Privacy Policy

Vihkin operates as a data controller under Regulation (EU) 2016/679 (General Data Protection Regulation / GDPR) and the Bulgarian Personal Data Protection Act (ZZLD). We are committed to protecting your personal data and respecting your privacy rights. The registered legal entity operating Vihkin, including its company registration and VAT numbers, is published on our About page.

For data protection inquiries, contact us at: privacy@vihkin.com

Account data: name, email address, password (hashed), language preference, and currency setting. This data is collected for the legitimate purpose of providing the Service (Art. 6(1)(b) GDPR).

Vehicle data: make, model, year, VIN, registration number, mileage, engine hours, photos, and service history. This data is provided voluntarily by you for the purpose of using the Service.

Usage data: login timestamps, IP addresses, browser type, and pages visited. This data is collected for the legitimate interest of service security and improvement (Art. 6(1)(f) GDPR).

We process your personal data based on: (a) performance of the contract between you and Vihkin (Art. 6(1)(b) GDPR); (b) your consent where explicitly given (Art. 6(1)(a) GDPR); (c) our legitimate interests in operating and improving the Service (Art. 6(1)(f) GDPR); (d) compliance with legal obligations (Art. 6(1)(c) GDPR).

You may withdraw your consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

Your data is stored on servers within the European Union (Supabase infrastructure). We do not transfer personal data outside the EU/EEA unless adequate safeguards are in place as required by Chapter V of the GDPR.

Data is retained for as long as your account is active. Upon account deletion, personal data is permanently erased within 30 days, except where retention is required by law.

Under the GDPR, you have the right to: access your personal data (Art. 15); rectify inaccurate data (Art. 16); erase your data ("right to be forgotten", Art. 17); restrict processing (Art. 18); data portability (Art. 20); object to processing (Art. 21); and not be subject to automated decision-making (Art. 22).

To exercise any of these rights, contact us at privacy@vihkin.com. We will respond within 30 days as required by Art. 12(3) GDPR. You also have the right to lodge a complaint with the Commission for Personal Data Protection of Bulgaria (KZLD) or any other EU supervisory authority.

When you create a service link, limited vehicle data (make, model, year, registration number, mileage, reported problem) is made accessible to the link recipient. This sharing is based on your explicit action and consent. The recipient does not gain access to your account, other vehicles, or financial data.

We implement appropriate technical and organizational measures to protect your data, including: encryption in transit (TLS 1.3), encryption at rest, row-level security policies, secure authentication with hashed passwords, and regular security reviews.

In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours as required by Art. 33 GDPR, and affected data subjects without undue delay where required by Art. 34 GDPR.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 30 days before taking effect. Continued use of the Service after changes constitutes acceptance.