an approximate location derived from your IP address. We count clicks on shop buttons (which product, which button, which page), without linking them to your account. Analytics and affiliate cookies are only used with your consent, which you give or refuse in the cookie banner. Legal basis: consent (non-essential cookies) and legitimate interest (security and basic statistics).

3. Who processes data for us

  • Rocket.net (hosting) and Cloudflare (network and security)
  • SureCart (checkout and customer accounts), Stripe and PayPal (payments)
  • Amazon Web Services, Simple Email Service (sending emails)
  • OpenAI (generating AI assistant answers; data sent through the API is not used to train their models under their current terms)
  • Supabase (database for AI assistant logs, experience reports and their images)
  • n8n (automation that connects the AI assistant to our database)
  • Google Analytics (statistics, only with consent)
  • Gravatar by Automattic (profile pictures linked to your email address)
  • YouTube and Vimeo (embedded videos, which can set their own cookies when you play them)
  • Affiliate programs such as Amazon Associates, AliExpress, CJ Affiliate and Awin, and the shops we link to (they can set cookies when you click an affiliate link)

Newsletter, course platform and community software run on our own hosting. We do not sell personal data.

4. Transfers outside the EU

Some providers above are based in the United States or other countries outside the European Economic Area. We use them only with a legal basis for the transfer, such as the EU-US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

5. How long we keep data

  • Account and profile: while your account exists. Deleted within 90 days after you ask us to close it, except data we must keep by law.
  • Purchase and accounting records: 7 years (Estonian accounting law).
  • Tool delivery log: 24 months. Masked uploaded files: kept, as they are not personal data.
  • AI assistant logs: up to 24 months, then deleted or anonymized.
  • Community posts: while published. When your account is closed, your posts can stay under the name “Member”, or be deleted on request.
  • Experience report images: rejected reports are deleted; private images of approved reports are kept with the report.
  • Newsletter: until you unsubscribe, then your address stays on a suppression list so we do not email you again.

6. Your rights

You can ask for access to your data, correction, deletion, restriction, a copy in a portable format, and you can object to processing based on legitimate interest (including direct marketing) and withdraw consent at any time. Write to info@iamcarhacker.com, we answer within one month. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or the authority in your country.

7. Security

HTTPS everywhere, hashed passwords, restricted admin access, two-factor login for administrators, and regular updates. No system is perfectly secure, so we cannot guarantee absolute security.

8. Age

The Website is not meant for people under 16, and purchases require you to be 18. We do not knowingly collect data from children. If you believe we have, contact us and we will delete it.

9. Changes

We update this policy when our services change. The date at the top shows the latest version. We tell account holders by email about important changes.