PRIVACY POLICY - MOTORO.ch

Version 2.0 - October 2026

This policy explains which personal data Motoro processes when you use the motoro.ch website (including the blog) and the Motoro apps for iPhone and Android: which data, why, who it is shared with, how long it is kept and how to exercise your rights.

It is based on the Swiss Federal Act on Data Protection (FADP, SR 235.1), in its revised version in force since 1 September 2023 (often called the new FADP). Where the European Union's General Data Protection Regulation (GDPR) applies to your situation, for example if you use Motoro from an EU country, this policy also takes it into account.

1. DATA CONTROLLER

• Motoro.ch, sole proprietorship
• Rte du Clos 18, 1913 Saillon, Switzerland
• Business ID (UID): CHE-380.830.174
• Email: info@motoro.ch

For any question about your data, write to info@motoro.ch. Requests are handled directly by the person responsible for Motoro.

2. DATA WE PROCESS

2.1 Your account

• Email address and password. The password is only stored in irreversibly encrypted form (hashed): nobody at Motoro can read it.
• If you sign in with Google or Apple: the identifier of your Google or Apple account, your email address (with Apple, this may be a relay address) and your name if the service passes it on.
• Date the account was created and date of last sign-in.
• If you sign in to the website with a code shown in the app: that temporary code.

2.2 Your profile

• Username and preferred language and, if you provide them: full name, profile photo, town and phone number.
• The following are public: username, full name, profile photo, town, preferred language, registration date and verified professional status.

2.3 Professional sellers

• If you apply for verified professional status: company name, address, phone and email of the company, commercial register or UID number, VAT number, description, and a photo of a supporting document (for example an extract from the commercial register).

2.4 Your listings

• Category, make, model, features, price, description, photos and any video.
• Location of the listing, chosen from a list of addresses suggested by Google, with the canton and the geographic coordinates of that address.
• Phone number, if you add one to the listing.
• An active listing is public: every visitor can see its content, including the phone number and location.
• Listing statistics: number of views, clicks and additions to favourites. So that the same person is not counted twice, each view is recorded with the date and, if the visitor is signed in, their account identifier.
• If a visitor asks for a description to be translated, the text is sent to an automatic translation service (see section 5), and the translation is then kept for later visitors.

2.5 Messaging

• The messages exchanged, photos sent, the date sent and the read or unread status.
• To let you know about a new message, we create a notification in the app (sender's name and the first 100 characters of the message) and, unless you have turned it off, an email (sender's name and the first 200 characters of the message). The push notification on your phone only contains the sender's name, not the content of the message.
• Messages are automatically checked for scams when they are sent (see section 8).

2.6 Favourites, reports, blocking and requests

• The listings you add to your favourites.
• The reports you make (listing or user, reason and details) and reports that concern you.
• The users you block.
• Messages sent through the contact form (name, email, subject, message) and events you suggest for the calendar.

2.7 Subscriptions and purchases

• Subscriptions bought in the app are charged by Apple (App Store) or Google (Google Play). Motoro receives from them: the product bought, the purchase, renewal and expiry dates, the status, transaction identifiers, the store country, the price and the currency.
• Subscriptions bought on the website are charged by Stripe. Motoro receives the subscription status and payment identifiers.
• Motoro never receives your card details.

2.8 Push notifications

• Your device's notification token, its operating system (iOS or Android), the app version and your notification preferences.

2.9 Technical data and audience measurement

• Web server logs: IP address, date and time, page requested, browser.
• Error logs from the website and the app: error message, page or screen concerned, browser or app version and, if you are signed in, your account identifier.
• Log of important actions (for example a listing published successfully or not), so that errors can be fixed.
• Website visit counter: for each new visit, we record the date, the browser used and the referring page.
• On the website and the blog: audience statistics with Umami (see section 11).
• In the app, according to your consent choices (see section 11.2): Google Analytics for Firebase and an activity log linked to your account (registration method, app opening, session length, app version, screens viewed, searches, listings viewed).
• Motoro does not access your device's GPS location. The only location processed is the one you enter in a listing or in your profile.

3. WHY WE USE YOUR DATA

• To provide the service: account, publishing and searching listings, messaging, favourites, notifications, translation of descriptions.
• To protect users: moderation, automatic scam detection, limits for new accounts, handling of reports, blocking of abusive accounts.
• To manage subscriptions: activation, renewal, expiry and listing limits.
• To write to you: service emails (welcome, listing published, periodic reminder about your listings, new messages, subscription, replies to your requests). Motoro does not send a newsletter.
• To measure use of the service and fix errors.
• To show advertising in the free app.
• To meet our legal obligations and answer requests from authorities.

4. LEGAL BASES

Motoro processes your data in line with the principles of the FADP: lawfulness, good faith, proportionality, recognisable purpose, accuracy and security. We ask for your consent where the law requires it.

Where the GDPR applies, our legal bases are:

• Performance of a contract (Art. 6(1)(b) GDPR): account, listings, messaging, subscriptions, service emails.
• Legitimate interest (Art. 6(1)(f) GDPR): security, fight against scams and moderation, server and error logs, cookieless visit statistics, translation of descriptions, non-personalised advertising.
• Consent (Art. 6(1)(a) GDPR): personalised advertising and ad tracking, Google Analytics for Firebase, the app's activity log, push notifications (permission requested by your phone). You can withdraw your consent at any time (see section 9).
• Legal obligation (Art. 6(1)(c) GDPR): replies to requests from authorities.

5. WHO HAS ACCESS TO YOUR DATA

5.1 Other users and the public

• Active listings and the public profile information (section 2.2) are visible to everyone: on the website, in the app and in search engines.
• Your messages are only visible to the person you are writing to, and to Motoro when this is needed for moderation, security or maintenance (sections 5.2 and 8).
• Within Motoro, only the owner of the business has access to data, to the extent needed for support, moderation, maintenance and security.

5.2 Our service providers

These providers process data on behalf of Motoro, each for the task stated:

• Supabase Inc. (United States): database, accounts and sign-in, storage of photos and files, server functions. The servers used are located in the United States (Ohio).
• Infomaniak Network SA (Switzerland): hosting of the website, the blog, the image server and the Umami statistics tool; server logs; backups; sending of emails; automatic translation of listing descriptions.
• Google (Google Ireland Limited and Google LLC, United States): push notifications (Firebase Cloud Messaging), app statistics with your consent (Google Analytics for Firebase), advertising in the app (Google AdMob), address entry (Google Places and Google Maps), sign-in with Google, purchases in the Android app (Google Play) and YouTube videos embedded on the website.
• Apple (Apple Distribution International Ltd, Ireland, and Apple Inc., United States): purchases in the iPhone app (App Store), sign-in with Apple and delivery of push notifications on iPhone.
• Stripe (Stripe Payments Europe Ltd, Ireland, and Stripe Inc., United States): payment of subscriptions bought on the website.
• Anthropic PBC (United States): translation of listing descriptions, only as a fallback when Infomaniak's translation service does not respond; and Claude, a technical assistance tool used to maintain the service, which may access data in the database during this work.

Apple and Google also process data as independent controllers when you download the app or pay for a subscription: their own privacy policies apply.

5.3 Authorities

We only disclose data to authorities when the law requires us to, for example on the order of a court or the police.

5.4 No sale of data

Motoro does not sell your personal data.

6. DISCLOSURE OF DATA ABROAD

Your data is processed in Switzerland (Infomaniak) and abroad:

• United States: Supabase (most of the data of your account, listings and messages), Google, Apple, Stripe and Anthropic (fallback translation and maintenance assistance tool).
• Ireland (European Union): Google, Apple and Stripe, through their European companies.

The Swiss Federal Council recognises that the states of the European Union provide an adequate level of protection. For the United States, disclosure relies, depending on the provider, on its certification under the Swiss-U.S. Data Privacy Framework, recognised by the Federal Council since 15 September 2024, or on the European Commission's standard contractual clauses, recognised by the Federal Data Protection and Information Commissioner (FDPIC) and adapted to Swiss law. You can obtain information about these safeguards by writing to info@motoro.ch.

7. RETENTION PERIODS

7.1 As long as your account exists

• Account, profile, favourites, preferences, notification tokens and subscription data: as long as the account exists.
• Listings: until you delete them. After a listing is deleted, an internal copy is kept for 10 days to deal with any disputes or abuse. Photos and videos are erased from storage about one hour after deletion; the reduced versions cached by our image server may remain accessible through their link for up to 30 days.
• Messages: as long as the conversation exists. Either participant can delete a conversation: it is then deleted for both participants. Conversations left without any message are deleted after 7 days.
• Reports: deleted together with the account of the person who made them and, for a report about a user, with the reported account.
• Contact form messages and event suggestions: deleted together with your account.
• Website sign-in codes: deleted as soon as they have been used or have expired.

7.2 Deleting your account

You can delete your account yourself, in the app or on the website (see section 9). Deletion is immediate and final: your account, profile, listings, the messages you sent, your favourites, preferences, notification tokens, notifications, your subscription data held by Motoro, your reports, your contact requests and the activity log linked to your account are deleted. Photos and videos are erased from storage about one hour later.

What does not disappear immediately:

• The internal copy of deleted listings (10 days) and cached images (up to 30 days).
• Backups: 10 days for those of our server; the database backups made by Supabase are replaced over time.
• Error logs (7 days at most) and action logs (30 days at most): they remain until they are automatically deleted, without any link to your account.
• Listing views you made while signed in: kept without your identifier, for 12 months at most.
• Messages the other participant sent you remain in their messaging.
• The history of emails sent and the sign-in log of the authentication service (90 days at most), and the purchase logs sent by Apple and Google (12 months at most).

Deleting your account does not cancel a subscription taken out in the App Store or on Google Play: cancel it in your Apple or Google account, otherwise you will still be charged. Apple, Google and Stripe keep their own billing data according to their own rules.

7.3 Logs and statistics

• Web server logs: 14 days.
• Error logs: 7 days.
• Log of important actions: 30 days.
• Visit counter: 90 days for visit starts, 7 days for other events.
• Backups of our server: 10 days.
• Google Analytics for Firebase: according to the retention period set in Google Analytics.

7.4 Other logs

These periods are enforced by a daily automatic deletion:

• History of emails sent (recipient address, subject, date): 90 days.
• Sign-in log of the authentication service (email address, type of action, date): 90 days.
• Notifications shown in the app: 12 months, and deleted together with your account.
• History of listing views: 12 months.
• The app's activity log: 12 months, and deleted together with your account.
• Technical logs and archives of purchases sent by Apple and Google: 12 months.
• Contact form messages sent without an account: 12 months.
• Translations of listing descriptions: deleted at the latest the day after the listing is deleted.

The website's Umami statistics contain neither IP addresses nor account identifiers; no automatic deletion is set up for them.

You can ask for your data to be erased before these periods end by writing to info@motoro.ch.

8. MODERATION AND AUTOMATED DECISIONS

To protect users against scams, messages are checked automatically when they are sent. An account can be suspended automatically, without human involvement, in particular in the following cases:

• a seller asks for payment with prepaid vouchers;
• the same message containing an email address or phone number is sent in several conversations within a short time;
• the account is reported by several different users within a few days.

The suspension blocks sign-in and pauses the account's listings; the message that triggered it is not delivered. An administrator is notified immediately and decides whether to confirm or lift the suspension. In addition, an account created less than 7 days ago can only start a limited number of new conversations per day.

If such a decision concerns you, you can state your point of view and ask for it to be reviewed by a person by writing to info@motoro.ch (Art. 21 FADP; Art. 22 GDPR).

9. YOUR RIGHTS

9.1 Access to and copy of your data

• You can ask which data we process about you and obtain a copy (Art. 25 FADP; Art. 15 GDPR).
• You can ask to receive the data you provided to us in a common electronic format, or to have it transferred to another service (Art. 28 FADP; Art. 20 GDPR).
• There is no self-service export in the app or on the website: write to info@motoro.ch and we will reply within 30 days. The request is free of charge.

9.2 Correction

• You can edit your profile and listings yourself, in the app or on the website.
• For any other correction, write to info@motoro.ch.

9.3 Deletion

• In the app: open your profile, then "Edit profile", then "Delete Account".
• On the website: the page motoro.ch/en/delete-account, once signed in.
• By email: info@motoro.ch.
• You can also delete a listing or a conversation at any time.

9.4 Objection and withdrawal of consent

• In the app (version 2.3.5 or later): open your profile, then "Privacy and ads", to review your choices in Google's consent form. This entry appears when that form applies in your country.
• On iPhone: Settings, then Privacy & Security, then Tracking, and turn Motoro off. Without this permission, the app turns on neither personalised advertising, nor Google Analytics for Firebase, nor the activity log.
• On Android, you can also delete or reset your advertising ID in the device settings.
• Push notifications: in the app's notification settings or in your phone's settings.
• New message emails: in the app's notification settings.
• You can also object to processing based on our legitimate interest by writing to info@motoro.ch.

9.5 Exercising your rights

• Email: info@motoro.ch.
• To protect your data, we may ask you to confirm your identity, usually by writing from your account's email address.
• We reply within 30 days. If we cannot act on a request, we will explain why.

10. DATA SECURITY

10.1 Measures in place

• Encrypted connections (HTTPS) on the website, in the app and for the server services.
• Passwords stored only in hashed form.
• Access rules in the database: each user can only change their own data.
• Automatic blocking of addresses that repeatedly attempt abusive access, and limits on the number of requests.
• Daily backup of our server, kept for 10 days.
• Automatic monitoring of the service's availability.

10.2 What you should know

• The files you upload (listing photos, profile photo, photos sent in messages, professional supporting document) are stored at addresses that are hard to guess. Anyone who obtains the link to a file can view it.
• Never share a password, a code received by text message or card details in messages. Motoro will never ask you for them.

10.3 In the event of a data security breach

If a data security breach is likely to result in a high risk to your rights, we report it as soon as possible to the FDPIC (Art. 24 FADP) and, where the GDPR applies, to the competent authority within 72 hours (Art. 33 GDPR). We inform you when this is necessary for your protection.

11. COOKIES AND SIMILAR TECHNOLOGIES

11.1 On the website

• Session cookies: they keep you signed in to your account. They are only set if you sign in.
• Language cookie (NEXT_LOCALE): it remembers the language you chose, for one year.
• Browser local storage: your answer to the cookie banner, hiding of the app installation banner, a marker so that each visit is counted only once, and a technical marker to reload the page after a website update.
• Umami statistics: a tool hosted on our server in Switzerland, without cookies. It records the page viewed, the referring page, the browser, the operating system, the device type, the language and the approximate country, region and city; the IP address is used to determine this location but is not stored.
• Address entry in the selling form: the Google Maps service is loaded on that page. Google receives your IP address and the text you type.
• Videos: on the video pages, the preview images come from YouTube's (Google's) servers, which receive your IP address. The YouTube player is only loaded if you click on a video; YouTube may then set its own cookies.
• The website shows no advertising and uses neither Google Analytics nor social network buttons.

11.2 In the app

• The app keeps your session, language, preferences and consent choices on your phone.
• Advertising (Google AdMob): on first launch, the app asks for your consent (on iPhone, Apple's tracking request and, depending on your country, Google's consent form). Without consent, the ads shown are not personalised; Google still receives technical information about the device in order to show and count ads and to fight fraud.
• With your consent, the device's advertising identifier is used for personalised advertising.
• Google Analytics for Firebase is off when the app starts. On iPhone, it is only turned on, like the activity log, if you allow tracking. On Android, both follow your choices in Google's consent form; in countries where Google does not show this form, they are on.
• This is how the app works from version 2.3.5: please update it.

11.3 Managing cookies

• You can delete or block cookies and local storage in your browser settings. Without a session cookie, you cannot stay signed in.
• The cookie banner lets you decline audience measurement: your visits are then no longer counted, neither by Umami nor by our visit counter. To change your mind, clear the site data in your browser and the banner will appear again.
• For the app, see section 9.4.

12. MINORS

Motoro is intended for adults. A minor may only use the service with their parents' permission (see the terms of use). We do not knowingly collect data from children under 16.

13. CHANGES TO THIS POLICY

We update this policy when the service or the law changes. The version in force is the one published on the website and in the app, with its update date.

14. COMPLAINTS

If you disagree with how we process your data:

• please write to us first at info@motoro.ch;
• in Switzerland, you can contact the Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch;
• in the European Union, you can contact the data protection authority of your country of residence.

15. CONTACT

Motoro.ch, Rte du Clos 18, 1913 Saillon, Switzerland
Email: info@motoro.ch

Last update: October 2026