Effective: June 10, 2025 · Version 1.0
Vroom(“we”, “us”, “our”) is the data controller for personal data processed through this service, available at https://thevroomcar.com and the Vroom mobile application.
Contact us about privacy at: privacy@thevroomcar.com
We collect only what is necessary to provide the service. The table below lists the categories of data, the purpose, and the legal basis under GDPR Article 6.
| Data | Purpose | Legal basis |
|---|---|---|
| Name (optional), email address, hashed password | Account creation and authentication | Contract (Art. 6(1)(b)) |
| Vehicle details (make, model, year, nickname, plate) | Core service — vehicle diary | Contract (Art. 6(1)(b)) |
| Expense records (amount, date, category, odometer) | Core service — expense tracking | Contract (Art. 6(1)(b)) |
| Preferences (currency, distance unit, fuel unit) | Personalising the display of your data | Contract (Art. 6(1)(b)) |
| Consent timestamp and version (gdpr_consent_at, gdpr_consent_version) | Compliance audit record | Legal obligation (Art. 6(1)(c)) |
We do not collect payment card details, government identifiers, or sensitive categories of personal data (Art. 9 GDPR).
We use Vercel Analytics and Vercel Speed Insights to understand aggregate usage patterns. These tools are privacy-friendly by design: they do not use cookies, do not track users across sites, and do not store personal identifiers. Data is derived from hashed request metadata and is retained by Vercel per their own privacy policy.
We use a single session cookie (accessToken) to authenticate you after login. This is strictly necessary for the service to function and does not require a cookie consent banner under ePrivacy rules.
Your data is retained for as long as your account is active. If you delete your account, all associated data (vehicles, expenses, session tokens) is permanently and immediately erased from our systems. We do not maintain soft-deleted records or backups past our database provider's standard backup window (approximately 7 days).
Consent audit records are retained for 5 years from the date of collection to meet our legal obligations, even after account deletion.
We use the following sub-processors to deliver the service:
We do not sell, rent, or trade your personal data to third parties for marketing purposes.
If you are in the EU or EEA, you have the following rights:
Passwords are stored as bcrypt hashes and are never stored in plaintext. All connections use TLS. Authentication tokens are short-lived (7-day JWTs). Email verification tokens are single-use and SHA-256 hashed before storage.
If we make material changes, we will notify you by email or by a prominent notice in the application before the change takes effect. The current version and effective date are shown at the top of this page.
For any privacy-related requests or questions, email us at privacy@thevroomcar.com. We aim to respond within 30 days as required by GDPR Art. 12.