1. Who is responsible for your data
The data controller is the seller of LotRadar:
- Legal name
- [to be filled: sole trader or company name]
- Country of registration
- [to be filled: seller’s country of registration]
- Registration or tax number
- [to be filled: registration or tax number]
- Postal address
- [to be filled: seller’s postal address]
- [to be filled: contact email]
For anything about your data, write through the Support section in the extension or to [to be filled: contact email].
2. What the extension sends
Lot data from the page you open
Lot number, make, model, year, engine size, mileage, title type, damage, current bid, the auction’s estimate and photo URLs. This is public information from a page you already have open. We need it to do the math: without engine size there is no duty calculation, without the damage there is no repair estimate.
Page parsing health
Which fields could be read from the page and which could not, and the version of the extraction profile. Without this we would only learn something broke from a user who thought to write in, which usually means weeks later.
Extension errors
The error message, stack trace and the page address without query parameters. Parameters are dropped on purpose: auction sites put session identifiers in them.
Support requests
What you wrote plus context: page address, lot number, extension and profile versions. The context is shown to you as a plain list before you send, not in fine print.
Activity stamp
Time of last login, browser time zone and language, extension version. This tells us which versions people run and in which regions, so we know who a fix will reach.
3. Your account and workspace
- Login details. Email and password at sign-up. The password is stored only as a one-way hash: it cannot be recovered, only reset.
- Your rates. Freight rates, shop labor rate and other values you enter under “My rates”. They belong to your workspace.
- Saved searches and calculations. Saved searches, selected destinations, calculations, bid ceilings and AI check results for lots you opened.
- Team. On the Team plan: email addresses of invited members and their roles.
- Subscription. Plan, period, payment and expiry dates, remaining AI checks.
4. Payments
Payments are handled by lava.top. Card details are entered on its side and never reach us: we do not see, receive or store them. What comes back is a payment notice with your email address, the amount, the currency and the contract number. We need the email to link the payment to your account: there is no other way for us to know whose payment it is. Your calculations, bids and lots are never sent to lava.top.
How lava.top handles card data is described in its own policy.
5. AI photo check
When you run an AI photo check, our server sends Anthropic (the Claude model API) the URLs of the lot’s photos on the auction site, which the model uses to fetch the images, along with the lot’s year, make, model and the damage declared by the auction. The request contains no personal data: no email, no name, no account identifier.
Anthropic acts as a processor: it processes the request to return a response, under its commercial terms. According to Anthropic’s commercial terms, data sent through the API is not used to train its models by default. More about the check: How the AI Photo Check Works.
6. Telegram alerts
If you connect alerts for saved searches, we store the Telegram chat ID to send them to. Messages with matching lots are sent through the Telegram Bot API and pass through Telegram’s servers under Telegram’s rules. To unlink Telegram and delete the chat ID, message support; it is also deleted together with your account.
7. What we do NOT store
- Your auction password. The extension never asks for it and has no access to it. You work through your own session on the auction site.
- IP address in your user profile. Your region is inferred from the time zone your browser reports. The IP address only appears in an internal change log and is not used to track people.
- Browsing history. The extension runs only on copart.com, copart.ca and iaai.com. This is written into its permissions and enforced by the browser. It does not run on any other site.
- Other tabs. The address of the active tab is read once, when you yourself send a support request.
- Payment data. Cards are processed by the payment provider; card numbers never reach our servers.
8. Who can see your data
Other customers see nothing. Workspaces are isolated at the database level, not just in application code: a query from one workspace technically cannot return another workspace’s rows. Dedicated tests check this on every build.
The service owner and authorized support staff can open account and workspace data, including lots, calculations, bid ceilings, saved searches, your rates and AI check results. We need this to answer support requests, investigate calculation errors, prevent abuse, reconcile payments and keep an eye on service quality.
Every such access is recorded in an audit log: who opened which workspace and when. Your data is never sold or shared with anyone other than the processors in section 9.
9. Where data is stored and who processes it
- Render: hosting for the server that runs the calculations.
- Neon: the database, hosted in the EU (Frankfurt).
- Vercel: hosting for this website and the extension’s update file.
- Anthropic: AI photo checks, as described in section 5.
- lava.top: payment processing, as described in section 4.
- Telegram: alert delivery, if you connect it.
- An error tracking service, if the owner has enabled one. Authorization headers, request bodies and cookies are scrubbed before sending.
- An exchange rate source. We request rates from it; none of your data goes there.
- Classified ad sites in destination countries: we read public listings to estimate market prices. None of your data goes there.
10. This website
This website sets no cookies and uses no analytics, counters or third-party scripts. Like any web server, our host Vercel processes your IP address and technical request details to deliver pages and protect the site from attacks. More: Cookies and Storage.
11. Legal bases
- Performance of the contract: your account, calculations, saved searches, alerts, AI checks you request, linking payments.
- Legitimate interest: error and parsing logs, the activity stamp, abuse prevention, the audit log. We weighed these against your interests and collect the minimum needed to keep the service working.
- Consent, where the law requires it: for example, connecting Telegram alerts, which you do yourself. You can withdraw consent.
- Legal obligation: payment records we must keep for accounting and tax purposes.
12. International transfers
The processors in section 9 operate in several countries, including the United States. The database is hosted in the EU. Where the law requires it, transfers rely on contractual safeguards these companies provide, such as standard contractual clauses.
13. How long we keep data
- Account, rates, saved searches and calculations: while you use the service and until you delete your account.
- Lot data and observations: while you use the service.
- Support requests: until closed and for one year after, so we can come back to the conversation.
- Errors: until investigated and three months after.
- Change log and audit log: three years, for resolving disputes.
- Payment records: as long as accounting and tax law requires.
Deleting a workspace deletes your rates, calculations and support requests. Auction lot data stays: it is public and not about you personally.
14. Your rights
- Access your data and get an export in a machine-readable format.
- Correct inaccurate data.
- Delete your account together with everything related to it.
- Restrict processing, or object to processing based on legitimate interest.
- Withdraw consent where processing relies on it.
- Complain to the data protection authority in your country.
Write through the Support section in the extension or to [to be filled: contact email]: your request goes straight to the service owner. We reply within 30 days.
15. Children
The service is for people aged 18 and over. We do not knowingly collect children’s data.
16. Security
- Workspace isolation at the database level (row-level security), verified by tests.
- Passwords stored only as one-way hashes.
- Data transferred only over encrypted connections.
- An audit log entry for every staff access to customer data.
If we learn of a breach affecting your data, we will tell you.
17. Changes
If what we collect changes, this document changes too and the date at the top is updated. We never expand data collection quietly: material changes are announced in the extension in advance.
18. Contact
The Support section in the extension’s side panel is the fastest way; your message goes straight to the service owner. Email: [to be filled: contact email]. Company details: Contact and Company Details.