Last updated: October 2026
This Privacy Policy explains how we collect, use, store, and protect your personal data when you use Evercar. We are committed to protecting your privacy and ensuring that your personal data is handled in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable national data protection laws.
By using Evercar, you acknowledge that you have read and understood this Privacy Policy.
Evercar is developed and operated by NAVIK SARL, registered in France.
For any questions or requests relating to your data, email alex@evercar.net
We collect and process the following categories of personal data:
Account Information: Name, email address, password (encrypted), country.
Vehicle Information: Vehicle make, model, year, license plate number, VIN (Vehicle Identification Number), mileage.
Maintenance Records: Service history, repair records, maintenance schedules, receipts, invoices, and associated costs, including vendor names and odometer readings.
Uploaded Documents and Photos: Invoices, receipts, and photos you upload or take with your camera, including any personal information they contain (for example names, addresses, or registration numbers).
Notes, To-dos and Diagnostics: Free-text notes, to-do items (including any links you add), and symptom descriptions and diagnostic step notes you enter about your vehicles.
Sharing and Preferences: Your public display name, language preference, newsletter choice, and the roles you grant to other people on a vehicle (which involves their email address). If you mark a vehicle as public, its details (including VIN), service history, costs, and the owner's name become visible to anyone with the link.
Notifications and Push Notifications: The reminders and notifications we create for you (to update a car's mileage, when a scheduled check is coming up or overdue, and when your uploaded invoices have been processed) and your notification settings. If you turn on push notifications in the mobile app, we also store a push address for your phone (an address that your phone's push service gives to the app), the encryption keys that go with it, the app version, and the date your phone last connected.
Usage Data: App interaction data, feature usage patterns, and session duration.
Device Information: Device type, operating system, app version, and IP address. Your IP address is checked against a locally hosted country database to choose a default language; the result is not stored.
Location Data: Only if you enable location services, and only to identify nearby service centers (not stored).
We process your personal data based on the following legal grounds under Article 6 GDPR:
Contract Performance (Art. 6(1)(b)): Processing necessary to provide you with Evercar's core functionality, including tracking maintenance schedules and storing vehicle records.
Legitimate Interests (Art. 6(1)(f)): Processing for app improvement, security, and fraud prevention, where our interests do not override your fundamental rights.
Consent (Art. 6(1)(a)): Where you have given explicit consent, such as for marketing communications or optional location services. You may withdraw consent at any time.
Legal Obligation (Art. 6(1)(c)): Processing required to comply with applicable laws and regulations.
We use your personal data to:
We may share your personal data with:
Service Providers: Cloud hosting providers, analytics services, and email delivery services, and AI processing services that process data on our behalf under strict data processing agreements.
Legal Authorities: When required by law, court order, or to protect our legal rights.
We do not sell your personal data to third parties.
Third-Party Processors:
| Provider | Purpose | Location | Safeguards |
|---|---|---|---|
| OVHCloud | Data hosting | EU | GDPR compliant |
| Fathom Analytics | App analytics | EU/US | Standard Contractual Clauses |
| Your phone's push service | Delivering push notifications to your phone, only if you turn them on in the mobile app. This is either a push app you install (such as ntfy or Sunup) or, on Android phones with Google services or microG, Google's Firebase Cloud Messaging. The content of each message is encrypted so that only your phone can read it; the service can see that a message is delivered to your phone, and when. | Depends on the service (EU/US) | Encrypted messages (Web Push, RFC 8291); Standard Contractual Clauses where applicable |
| Anthropic (Claude) | AI-based extraction of date, mileage, cost, and description from uploaded invoices and receipts, and detection of duplicate service records. The uploaded file, or the title and details of the relevant records, is sent to Anthropic for this purpose only. | US | Standard Contractual Clauses |
If we transfer your personal data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including:
You may request a copy of these safeguards by contacting us.
We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy:
Account Data: Retained while your account is active and for 30 days after deletion request.
Vehicle and Maintenance Records: Retained while your account is active. Upon account deletion, personally identifiable data and financial data are deleted within 30 days, but maintenance records remain and can be claimed by future owners upon presentation of a valid ID and registration document.
Notifications: Notifications you have read or dismissed are deleted after 90 days, and notifications that no longer apply (for example after you update the mileage) after 30 days.
Push addresses: Deleted when you turn push notifications off, sign out of the mobile app, or delete your account, or when your phone's push service reports that the address is no longer valid.
Usage and Analytics Data: Retained in anonymised form for up to 24 months.
Legal Records: Retained as required by applicable law (typically 7 years for financial records).
You have the following rights regarding your personal data:
Right of Access (Art. 15): Request a copy of your personal data.
Right to Rectification (Art. 16): Request correction of inaccurate data.
Right to Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten").
Right to Restriction (Art. 18): Request limitation of processing.
Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format.
Right to Object (Art. 21): Object to processing based on legitimate interests or for direct marketing.
Right to Withdraw Consent: Where processing is based on consent, withdraw at any time without affecting prior processing.
Right to Lodge a Complaint: File a complaint with your local supervisory authority.
To exercise these rights, contact us at alex@evercar.net. We will respond within 30 days.
Delete your account yourself: Sign in, open My account (from your name in the top menu on the website, or the Account tab in the mobile app) and use the Delete account button at the bottom of the page. You will be asked to enter your current password to confirm. Your account is deleted straight away and you are signed out. You do not need to contact us.
What this removes: your login and the personal details held on your account (name, email address, password, country and preferences), your to-do items, and your access to any cars. Cars and their maintenance records are not deleted with your account; they are handled as described in Section 8.
Delete some of your data without deleting your account: Within the App you can delete individual cars, log entries (including their attached documents and photos), notes, to-do items and maintenance schedules, as long as your role on the car allows it. Deleting a car also deletes all of its log entries, notes and other records. You can also change your email address and password from My account.
If you cannot delete something yourself, or you would like data removed that is not covered above, email alex@evercar.net and we will help.
We implement appropriate technical and organizational measures to protect your personal data, including:
The App does not engage in automated decision-making or profiling that produces legal or similarly significant effects on you.
The App is not intended for users under 18 years of age. We do not knowingly collect personal data from children. If we become aware of such collection, we will delete the data promptly.
The App uses a session cookie and, if you choose to stay signed in, a persistent signed cookie (up to one month) for authentication. Your language preference is kept in your session. Fathom Analytics is a cookie-free analytics service. You can manage cookie preferences through your device settings.
We may update this Privacy Policy periodically. We will notify you of material changes through the App or via email. The "Last updated" date indicates the most recent revision.
For questions, concerns, or to exercise your rights, please contact:
Alexander Velkov
Navik SARL
Email: alex@evercar.net
Supervisory Authority
You have the right to lodge a complaint with your local data protection authority. A list of EU supervisory authorities is available at: https://edpb.europa.eu/about-edpb/about-edpb/members
--------------------------------------------------