Privacy Policy

The data controller is Encontra Carros (encontracarros.pt), operated by Unruly Tomorrow, Lda, NIF 519 700 228. For any question about your data, write to [email protected].

The terms of use and purchase are in the Terms and conditions.

Account. You sign in with your Google account, with a code sent to your email or with email and password. From Google we receive your name, email and profile photo, never that account’s password. If you choose a password on Encontra Carros, we store it encrypted (we cannot read it). We also store the IP address and browser of each session, for security.

Purchases and subscriptions. When you buy a report, a highlight or a subscription, we store the product, the date, the amount, the status (paid, refunded, cancelled) and what the purchase refers to: the listing, the car details you entered for the sale report or the dealership. Card details stay with Creem only (see Sharing).

Conversations with the Market Agent. We store the messages you exchange with the agent in your account, so you can go back to your conversations, so we can count the month’s questions and to improve the answers.

Agent memory. The agent keeps a short summary of what you are looking for (for example budget, area and type of car), so you don’t have to repeat it. You can see that summary, delete it or turn the memory off at any time, in the agent and in Settings. Turning it off deletes what was stored.

Saved searches and alerts. We store the filters of the searches you save and the email preferences for each one.

Listings you publish. The car details, the photos and the contact phone number you enter. See Private sellers’ listings below.

Dealers. If you claim or create a dealer’s page, we store the dealership details you enter (name, contact details, address, opening hours, logo, description) and who claimed it.

Clicks to other sites. When you open a listing on another site, the carVertical page or an advertiser’s banner, we record the destination (for carVertical, the place on our site where the link was), the time and a random code for the browser session, to count unique clicks. We do not record your name, your account or your IP in that record.

Technical and usage data. Pages visited, device, browser and where the visit came from, through cookies and analytics tools (see Cookies).

Email left in the footer.If you leave your email in the footer without creating an account, we store it to send you "O mercado esta semana" (the market this week) once it opens to people without an account. For now the summary only goes to account holders. To have the email deleted, write to [email protected].

Encontra Carros brings together car listings published on other Portuguese websites. Those listings may contain sellers’ data (name of the dealership or private seller, phone number, town), the number plate and other details of the car. We also use technical vehicle data from public sources.

With each dealership’s listings we create a public page with business data: name, town, cars for sale, prices and aggregated numbers (for example, how many cars it has and how long they have been for sale). We do not publish private sellers’ data on those pages.

Legal basis: legitimate interest in giving buyers a complete view of the market. If you are a seller and want your data removed, write to [email protected].

We may write once to a dealership, at the general business address the dealership itself publishes on its website (for example, geral@ or vendas@), to introduce Verified Dealer. We do not write to personal addresses. Legal basis: legitimate interest. Each email says where the address came from and how to stop receiving emails, and anyone who asks to opt out never receives anything again.

• Providing the service you ask for (performance of a contract): keeping your account, answering in the Market Agent, saving searches and sending the alerts you turned on, publishing your listings, delivering reports and highlights and managing your dealership’s page.
• Charging and meeting legal obligations (legal obligation): keeping records of purchases, refunds and responses to complaints.
• Sending "O mercado esta semana" (legitimate interest): a weekly email with price drops and the best deals, only for account holders. It is on by default and we tell you so when you create your account. Turn it off with one click at the end of any email or in Settings.
• Moderating and protecting (legitimate interest): reviewing listings before they become visible, preventing fraud and abuse, and checking reports about dealers.
• Measuring and improving the site (consent): understanding which pages are useful and fixing errors. The analytics tools only load after you accept cookies.
• Showing advertising: an advertiser’s banner at the bottom of some pages. The banner uses no cookies and none of your data.

• Account and purchase emails: purchase confirmations, notices about your listing or dealership. They cannot be turned off, as they are needed for the service.
• Saved search alerts: only for the searches where you turned the alert on.
• O mercado esta semana (the market this week): on Thursdays, on by default for account holders.

Every email that is not an account email has a link to stop receiving it with one click, without signing in.

When you publish a listing, the car details, the photos and the contact phone number you enter are visible to any visitor, so that buyers can contact you.

Photos are compressed and their metadata (such as GPS location) is removed before we store them, on servers in the European Union. Our team reviews each listing before publishing it and, in that review, sees the listing’s details and the account that created it.

A listing stays online for as long as the paid highlight lasts (30 days) and becomes inactive when it ends, until you renew it. When you delete a listing, its photos are deleted from our servers.

We do not sell personal data. We use these providers, who process data on our behalf:

• Creem (Armitage Labs OÜ, Estonia): payments. Creem is the reseller (merchant of record): it charges you, issues the invoice and handles the VAT. It receives your email, name, country and payment details, under its own privacy policy.
• Google: sign-in and analytics (Google Analytics).
• Microsoft Clarity: usage analytics and anonymous session recording to improve the site.
• OpenRouter and the artificial intelligence model providers it gives access to: they receive the messages you send to the Market Agent, only to generate the answers. Don’t share sensitive data with the agent.
• Resend: sending emails, including the codes and links to sign in to your account.
• Cloudflare: delivering the site and storing listing photos, in the European Union.
• Telegram: internal notices to the team (for example, a listing waiting for review) and our public channel, based on public listings.
• carVertical: if you open a car’s history on carVertical, you start using their site, which stores a cookie to know you came from ours. In the link we send the listing’s number plate or VIN, when we have them, and the place on our site where the link was, never your data.

Some of these providers are outside the European Union (for example, in the USA). In those cases, the transfer is made with the safeguards provided for in the GDPR (RGPD in Portuguese), such as the European Commission’s standard contractual clauses.

We share with dealers aggregated, anonymous statistics on the use of the site (for example, whether there is interest in their cars, from searches, favourites and alerts), which never identify anyone.

We may have to hand data over to the authorities when the law requires it.

On your first visit we ask whether you accept analytics cookies. Without your answer, or if you reject them, we only use the essential ones.

We use two types of cookies and browser storage:

• Essential: keeping you signed in, saving your cookie choice, remembering a purchase you started before signing in and telling visitors apart from bots that overload the site (a cookie with none of your data). The site does not work without them.
• Analytics (only if you accept): Google Analytics and Microsoft Clarity cookies, a random session code to count unique clicks and, for 30 days, the campaign you came from (for example, one of our emails). If you don’t accept, Google Analytics still receives page visits, without cookies and without identifying you, so we can count how many people visit the site.

You can change your choice whenever you like: review your cookie choice. You can also delete or block cookies in your browser settings. Blocking the essential ones prevents you from signing in.

• Account, conversations with the agent, memory, saved searches and favourites: for as long as the account exists.
• Purchase records: for the period required by tax and consumer law, even after you delete your account.
• Sessions: expire after 30 days without use.
• Listing photos: deleted when the listing is deleted or ends.
• Clicks to other sites: kept without personal data, for statistics.
• Technical data (IP, browser): deleted or anonymised after a short time.

Under the General Data Protection Regulation (GDPR) you can ask to access your data, correct it, delete it, restrict or object to its processing and receive it in a format you can take to another service. When processing is based on consent, you can withdraw it at any time.

You can delete your account in Settings. That deletes the account, the conversations, the memory, the saved searches, the favourites and your listings with their photos, and cancels your subscriptions. Purchase records are kept (see Retention). For other requests, write to [email protected]. We reply within one month.

If you think we have not handled your data properly, you can complain to the Comissão Nacional de Proteção de Dados, the Portuguese data protection authority (cnpd.pt).

When we change this policy, we update the date at the top. If the change is significant, we tell account holders by email.