Privacy Policy

The controller of your personal data is Telmo Eduardo Antunes Alfarrobeira, IČO 21781478, Kaprova 14, 11000 Prague, Czech Republic ("we"). Privacy questions and requests: info@detailmasters.pro. This policy explains what personal data we process on the platform at detailmasters.pro, why we process it, and what rights you have.

It covers everyone who uses the platform — customers who book services, the detailing businesses (and their staff accounts) that list on it, and agents who refer businesses to us.

It also covers the owners and staff of detailing businesses that do not have an account, where we have prepared a preview page from the business's public website or contacted the business about the platform (see sections 4 and 5), and people who subscribe to our newsletter or write to us without an account.

We offer the platform in the following countries: Portugal, Czech Republic, Spain, France, Germany, Italy, Austria, United Kingdom, Switzerland, Poland, Hungary, Slovakia, Sweden.

Depending on where you are, one of the following applies to the processing described here:

• European Union / EEA — the General Data Protection Regulation (Regulation (EU) 2016/679, "EU GDPR"), together with the national data-protection and electronic-communications rules of your country.
• United Kingdom — the UK GDPR and the Data Protection Act 2018, together with the Privacy and Electronic Communications Regulations (PECR).
• Switzerland — the Federal Act on Data Protection (FADP/revFADP).

Where this policy refers to a GDPR article, read it as the equivalent provision of the UK GDPR for users in the United Kingdom, and of the FADP for users in Switzerland. Because we are established in the Czech Republic, the EU GDPR is our baseline and we apply its standard of protection to everyone.

• Account data — name, e-mail, phone, country, preferred language, password (stored as a salted hash), optional avatar and bio, marketing consent.
• Billing data — optional billing address and tax identifiers you provide for invoices.
• Booking data — services booked, dates and times, prices (range, confirmed price, per-extra prices, payments recorded by the business), notes you add, service address for mobile services.
• Vehicle data — vehicles you save (make, model, year, colour, licence plate) and vehicle details entered with a booking.
• Photos — before/after photos of your vehicle uploaded by the business to document the work.
• Payment data — processed by Stripe; we receive only payment references (amounts, status, intent identifiers), never your card number.
• Content — reviews, review responses, appeals, messages sent through service updates.
• Loyalty, coupon and package data — points, redemptions, issued coupons and their usage, purchased packages and used sessions.
• Notification data — in-app notifications and, if you opt in, push subscription endpoints for this device.
• Technical data — IP address, request logs, cookie identifiers described below.
• Preview and prospect data (detailing businesses without an account) — the business name, address, contact e-mail and phone, services, prices, opening hours, photos and customer testimonials as published on the business's own public website; how often the preview page was opened or shared; an e-mail address left on the preview page; and our record of contacting the business (dates, channel, notes, and a request not to be contacted). When a visitor builds a preview themselves, we keep a salted hash of their IP address and browser identifier to limit abuse — not the values themselves.
• Newsletter data — the e-mail address and language of people who subscribe to our newsletter or blog without an account, and whether the subscription was confirmed or cancelled.
• Messages you send us — your name, e-mail address, subject and message when you write to us through the contact form.
• Product-usage data (business and staff accounts only) — which dashboard pages you open and for how long, the actions you take there (for example creating a service or confirming a booking), searches you run inside the dashboard, plan-restricted features you attempt to open, technical errors you hit, your device type (phone, tablet, desktop, installed app), language and country. We do not record what you type into forms, and we do not store your IP address with this data.

Mostly directly from you. Some data is created by businesses you interact with: a business may record a walk-in booking with your name and contact details, keep customer notes about the services performed, upload photos of your vehicle, and record payments. Businesses are independent controllers of their own customer records; we process this data as part of providing the platform.

A business can also bring in the customer list it already keeps elsewhere, by uploading a spreadsheet or a PDF. An AI model reads the file and proposes one record per customer (name, contact details, vehicles and notes, as far as the file contains them); the business checks each record before anything is saved. The file itself is read in memory and not stored by us. We do this on the business's behalf, and the business is responsible for having the right to bring those records in.

A business you have been a customer of can write to you through the platform: updates about a booking (for example that your car is ready), a reminder of a payment still owed for a finished service, and invitations to return (for example around the time you usually come back, or a year after your first visit). The business decides whether these are sent. A person at the business can approve each message, or the business can instruct the platform to send certain kinds automatically on its behalf; the message is then sent under the business's name without a person approving each one. The wording comes from fixed templates, which a person at the business may edit before sending; no AI model writes or sends these messages.

When the business uses a plan that includes them, updates about a booking also reach your mobile number by text message: the booking confirmed, moved or cancelled, a reminder the day before, your car ready, and the business's own updates on the job. Each text carries a private link to the booking. The link shows the booking itself (the service, the date, the place, the price and the business's contact details) but not your name, e-mail address or phone number, and it is not listed or indexed anywhere.

Preview pages are the exception. To show a detailing business what its page on the platform would look like, we read the business's own public website — at the request of someone who gives us the website address, or on our own initiative when we intend to present the platform to that business — and build a preview page from what the business has published there. We take nothing from private or password-protected sources.

A preview is not listed in our directory and is marked so that search engines do not index it; it is reachable only through its link. Anyone holding the link can delete the page with one click on the page itself. The business can ask us at any time to delete its data and not to contact it again (see section 10).

• Providing the service (accounts, bookings, payments, packages, loyalty, notifications) — performance of a contract (Art. 6(1)(b) GDPR).
• Invoicing and tax record-keeping — legal obligation (Art. 6(1)(c)).
• Booking reminders and essential service e-mails and text messages — performance of a contract.
• Messages a business sends its own customers through the platform, whether approved one by one or sent automatically on the business's instruction — the business is the controller of these messages and we send them as its processor. Updates about a booking and reminders of a payment owed belong to the service you booked with that business (performance of a contract). Invitations to return rely on the business's legitimate interest in keeping in touch with its existing customers about its own services (Art. 6(1)(f)); every invitation carries a link that stops further invitations from that business, and we honour it at once.
• Marketing e-mails, promotional coupons, review invitations — your consent (Art. 6(1)(a)), withdrawable at any time in account settings.
• Newsletter for people without an account — your consent, confirmed through the link in the confirmation e-mail and withdrawable through the unsubscribe link in every issue.
• Preview pages and contacting detailing businesses about the platform — legitimate interest (Art. 6(1)(f)) in presenting our service to businesses in our sector, using only what the business itself has published and the contact details it gives for business enquiries. You can object at any time: we then delete the preview and everything read from the website, and keep only the business's name, its website address and a note of your request, so that we do not contact the business again.
• Answering messages sent through the contact form — legitimate interest in replying to your enquiry, or steps taken at your request before entering into a contract (Art. 6(1)(b)).
• Support access to a business account — performance of a contract: at a business's request, or to resolve a problem affecting it, an authorised member of our team may sign in to that business's account for up to one hour. Each such session is recorded, is marked on screen for its whole duration, and is excluded from product-usage data.
• Push notifications — your consent, given per device and withdrawable in account settings or your browser.
• Advertising and conversion measurement (Google Ads, Google Analytics) — your consent (Art. 6(1)(a) GDPR), given or refused in the cookie banner and withdrawable at any time.
• Platform security, fraud prevention, dispute records — legitimate interest (Art. 6(1)(f)).
• Product-usage data of business and staff accounts — legitimate interest (Art. 6(1)(f)) in understanding how the dashboard is used so we can improve it, support businesses that are struggling with it, and notice when a business has stopped using it. This is first-party, stays on our own systems, is never shared with advertising or analytics providers, and is not used for automated decisions about you. You can object at any time by writing to us; we then stop collecting it for your account.
• Anonymous, aggregated statistics (e.g. specialists, cities, bookings counters) — legitimate interest.

In Switzerland, processing is carried out on the basis of the FADP; consent-based processing (marketing, push, advertising cookies) works the same way and is withdrawable at any time.

We use first-party storage only for what the platform needs to work and to remember your own choices on this device:

• dp_session (cookie) — marks an active session so protected pages can redirect correctly; expires after 7 days.
• NEXT_LOCALE (cookie) — remembers your language choice; 1 year.
• detailmasters_token (localStorage) — your login token on this device; dp_partner_token is the equivalent for the partner portal.
• dm_cookie_consent (localStorage) — your choice in the cookie banner.
• dm_theme, dm_nav_groups_v1, dm_nav_pinned_v1, dm_agenda_view, dm_bookings_view (localStorage) — light or dark mode, and how you arranged the dashboard menu, calendar and lists.
• dismissed_promo_*, dm_preview_cta_dismissed, dm_platform_review_snoozed, dm_onboarding_seen, dm_tour_live, trial-banner-dismissed (localStorage or sessionStorage) — banners, prompts and guided-tour steps you have closed or completed, so they are not shown again.
• dm_quick_booking_draft_v1, dm_onboarding_draft_v2, dm_claim_failed (localStorage or sessionStorage) — a booking or sign-up form you started and did not finish, kept on this device so you can continue; removed when you finish or discard it. A business that starts a walk-in booking keeps the customer's name and contact details in this draft on its own device until the booking is saved.
• dm_sid, dm_sid_at (sessionStorage; business and staff accounts only) — a random identifier for the current browser tab, used for the product-usage data described in section 3. It is gone when the tab is closed.

None of this storage is used for advertising, and none of it is shared with third parties.

Third-party analytics and advertising cookies are optional, off by default, and load only with your consent:

• Google Analytics 4 — audience and traffic measurement (e.g. _ga, _ga_* identifiers).
• Google Ads — measuring sign-up conversions from our advertising campaigns. We use enhanced conversions, which send a hashed (irreversible) version of your e-mail address to Google to match a conversion to an ad click; Google may set conversion cookies such as _gcl_*.

We use Google Consent Mode v2: until you choose, advertising and analytics storage stay denied and these services receive only limited, cookieless signals. The cookie banner lets you "Accept all" or "Reject optional"; the strictly necessary storage above remains active either way. You can change your choice at any time by clearing this site's cookies and local storage, which makes the banner reappear.

Consent for non-essential storage is required under the EU ePrivacy rules as implemented in each country, under PECR in the United Kingdom, and under the FADP together with the Swiss Telecommunications Act in Switzerland.

We share personal data only as needed to run the platform:

• Businesses you book with — receive your booking details, contact data, vehicle details and service address (for mobile services).
• Stripe Payments Europe — payment processing.
• MongoDB Atlas — database hosting.
• Vercel — web hosting and content delivery.
• Resend — transactional and consented marketing e-mail delivery.
• Twilio — delivery of text messages about bookings. It receives your mobile number and the words of each message.
• Cloudinary — image hosting (business logos, galleries, vehicle photos, and the photos shown on a preview page).
• Anthropic — provider of the AI models we use for three tasks: reading the text of a detailing business's public website to build its preview page and to draft our first message to that business; translating reviews, testimonials and interface text for readers in another language; and reading a customer list a business uploads to import its existing customers, which includes those customers' names and contact details. It receives the text or file to be processed and nothing else — no account, payment or other data beyond what that text or file contains.
• Push delivery services of your browser vendor (Apple, Google, Mozilla) — only if you enable push notifications.
• Google (Google Analytics 4 and Google Ads) — audience measurement and advertising conversion tracking, only if enabled and consented to; enhanced conversions share a hashed, irreversible version of your e-mail address.
• Agents — see business-level data of the businesses they referred; they do not receive customer personal data.

We also disclose data where we are legally required to do so, or to establish, exercise or defend legal claims.

Our infrastructure is operated primarily in Europe, but some processors listed above may process data outside the EEA, the United Kingdom or Switzerland — in particular in the United States.

Where that happens, the transfer is covered by an appropriate safeguard:

• an adequacy decision — including the EU–US Data Privacy Framework and its UK Extension, and the Swiss–US Data Privacy Framework, where the recipient is certified;
• the European Commission's Standard Contractual Clauses for transfers out of the EEA;
• the UK International Data Transfer Agreement, or the UK Addendum to the Standard Contractual Clauses, for transfers out of the United Kingdom;
• the Standard Contractual Clauses as recognised by the Swiss Federal Data Protection and Information Commissioner for transfers out of Switzerland.

You can request a copy of the relevant safeguard by writing to us.

Account data is kept for as long as your account exists. Booking, review and loyalty records are kept while the account is active to provide your history. Payment references are retained as required for accounting and dispute resolution.

Invoicing and accounting records are retained for the statutory period required under applicable Czech law (up to 10 years). Where the law of your own country requires a business to keep records of a transaction for longer, the business you booked with is responsible for that retention in its own systems.

Product-usage data of business and staff accounts is kept for 90 days in detail (individual page views and actions) and for 24 months as daily counts per account; both are included in your data export and deleted with your account.

A preview page that nobody claims is deleted automatically 30 days after it was built, together with our contact record for that business. If the business asks not to be contacted, we delete the preview at once and keep only the business's name, its website address and a note of that request, for as long as needed to honour it. A preview that a business claims becomes part of that business's account.

Newsletter subscriptions are kept until you unsubscribe; we then keep the address marked as unsubscribed so that it is not added again by mistake. Messages sent through the contact form are delivered to our mailbox and kept as ordinary business correspondence.

When you delete your account, personal data is deleted or anonymised, except where retention is legally required.

You have the right of access, rectification, erasure, restriction, data portability, objection to processing based on legitimate interest, and the right to withdraw consent at any time without affecting processing carried out before the withdrawal. These rights exist under the EU GDPR, the UK GDPR and the FADP alike.

Self-service: you can export your data (account settings → "Your data"), update your details, manage marketing consent and push notifications, and delete your account — all in the app. For anything else, write to us; we respond within one month.

Without the app or an account, you can still request deletion: see https://detailmasters.pro/en/account-deletion.

If we hold data about your business because we built a preview page or contacted you, you do not need an account to exercise these rights: delete the preview from the page itself, or write to us and we will delete it and record that the business must not be contacted again.

To stop invitations from a business you have visited, use the unsubscribe link in any of them; for anything else about a business's messages, write to that business or to us.

To stop text messages about your bookings, switch them off in your account settings; without an account, ask the business or write to us. Where a text comes from a phone number, replying STOP also stops them.

We do not use your personal data for automated decision-making that produces legal effects concerning you. Sending a reminder or an invitation automatically on a business's instruction is not such a decision: it only sends a message.

If you believe we have handled your data incorrectly, please contact us first — most issues are resolved quickly. You also have the right to lodge a complaint with the supervisory authority of your country of residence, your place of work, or the place of the alleged infringement:

• Portugal — Comissão Nacional de Proteção de Dados (CNPD), cnpd.pt
• Czech Republic — Úřad pro ochranu osobních údajů (ÚOOÚ), uoou.gov.cz
• Spain — Agencia Española de Protección de Datos (AEPD), aepd.es
• France — Commission Nationale de l'Informatique et des Libertés (CNIL), cnil.fr
• Germany — the data protection authority of your federal state; overview at bfdi.bund.de
• Italy — Garante per la protezione dei dati personali, garanteprivacy.it
• Austria — Datenschutzbehörde (DSB), dsb.gv.at
• Poland — Urząd Ochrony Danych Osobowych (UODO), uodo.gov.pl
• Hungary — Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), naih.hu
• Slovakia — Úrad na ochranu osobných údajov SR, dataprotection.gov.sk
• Sweden — Integritetsskyddsmyndigheten (IMY), imy.se
• United Kingdom — Information Commissioner's Office (ICO), ico.org.uk
• Switzerland — Federal Data Protection and Information Commissioner (FDPIC/EDÖB), edoeb.admin.ch

As we are established in the Czech Republic, ÚOOÚ acts as our lead supervisory authority within the EU — but you may always complain to your own national authority.

Data is encrypted in transit (TLS). Passwords are stored as salted hashes. Access to production systems is restricted and authenticated; staff accounts within a business operate under granular per-section permissions; payment card data never touches our servers. Invoice documents are served only through authenticated or unguessable capability links. Access by our own team to a business account is limited to authorised staff, lasts at most one hour per session, and is recorded.

The platform is not directed at children. You must be at least 18 years old to create an account. We do not knowingly process children's data; if you believe a child has provided us personal data, contact us and we will delete it.

We may update this policy as the platform evolves; material changes will be announced in the app or by e-mail. This policy is maintained in English only, so that a single authoritative text applies across every market we serve. Contact: info@detailmasters.pro.