Privacy policy

1. Who is responsible for your data

The controller of the personal data processed through the vistomotors.al platform is:

Data is processed in accordance with Law no. 124/2024 "On the protection of personal data" (aligned with the EU GDPR) and, for users in the European Union, with Regulation (EU) 2016/679 (GDPR).

In a rental, the owner and the renter receive each other's data to carry out the rental itself (see section 5). Once they have received it through the platform, each processes it under their own responsibility.

2. The data we process

We process data you give us, data created when you use the platform, and some technical data collected automatically.

• Account: name, email address, phone number (optional), city (optional), profile photo (optional), preferred language, password stored only as a hash (bcrypt), and the time you accepted the terms
• Sign-in with Google: if you choose "Continue with Google", we receive your name and email address from Google — never your Google password
• Business data (dealers only): legal name, public name, address, city, phone, business email, website, VAT number, licence number, logo and description
• Content: listings, photos, descriptions, messages between users, reports you send and the notifications you receive on the platform
• Activity: votes, saved listings, the dealers you follow, saved searches and their alert settings
• Rentals — renters: booking details (dates, pickup place or airport and flight number if you give one, countries allowed for border crossing, your message to the owner), photos of the ID card or passport and the driving licence you upload for a booking, pickup and return records, reviews you write and a record of no-shows
• Rentals — owners: application data (legal name, NIPT, phone, city, address), identity and business documents you upload for verification, bank details for settlements (IBAN, account holder, bank), pickup and return records of the car (photos, mileage, fuel level, notes), damage claims with their photos, and response statistics
• Payments and fees: amounts, fees, commissions, monthly statements and settlements recorded for each rental. At the date of this policy the platform doesn't take card payments: the renter pays the owner at pickup and owners pay Visto's fees by bank transfer. We don't store card numbers. If we start online payments we will update this policy beforehand and name the provider
• Technical data: IP address, browser type (user-agent), session data — used for security, rate limiting and abuse prevention, and present in server logs
• Pseudonymised statistics: views of listings and profiles are recorded with an irreversible fingerprint (salted SHA-256 hash of IP + browser) — not with your full IP
• Communication with us: messages you send us by email or on WhatsApp and the data you give us to resolve a request

3. Data obtained from third-party sources

Some listings on Visto weren't published with us by the seller themselves. They may have been created by our staff from a listing already public elsewhere (for example a sale listing on a classifieds portal or a social network), or from the inventory a partner dealership sends us.

• Categories of data: the seller's name or trading name, the contact number shown in the listing, the city, the vehicle details, the photos and the listing text
• Source: publicly accessible classifieds sites and public profiles, or the dealership itself when it gives us its inventory
• Legal basis: legitimate interest in building a vehicle catalogue that is useful to buyers (Article 7, letter "dh"), or contract when the dealership itself provides the data
• How long we keep it: until the listing is removed, or until you ask us to — whichever comes first

Your rights are the same even without an account. If you find a listing that concerns you and that you didn't publish with us, you have the right to ask for it to be removed, for the data to be corrected, or to take control of the listing yourself. You also have the right to object at any time to the processing of your data for direct marketing, without having to give a reason — and we stop immediately (Article 19, points 2 and 3). Write to us at privacy@vistomotors.al and we handle it within 30 days.

We don't send you advertising on WhatsApp, SMS or email without your prior consent. If you ever get such a message from us, just reply NDAL (or STOP) and your number goes straight onto our opt-out list, free of charge and with no further steps.

4. Purposes and legal basis

• Performance of the contract: creating and managing the account, publishing listings, messages between users, carrying out bookings and rentals (including contact between renter and owner)
• Legitimate interest: account and platform security (protection against attacks, rate limiting, blocking abusers), fraud prevention and verification of owners, content moderation, resolving disputes and damage claims, pseudonymised statistics to improve the platform, technical error monitoring
• Legal obligation: keeping accounting and tax records for rentals and our fees, and responding to lawful requests from the authorities
• Consent: optional features you turn on yourself (device notifications, "remember this device" for two-step verification, promotional messages if you agree to receive them). You can withdraw consent at any time

We don't profile you for advertising and we don't take fully automated decisions with legal effects on you.

Some rental rules run automatically: the ranking of rental listings is affected by the owner's response rate and time; a "Verified Visto Host" badge appears after a number of completed rentals with good reviews; an owner's listings are paused automatically when Visto's fees stay unpaid beyond the deadline; no-shows are counted and after the second one the renter is reported to our staff, who decide on any further steps. You can ask for review by a person by writing to us.

5. Who we share data with

We don't sell your personal data. We share it only in the following cases:

• Other users: the content you publish and, for a rental, the other party. The owner receives the renter's name and booking details; the renter's contacts (phone, email) and documents are visible to the owner only once the booking is confirmed. Before confirmation, phone numbers and emails in messages are masked
• Brevo (Sendinblue SAS): sending service emails (account verification, password reset, two-step sign-in codes, security notices and booking notices)
• Cloudflare R2: storing the photos of listings and profiles, and — in private, non-public storage — identity documents and pickup and return photos
• Cloudflare Turnstile: bot protection on some forms, when enabled
• Sentry: technical monitoring of server errors (reports may contain technical request data)
• Google: only if you choose to sign in with Google
• Hosting and database providers: Vercel (the website), Railway (the platform's server and temporary Redis memory) and Supabase (the database)
• Browser push services (e.g. Google, Apple, Mozilla): only if you turn on device notifications
• WhatsApp (Meta): only when WhatsApp messages are enabled, e.g. booking alerts to owners; they are limited to the renter's first name and the booking details
• NHTSA public database (USA): where this feature is enabled, the VIN you check is sent for decoding

We use the providers above as processors, under data processing terms.

The content you publish yourself (listings, public name, profile photo, business profile for dealers, phone number if you show it in a listing) is publicly visible — that is the nature of an online marketplace.

We may give data to the authorities when the law requires it, and to professional advisers (e.g. accountants, lawyers) when necessary for our legal obligations or to protect our rights.

6. Transfers outside Albania

Some of the providers above process data outside Albania and the European Economic Area (e.g. in the USA). In those cases the transfer relies on the safeguards recognised by the applicable law, such as adequacy decisions, the Standard Contractual Clauses or the provider's EU–US certification framework.

7. How long we keep data

We keep data only as long as is needed for the purposes above or as the law requires. The main periods:

Backups kept by our providers may hold data for a limited time after deletion, until the copy is replaced under the provider's cycle. We therefore don't guarantee immediate deletion from backups.

8. Deleting your account

You can delete your account from Profile → Delete account. For security the current password is required (if you sign in only with Google, first set a password with "Forgot your password?"). From the moment of the request the account is closed and you can no longer sign in; the data is then deleted in the background — usually within minutes and, in any case, within 30 days.

Deleted: your listings (except rental listings with bookings, see below), messages sent and received (also on the other party's side of the conversation), votes, saved listings, saved searches, follows, blocks, push subscriptions, notifications, the business profile, the linked Google identity, trusted devices, the owner's identity documents and bank details, and your name, email, phone, city and profile photo.

Kept: bookings, payment and fee records, commission statements, pickup and return records, damage claims and reviews connected to a rental, because the law requires accounting records to be kept and because the other party to the rental has a legitimate interest in them (e.g. in a dispute). They are linked to an anonymised account, but may contain text you wrote yourself (e.g. a message in a booking or a review comment). Rental listings that have had bookings are archived (taken off the site) instead of deleted.

Renters' documents are deleted on the schedule in section 7, not immediately with the account. For backups see section 7 as well.

9. Your rights and how to use them

You have the following rights over your data:

• Access & portability: download a copy of your main account data in JSON format from Profile → Download your data. The file includes the account, listings, messages, votes, saved listings, follows, the business profile and the owner application (without the documents themselves). It doesn't include bookings, rental records and damage claims — for those write to us at privacy@vistomotors.al
• Rectification: update your name, phone, city and email directly from your profile
• Erasure: see section 8
• Restriction and objection: you can ask for processing to be restricted or object to processing based on legitimate interest
• Withdrawing consent: for consent-based features, at any time, without affecting the lawfulness of earlier processing. You turn off push notifications in your browser settings; you stop promotional messages by replying NDAL or STOP
• Review by a person: for the automatic rental rules (section 4)

For any request you can't carry out yourself on the platform, write to us at privacy@vistomotors.al. We may ask you to prove your identity. We reply within 30 days.

If you think your rights have been infringed, you have the right to complain to the Commissioner for the Right to Information and Personal Data Protection (idp.al). If you are in the EU/EEA, you can also turn to the supervisory authority of your country.

10. Cookies and browser storage

We only use cookies that are strictly necessary for the platform to work. We don't use third-party advertising, tracking or analytics cookies — which is why we don't show you a cookie consent banner.

The session cookies are httpOnly (unreadable by scripts) and are only sent over a secure connection (HTTPS) in production. The language cookie stores only the language code (e.g. "sq").

Besides cookies, the site keeps some data only in your own browser. It isn't sent to us and you can delete it in your browser settings:

When enabled, the Cloudflare Turnstile bot check is loaded from challenges.cloudflare.com on some forms; Cloudflare may process your IP address and browser data to carry out the check.

11. Security

We apply appropriate technical and organisational measures: password hashing with bcrypt, HTTPS with HSTS, a strict content security policy (CSP), optional two-step verification (2FA), limits on sign-in attempts, restricted access to data, private storage for identity documents, IBANs encrypted at rest and audit logging of administrative actions.

No system is completely secure, so we can't guarantee absolute security. In the event of a security breach that puts your rights at risk, we notify the supervisory authority and, where required, you too, within the legal deadlines.

12. Children

The platform isn't directed at minors and we don't knowingly collect data from people without full legal capacity. If you think a minor has given us data, write to us and we will look into it promptly.

13. Changes to this policy

We may update this policy from time to time. For material changes we notify you by email or on the platform at least 15 days before they take effect, so you have time to review them. The date of the latest update is at the top of the page.

Main changes in the version of 30 Oct 2026: we added the data and retention periods for rentals, step-by-step account deletion, browser storage and the automatic rental rules.