Privacy policy
Last updated 27 September 2026
CarFitMe tells used-car buyers what a specific car is likely to cost to run and what to check before buying it. It works through a browser extension that reads the car listing you are looking at. This page explains what we collect, why, and who else sees it.
Who we are
The controller of your personal data is Agenic UAB, company code 305933921, Teatro g. 9A-12, LT-03107 Vilnius ("CarFitMe", "we"). For anything about your data, write to [email protected].
What the browser extension does
The extension runs on car listing pages of autoplius.lt, autogidas.lt, AutoScout24 and mobile.de, and on carfitme.com. On a listing page it reads the car's details and shows them in a small card. Reading the page sends nothing anywhere.
Data leaves your browser only when you ask for a report: by clicking the card or the toolbar button, or by pasting a listing link on carfitme.com (the extension then opens that listing in a background tab, reads it and closes it). What is sent is a set of named fields about the car, never the whole page:
- the listing's address and the site's listing number;
- the vehicle details: make, model, version, registration date, mileage, engine, fuel, gearbox, drive, body type, consumption and emissions;
- the asking price, and the town and country the car is in;
- whether the seller is a private person or a dealer;
- the seller's description of the car, as written;
- the address of the listing's main photo.
The extension does not read or send the seller's name, phone number or street address, your account or messages on the listing site, or your browsing history. It stores nothing on your device.
The use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use it only to produce the report you asked for, and we do not sell it or use it for advertising.
What we collect
Reports. For each report we store the listing data described above, a copy of the listing's main photo, the report we produce from it, and a mileage figure if you correct it yourself. Sellers sometimes put their own contact details in the description; we keep the description as written and do not use those details.
Your account. If you sign in, we store your email address, the number of checks your account allows and has used, and which reports are yours. Signing in works through a one-time link we email you.
Server logs. Our web server records each request: your IP address, the address requested, the time and your browser's user agent. We use these logs to keep the service running and secure.
In your browser. The cookies listed below, and which checklist items you have ticked in a report (stored in your browser only).
Analytics, only if you agree. With your consent, the website uses Google Analytics 4 to count visits and see which pages are used. It records the pages you open, where you came from, and your device, browser and approximate location (by country and city; Google does not store your IP address). Report addresses are sent with the report's identifier removed, so Google cannot open your reports. Google signals and ad personalisation are switched off, and we use no advertising tools. If you decline, Google Analytics is not loaded at all. The browser extension itself never uses analytics.
Why, and on what legal basis
- To produce the reports you ask for and to run your account: performance of our contract with you (GDPR Art. 6(1)(b)).
- To keep the service secure and working, through server logs and backups: our legitimate interest in running a reliable service (Art. 6(1)(f)).
- To understand how the website is used, through Google Analytics: your consent (Art. 6(1)(a)), which you can withdraw at any time under "Cookie settings" below.
- The seller's description and listing details are published by the seller on a public listing site; we process them to assess the car, which is our and your legitimate interest (Art. 6(1)(f)).
Who else processes it
- Google Cloud hosts the service, its database, the stored photos and the backups, in the European Union (Warsaw, Poland).
- Google (Gemini API) receives the vehicle details, the mileage and the seller's description, to identify the exact engine and to write parts of the report. It does not receive your email address, account or IP address.
- Google Analytics (Google Ireland Limited) receives the usage data described above, only if you agree. Google may transfer it to the United States under the EU-US Data Privacy Framework.
- Mailgun (EU region) sends the sign-in emails, so it receives your email address.
Some of these providers may process data outside the EU under the European Commission's standard contractual clauses. We share data with no one else, and never sell it.
The insurance section of a report links to draudimas.lt. Following that link takes you to their site under their own privacy policy; we pass them nothing about you or the report.
Report links
A report is meant to be shared: anyone who has its link can open it, including the car's photo. The link is long and random, and a report shows the car, not you. Keep the link private if you do not want others to see which car you are checking.
Cookies
These cookies are needed for the service to work, and are always set:
| Name | Purpose | Lifetime |
|---|---|---|
| carfitme_anon | A random identifier for your browser, so the reports you create before signing in stay yours and the free check can be counted. | 1 year |
| carfitme_session | Keeps you signed in. We store only a hash of it. | 90 days, or until you sign out |
| carfitme_theme | Your light or dark theme choice. | 1 year |
| carfitme_driver | The driver profile you pick for the insurance estimate (age band, years of driving, whether you caused a claim). Kept in your browser only; we do not store it. | 1 year |
| carfitme_consent | Remembers whether you agreed to analytics cookies, so we do not ask on every page. | 6 months |
These are set by Google Analytics, only after you agree:
| Name | Purpose | Lifetime |
|---|---|---|
| _ga | Google Analytics: tells one visitor's visits apart from another's. | 2 years |
| _ga_SJ1VYE723T | Google Analytics: keeps track of the current visit. | 2 years |
You can change your answer at any time: . Declining after agreeing removes the Google Analytics cookies.
How long we keep it
- A report created without an account can be opened for 90 days. If you sign in within that time, it moves to your account.
- Reports in your account, and the account itself, are kept until you ask us to delete them.
- Sign-in links expire after 30 minutes and work once; a sign-in lasts up to 90 days.
- Server logs are kept for up to 90 days.
- Google Analytics data is kept for 14 months, then deleted by Google.
- Database backups are kept for up to 30 days.
Your rights
You can ask us for a copy of your data, to correct it, to delete it or your account, to restrict or object to how we use it, and to receive it in a portable form. Write to [email protected]; we answer within one month. When you ask about reports created without an account, tell us the report links, since we have no other way to know they are yours.
You can also complain to the Lithuanian data protection authority, the State Data Protection Inspectorate (vdai.lrv.lt), or to the authority where you live.
Children
CarFitMe is for people buying a car and is not directed at anyone under 16.
Changes
When what we collect or who processes it changes, we update this page and the date at the top.