Privacy Policy

1. Who is responsible

Riold LLC, 1800 Cold Stream Ct. Apt. 205, Asheville, NC 28803, United States, company ID 2020-000944139, is the controller of the personal data described here. Write to info@skipdealer.cy with any question about it.

2. What we collect

Your email address, when you sign in with a code, with Google or with Apple. We use it to sign you in and to send necessary notifications. No marketing. If you sign in with Apple and choose to hide your address, we receive the relay address Apple gives us and never your own.

Your Google account identifier, when you sign in with Google. It lets us recognise you next time without holding a password.

Your Apple account identifier, when you sign in with Apple. It does the same job as the Google one.

A session for each device you sign in on in our app, so that signing out on one device leaves the others signed in. With it we keep the IP address the device last connected from, and the country and city we look up from that address.

A notification token for each device, if you turn notifications on in our app. It is the address Apple or Google delivers the evening digest to, and it is tied to your account.

The alerts you create: the make, the model and the criteria you chose. We match them against each day's auctions and send you the cars that fit.

Your price guesses, whenever you use Guess the Price. We keep the amount you guessed, which car it was for and when, and after the auction we add whether you won and what discount you earned. The discount stays because it is a promise we have to honour later.

Which cars have appeared on your screen and which you have put away, in our app. A card counts as read once it scrolls into view, whether or not you open it; that lets an unread card show as unread and a hidden card stay hidden. A car that never reached your screen is recorded nowhere at all.

Your name, your phone number and your preferred contact channel, when you place an order. We use them to carry out the order and to reach you about it.

Your Telegram id, username and display name, if you start our bot. We use them to send the alerts and the evening digest you asked for.

A record of your visit: the IP address you came from and the country and city we look up from it, which page you arrived on, which site sent you, the campaign labels in the address, and whose referral link you followed. We use it to see what brings people to us, to tell people from automated traffic, and to credit a referral to the right person.

We look up the country and city on our own server, in the GeoLite database of MaxMind, Inc. Your IP address is not sent to MaxMind. Both are approximate: they show where your internet provider connects you, which can be a different city from yours. This product includes GeoLite Data created by MaxMind, available from https://www.maxmind.com.

The steps you reach in the funnel, counted as events, so we know how many people get from one step to the next.

Which cars you open, and on which day, once we know who you are: signed in on this site or in our app, or arriving from a card our bot sent you. We count different cars for each reader, because that count is what tells a person from a program copying our prices. An account that passes the limit is blocked until we lift it, and we keep a record of the block.

3. What we never keep

We do not store your browser user-agent.

From the address of the page that sent you here we keep the host name only. The rest of another site's address can be private and is not our business.

We do not hold a password for you. Signing in is a six-digit code sent to your address, or Google. The value of your session cookie is not stored on our server either: we keep only a hash of it, so a copy of our database opens no session. The app's two tokens are held the same way, and the longer-lived one is replaced every time it is used.

Section 4 covers the measurement tools, which are a different matter and collect more than we do.

4. Analytics and advertising

If you accept them, three tools from Google and Meta run on this site.

Google Analytics 4 tells us how many people reach each page and each step. It reads your IP address, your device and browser, and the pages you open. Google shortens the address before storing it.

The Meta pixel tells us when someone who saw our advertising on Facebook or Instagram came here and what they did. It reads the same kind of data, and Meta can match it to a Facebook or Instagram account.

The Google Ads conversion tag tells us which advertisement led to an order.

None of them load until you accept. Decline, and the scripts are never fetched, so neither company learns that you were here.

Section 2 says we count the steps you reach. If you accept, we also send that count to Google and to OpenAI from our server, not from your browser. It carries the identifier the advertisement put in the address you arrived on, and nothing else about you: no name, no email, no IP address. Decline, or read on without answering, and it stays with us.

Our app is measured separately. It carries Google Analytics for Firebase, which gives your installation an identifier and reports how the app is used to Google. The steps you reach are sent from our server to that same property under that identifier, whatever you answered here: the choice on this page covers this site, and the app asks no such question.

Our legal basis for them is your consent. You may withdraw it at any time with the Cookies button in the footer, and refusing changes nothing about what this site shows you.

5. Cookies

Set by us:

The session cookie, kept for 180 days of inactivity on the site and 48 hours of inactivity on the admin panel. Keeps you signed in. Necessary.

sd:consent. Not a cookie: a value in your browser's local storage recording what you answered here and when. Necessary, and it is what lets us not ask again.

sd_visit, 180 days. Recognises the same visitor across pages so a visit is counted once and a referral is credited to the person who sent you. It holds a random number and nothing else: no address, no name, no device. Necessary, because a referral that is not credited is a payout that reaches nobody.

sd_lang, 12 months. Remembers which language you chose, so the site opens in it next time instead of guessing again from your browser. It holds two letters, en or ru, and nothing else. Necessary, because a choice we forget is a choice the reader has to make on every page.

Set by Google and Meta if you accept them: _ga and _ga_* for Google Analytics, _gcl_* for Google Ads, _fbp for the Meta pixel, and cookies Meta sets on its own domain when you are signed in to Facebook or Instagram.

To remove them, use the Cookies button in the footer, or block and delete cookies for skipdealer.cy in your browser. The catalogue, the car pages and the offer page work without any of them. Signing in needs the session cookie.

Our app sets no cookies at all. It signs its requests with the tokens described in sections 2 and 3 instead.

6. Who else handles it

Hetzner Online GmbH hosts our server and therefore our database, in Germany.

Cloudflare, Inc. stores a nightly backup of our database, in the European Union. We encrypt it before it leaves our server, so Cloudflare cannot read it.

Google Ireland Limited provides Sign in with Google, the mail relay that delivers our messages, Google Analytics, Google Ads, and the service that delivers our notifications to Android phones.

Apple Distribution International Limited provides Sign in with Apple and delivers our notifications to iPhones and iPads.

Meta Platforms Ireland Limited provides the pixel.

OpenAI Ireland Ltd receives the conversions described in section 4, when an advertisement in ChatGPT brought you here. It runs no script on this site.

Stripe Payments Europe Limited takes card payments, and Trybit takes payments in cryptocurrency. Whichever you choose receives your email address and the amount, and the payment itself happens on their page, not on ours. We never see or store your card number.

Telegram delivers the bot messages, for people who use the bot.

We do not sell your data. We do not rent it. We do not send you marketing email.

7. Where it is kept

The database is on a server in Falkenstein, Germany, inside the European Union.

Riold LLC is registered in the United States, and the people who run SkipDealer reach that server from outside the European Union. That access is necessary to carry out your order and to answer you, and it is limited to the people who do that work.

Google and Meta transfer data to the United States under their own safeguards. Both are certified under the EU-US Data Privacy Framework, and their contracts with us include the European Commission's standard contractual clauses. OpenAI Ireland Ltd is our contracting party for that advertising, and its own terms govern anything that reaches OpenAI in the United States. If you refuse analytics and advertising cookies, those tools do not run at all. Signing in with Google and the email we send you are separate, and they work whatever you choose here.

8. How long we keep it

Your account and the identities attached to it are kept for as long as you have an account with us. Order and payment records are kept for as long as accounting and tax rules require them.

A device session and its notification token last until you sign that device out, or until the device has gone 180 days without using the app. Closing your account ends every one of them.

Visit records, funnel events and the record of the cars you opened are kept while they are useful for measuring the funnel and for keeping that limit. Ask us to delete them and we will.

9. Your rights

You may ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use of it, and ask for it in a portable form. You may withdraw a consent you gave.

In our app you may sign out the device you are holding, and a session you have signed out of never opens again. To end a session on a device you no longer have, write to us.

You can close your account yourself at Delete your account. It works whether or not the app is still installed. Paid orders stay in our accounting records, as section 8 says.

Write to info@skipdealer.cy. We answer within thirty days.

If you live in Cyprus and you are not satisfied with our answer, you may complain to the Office of the Commissioner for Personal Data Protection. If you live elsewhere in the European Union, complain to your own supervisory authority.

10. Children

SkipDealer is for adults buying a car. It is not directed at anyone under eighteen, and we do not knowingly collect their data.

11. Changes

We may change this policy. The date at the top tells you when it last changed.