Privacy Policy

This English translation is provided for convenience only. The German version is legally binding. German version

As of: 10 November 2026

This policy describes which personal data is processed by the online service dealerfame, for what purpose, on what legal basis and to whom it is disclosed. It applies to this website, the dealer dashboard and the embedding of dealerfame on car dealers' websites.

1. Controller

No data protection officer has been appointed because there is no legal obligation to do so. Please send data protection enquiries to the email address above.

Where dealerfame processes content on behalf of a car dealership (in particular vehicle data and photos, the dealership's contact details, posts and the embedding on its website), the dealership is the controller and dealerfame is the processor within the meaning of Art. 28 GDPR.

2. Visiting this website

When you access the site, your browser technically necessarily transmits your IP address and customary connection data (e.g. the requested address, browser identifier). The application does not write access logs containing IP addresses. For requests for login links, the IP address is counted briefly in working memory (at most 20 requests per connection per hour) in order to prevent abuse; it is not stored permanently for this purpose. In the event of an error, the server's error logs may contain an email address (for example if an email could not be delivered); they are rotated once they reach a size of 5 MB, and at most three older versions are retained.

Fonts, scripts and images are loaded from our own server. No analytics, advertising or tracking services are used.

The legal basis is our legitimate interest in secure and functional operation (Art. 6(1)(f) GDPR).

3. Hosting

The website, database and files are located on a server of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany (data centre in Falkenstein/Vogtland, Germany). Hetzner processes the data as a processor (Art. 6(1)(b) and (f) GDPR).

4. Account and login via email link

Your email address is sufficient for registration and login; there is no password. You receive a login link that is valid for 30 minutes. Only a verification value (hash) of the link or session is stored in the database, not the link itself. A session remains on the device used for up to one year; it is deleted when you log out.

In the account, we process the email addresses of the owner and of invited employees, their role (owner/employee) and the details about the dealership that you enter yourself (e.g. company name, address, telephone, email, WhatsApp, website, logo, brand colour).

Trial sign-up and callback. When you start the free trial, we ask for your first name, last name, email address, the name of the dealership, the approximate size of your vehicle stock and – optionally – your phone number (with country code) and website. By ticking “Yes, call me” you ask us to give you one short call to help you get started; it only applies if you enter a phone number. If you leave it unticked, we will not call you. We use this information to set up your account (name, website for logo and colours), to know who has signed up and – only if ticked – for that call. We also store the time and language of the sign-up, your callback choice and our sales team’s notes and follow-up dates (our own customer management in dealerfame, servers in Germany). Our sales team is notified of a new sign-up via Telegram (dealership, name, phone number, website, stock, callback yes/no); Telegram also processes messages outside the EU. The legal basis is taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and, for the call, your consent given by ticking the box (Art. 6(1)(a) GDPR). You can withdraw it at any time with a short email; we will note this and not call.

To protect the referral programme against abuse (self-referral), when a login link is redeemed we store the IP address together with the email address; entries older than 90 days are deleted automatically.

The dealership's address is transmitted to the Nominatim service of OpenStreetMap in order to determine the location (geographic coordinates) for the territorial protection of the templates.

The legal basis is the performance of the contract or pre-contractual measures (Art. 6(1)(b) GDPR); for the prevention of abuse, our legitimate interest (Art. 6(1)(f) GDPR).

Sending emails

Login links and invitations are sent in encrypted form (STARTTLS) via the email server of our provider ALL-INKL.COM (Neue Medien Münnich, Germany). The recipient address and the content of the email are processed in the process.

5. Cookies

dealerfame uses only technically necessary cookies (HttpOnly, and on secured connections only via HTTPS), no advertising or analytics cookies:

• df_s – login session, lifetime of up to 1 year.
• df_m – which dealership is selected in the dashboard, lifetime of up to 1 year.
• df_empf – only after a referral link has been opened: code of the referring dealership, so that the referral can be attributed at registration, lifetime of 60 days.
• df_team – only for the operator (internal administration), lifetime of 8 hours.

The legal basis is Section 165(3) of the Austrian Telecommunications Act 2021 (Telekommunikationsgesetz 2021; strictly necessary cookies) in conjunction with Art. 6(1)(b) or (f) GDPR.

6. Payments via Stripe

Subscriptions and invoices are handled via Stripe (Stripe Payments Europe, Limited, Ireland). We transmit to Stripe the email address and name of the dealership as well as the services booked. You enter payment data (e.g. card number) directly with Stripe; dealerfame neither receives nor stores it. Stripe may also process data in third countries (such as the USA); the basis for this is Stripe's safeguards (e.g. EU Standard Contractual Clauses). The legal basis is performance of the contract (Art. 6(1)(b) GDPR) and statutory retention obligations (Art. 6(1)(c) GDPR).

7. Vehicle data, photos and posts

Vehicle data and photos come from your uploads or from the sources you connect (e.g. your public listings or your dealer page). From these, dealerfame creates images, posts, stories and reels. End-customer data is not required for this; please do not upload photos showing identifiable persons.

AI services

For individual functions, vehicle photos are transmitted to AI services, in each case only the photo and the vehicle details needed for the task, no account data:

• Anthropic (Claude), Anthropic PBC, USA: checking whether a photo is a genuine vehicle photo or a placeholder, and classifying the photos (viewing angle, interior) for the 360° view.
• kie.ai: generation of AI-edited vehicle images (digitally added surroundings) and of the AI-assisted 360° rotation, to the extent these functions are used. Vehicle photos and a text description of the desired surroundings (where applicable with the brand colour) are transmitted; the dealership's logo is only added on our own server. AI-supplemented images are labelled as such.

For providers outside the EU, the transfer takes place on the basis of the respective provider's safeguards (adequacy decision or EU Standard Contractual Clauses). The legal basis is performance of the contract (Art. 6(1)(b) GDPR).

Publishing on social networks

Only if you connect your own channels (e.g. Instagram, Facebook, TikTok) in the dashboard are approved posts handed over to these channels via the service Upload-Post (upload-post.com) or, for existing connections, Blotato (blotato.com). The post text, image or video and the identifier of your channel are transmitted. Without connected channels, you download the posts yourself. The social networks' own privacy notices apply to the processing within the social networks.

8. Embedding on car dealers' websites

Dealerships can display their inventory on their website using a script (/w.js) or an embedded frame. In doing so, the visitor's browser loads data and images from our server; for technical reasons the IP address is transmitted. No cookies are set and no IP addresses are stored. Only the number of times the list or a vehicle was viewed per day is counted anonymously (dealership, vehicle, day, type, count), so that the dealership can see these figures in the dashboard.

Enquiries to dealerships (enquiry inbox): If a prospective buyer sends an enquiry via the “Send enquiry” button of the embed or a form on a dealership's website, dealerfame processes the details (name, phone, email, message, selected vehicle, optional details about their own car and up to four photos) on behalf of the dealership as a processor under Art. 28 GDPR. The dealership is the controller. dealerfame stores the enquiry in the dealership's account, emails it to the dealership (sent via ALL-INKL from anfragen@dealerfame.com) and, if requested, sends a short confirmation to the prospective buyer. Photos are re-saved without metadata and are not publicly accessible. IP addresses are only counted as a salted hash to limit abuse (max. 2 days). Enquiries are deleted automatically after 12 months. Data processing agreement with dealerships: /avv (German).

Calls, emails and WhatsApp messages via the contact buttons go directly to the dealership; dealerfame does not receive them. The respective dealership is responsible for its website itself.

9. Previews for dealerships (demo)

To show dealerships what dealerfame does, the operator can create a private preview from publicly accessible listings or a dealership's website (company name, logo, colours, up to five vehicles with photos). The preview is accessible only via a random, unlinked key, is not indexed and is automatically deleted in full after 14 days. The legal basis is our legitimate interest in presenting the service (Art. 6(1)(f) GDPR). You can request earlier deletion at any time by email.

10. Storage period and deletion

• Enquiries to dealerships including photos: 12 months, then deleted automatically.
• Login links: valid for 30 minutes.
• Sessions: up to 1 year or until logout.
• IP addresses for protecting the referral programme: 90 days.
• Demo previews: 14 days.
• Account: the owner can delete the account in the dashboard. The dealership, vehicles, photos, posts and access credentials are then removed immediately and any running subscription is cancelled. Payment records are retained because of the statutory retention obligation (in Austria generally seven years).

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). To exercise them, write to info@builtbygregor.com.

If you believe that the processing of your data violates data protection law, you can lodge a complaint with the supervisory authority. In Austria this is the Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

12. Changes

We will amend this policy if the service or the legal situation changes. The version published here at the relevant time applies.

Home · Legal Notice