Privacy Policy

Version dated 14 October 2026.

This Policy explains in plain language what personal data Autospot.ge (“we”, the “Site”) collects about you, why, on what legal basis, to whom it is disclosed, how long it is kept and how you can control it. The Policy applies to the Site autospot.ge, its mobile version (including when installed on a device as an app) and to enquiries made through the Telegram support bot.

The Georgian version of the Policy prevails. All other language versions, including this English version, are translations provided for your convenience; in the event of any discrepancy, the Georgian version applies.

In brief

• We collect the data needed to run a listings platform: account, listings, messages, payment for services, security. The optional checks (“VIN confirmed”, “Owner confirmed”, “Verified company”) are started by you yourself (Section 2.2).
• You enter your bank card details on the bank’s page. We do not receive or store the card number.
• The content of a listing is visible to all visitors of the Site, except the licence plate number, which is needed only to check the vehicle inspection. The phone number is shown on pressing the “Show phone number” button. Photographs for VIN and owner checks are seen only by moderators, and we delete them 7 or 30 days after the decision.
• E-mails are either service e-mails (codes, payments, moderation decisions) or promotional e-mails (selections and news). We send selections and news on the basis of a tick box in the registration form: it is ticked by default, it can be unticked, and you can unsubscribe at any time using the link in the e-mail (Section 11).
• The top.ge counter and analytics and advertising services (through Google Tag Manager) are currently loaded when the Site is opened: there is not yet a separate choice window on the Site. How to switch them off is described in Section 10.
• You can request access to your data, its correction or deletion: support@autospot.ge.

1. Who we are and how to contact us

The controller of your personal data (under the Law, the person who decides why and how data is processed) is the company whose details are given below. We process data in accordance with the Law of Georgia on Personal Data Protection No. 3144 of 14 June 2023 (the “Law”).

Controller’s details

• Name and legal form: შპს რუ.ან ჯგუფი
• Identification code in the Registry of Entrepreneurs: 445731815
• Registered address: Georgia, Tbilisi, Leselidze, 3, 2
• E-mail for questions about data and for any other enquiries: support@autospot.ge

This Policy is part of the Site rules. It applies alongside the User Agreement, the Public Offer for Paid Services, the Refund Policy, the Cookie Policy and the “Payment Methods” page. If the User Agreement or other documents of the Site conflict with this Policy on matters of personal data, the Policy applies.

2. What data we collect and where it comes from

2.1. Data that you provide yourself

• Account. Phone number, name, e-mail and password. The password is stored only in the form of an irreversible “digest” (hash); we never see the password itself. The confirmation code from the SMS is stored temporarily (for up to 15 minutes) and is not written to the database. Optionally, in your profile you can provide a surname, patronymic, account type (private individual or company), company name, city, profile photo, a short profile name and notification settings.
• Sign-in with Google. If sign-in with Google is available on the Site and you choose it, we receive your e-mail, first name, surname and photo from your profile. We copy the photo to our own server. There is no separate mailing tick box for this kind of sign-in (Section 11).
• Passkey. If you turn on sign-in with a passkey, we store its public part and the device name. Biometric data (fingerprint, face) stays on your device and does not reach us.
• Listings. Title, description, price, category and specifications of the car or item, photographs, video link, address and coordinates (if you provide them), VIN. The contact phone number is taken from your profile. We place a watermark on photographs.
• Licence plate number for the vehicle inspection check. If you enter a car’s licence plate number, it is stored by us and is not shown to buyers. We use it to check vehicle inspection data (Section 4.2).
• Messages. Chat correspondence with other users and with support, voice messages and photo attachments.
• Actions in your account. Favourite listings, subscriptions to sellers and shops, saved searches (search parameters and e-mail), reviews, entries in the seller’s feed, conversation with “AI search”.
• Complaints. A complaint about a listing or a user can be submitted from your account. We save your account, the reason, the text of the complaint (up to 2000 characters) and the moderator’s decision: who took it and when, and the moderator’s note. Complaints are kept in an archive together with the moderator’s decision.
• Payments. Amount and purpose of the payment, order number, payment status, balance history. If you need an invoice for a legal entity — the organisation’s details and those of the contact person. You enter bank card details on the bank’s secure page; they are not passed to us.
• Enquiries. Name, e-mail, subject and text of an enquiry from the feedback form; e-mails to our mailbox; if you write to the Telegram support bot — your Telegram ID and name, @username, your answers to the bot’s questions and your phone number if you sent it yourself; requests through the customs clearance calculator (name, phone, calculation parameters, country, page address, as well as the IP address and, if you are signed in, the account ID).
• Car loan applications. This feature is being prepared for launch (see Section 4.3). Once it is live, we will receive the contact details and the information about the desired car and loan that you provide in the application yourself. Until the service is launched, we do not collect such applications.

2.2. Optional checks

These checks are not needed in order to use the Site. The “Phone confirmed” badge appears after you enter the code from the SMS; you start the other checks yourself and may choose not to start them: in that case we do not collect the data listed below. What each badge means is explained on the page “How we verify”.

• “Phone confirmed”. For this badge we store not the number itself but its protected fingerprint (a keyed hash, HMAC: an irreversible checksum that can be obtained only with our secret key) and the date on which you confirmed the code from the SMS. The phone number itself remains in your account data (Section 2.1).
• “VIN confirmed” (optional). For the check, the Site issues a one-time code and you send two photographs: the VIN plate together with this code, and the whole car. The photographs are seen only by Autospot.ge moderators. We delete them 30 days after the moderator’s decision. If an application is left without a decision, we close it after 14 days and delete the photographs. The badge is valid for 90 days.
• “Owner confirmed” (optional and only with your consent). You send photographs of the vehicle registration certificate and of an identity document. A moderator compares the name and the VIN or licence plate number in the documents with the listing. We store only the result of the check and its date. We delete the photographs 7 days after the decision. The licence plate number is not shown to buyers. The photographs are re-saved without metadata (EXIF, geolocation), only moderators can open them, and every opening is recorded in a log.
• “Verified company”. We compare the company name, identification code and address with the Registry of Entrepreneurs of Georgia. The badge is valid for one year. The identification code of a legal entity is shown to buyers. The code of an individual entrepreneur is not shown, because it is the same as the personal number.
• Check log. For each check we record events: what happened (badge issued, rejected, removed, expired), when, for what reason and who took the decision (the system, you or a member of staff), and, if it is connected with a complaint, a link to the complaint.

2.3. Data generated when you use the Site

• Visit log. IP address, date and time, the address of the page opened, the page you came from, browser and device type (User-Agent), the visit identifier in a cookie, whether scripts were executed on the page, and, for signed-in users, the account ID.
• Actions on the Site. Views of listings (for signed-in users they are linked to the account, for view counters), adding to favourites, search queries (query text and IP address), opening a phone number in a listing. The fact that a number was opened is counted in the seller’s statistics: the seller is shown only counters, not data about visitors. When you open a listing, we show others that it is being viewed right now (“Now watching”) and, for this purpose, keep the IP address and the listing for 30 days. If a seller has turned on the auto-responder, we record in a log which action triggered it (message, favourite, opening the number, subscription) and the time.
• Security. Sign-in attempts and code requests (instead of the login itself we store its irreversible checksum — a hash — and the IP address), the “familiar browser” marker (cookie), referral visits (the inviter’s ID, your IP address and the time of the visit), the IP address at registration and at the time of subscribing to selections and news (to protect the Site against abuse and to confirm the subscription).
• Push notifications. If you have allowed notifications in your browser, we store the subscription address, the notification encryption keys, the User-Agent and the language. The text of your messages is not included in the notification.
• Web app statistics. Events of installing and opening the Site as an app (platform, mode, language, page) — without the IP address, account or User-Agent.
• Error reports. When the Site fails, a technical report is sent to us: the type of error, the file and line of code, the page address without parameter values, the browser type. Phone numbers, e-mails, tokens and passwords are stripped from reports; cookies and the contents of forms are not included in reports.
• Location and microphone. We do not request precise geolocation from the browser. Where necessary, the city is determined from the IP address using a database installed on our own server, without sending the IP address to external services. You enter the address and coordinates of a listing yourself. Microphone access is requested by the browser only when you record a voice message.

2.4. Data from other sources

• Google — when you sign in with Google (see above).
• The pti.ge website — vehicle inspection information for the licence plate number that you provided.
• Registry of Entrepreneurs of Georgia — the company name, identification code and address, when the “Verified company” check is carried out.
• The bank — confirmation of payment (status and amount), without card data.
• Other users — messages, complaints and reviews that they write about you or your listing.
• E-mail delivery service — notices of undelivered e-mails and of spam complaints.

2.5. What is mandatory and what is not

Phone number, name, e-mail and password are necessary for the contract on the use of an account: an account cannot be created without them. Listings can be viewed without registration. The other profile fields are optional. Consent to selections and news is not a condition of registration or of using the Site.

3. Why we process data and on what legal basis

The Law allows data to be processed only where there is a lawful basis (Article 5 of the Law). We rely on four bases:

• Contract or your request — the data is needed in order to do what you ask: create an account, publish a listing, accept payment.
• Legitimate interest — our interest in the security of the Site and in protecting users against fraud and spam, and in measuring traffic. We rely on this basis only where your rights and interests do not override it.
• Legal obligation — for example, keeping records of payments or replying to a request from a public authority.
• Consent — a free and clear decision which, under the Law, is expressed by an affirmative action, for example a tick box in a form (Article 3(l) of the Law). Consent can be withdrawn at any time as easily as it was given; this does not affect what was done before the withdrawal.

By purpose, it looks like this:

• Account: registration, sign-in, phone confirmation by SMS, access recovery, passkeys. Basis — contract (User Agreement).
• Operation of the platform: publishing and displaying listings, chat, favourites, saved searches, subscriptions, reviews, the seller’s auto-responder, “AI” features. Basis — contract and your request (you start the feature yourself).
• Notifications about events in your account: messages, replies, moderation decisions, the end of a listing’s or service’s term — by e-mail and push. Basis — contract; for push, also your permission in the browser.
• Alerts about new listings matching saved searches and subscriptions to shops. Basis — your subscription (request).
• Paid services and payment: topping up the balance, payment for services and plans, refunds, invoices, record-keeping. Basis — contract and legal obligation.
• Checking listings and security: automatic and manual moderation, handling complaints, blocking violators, protection against spam and password guessing, limits on the number of attempts. Basis — legitimate interest.
• Trust badges. “Phone confirmed” and “Verified company” (check against the Registry of Entrepreneurs of Georgia): basis — legitimate interest in the safety of transactions. “VIN confirmed” and “Owner confirmed”: basis — your request, and for the owner’s documents also your consent, which you give by starting the check. Archive of complaints about listings together with the moderators’ decisions: basis — legitimate interest in the safety of transactions and in protecting our rights.
• Operation of the Site: visit log, our own statistics, error reports. Basis — legitimate interest.
• Vehicle inspection check by licence plate number. Basis — contract (a feature that you have chosen).
• Replies to enquiries and support (form, e-mail, Telegram bot). Basis — your request.
• Referral programme: recording invitations and crediting rewards. Basis — contract.
• Selections and news by e-mail. Basis — the “Receive Autospot.ge selections and news” tick box in the registration form (the rules on direct marketing are in Article 12 of the Law). This tick box is ticked by default and can be unticked before registration is completed. When signing in with Google there is no separate form, so such a subscription is set up automatically. You can opt out of the mailing at any time (Section 11). Service e-mails (codes, payments, moderation decisions) are not considered a mailing and are sent on the basis of the contract.
• Marketing push notifications. Basis — your permission for notifications in the browser; it can be withdrawn in the settings of your browser or device.
• Analytics and advertising measurement by third-party services (Section 10). Basis — our legitimate interest in measuring traffic and the effectiveness of advertising.
• Passing a calculator request to the partner expert. Basis — your consent tick box in the request form.
• Passing car loan applications to partner banks (once the feature is live). Basis — your request; promotional messages about such an application — only with separate consent.
• Compliance with the law and protection of our rights: replies to public authorities, handling disputes. Basis — legal obligation and legitimate interest.

We send SMS only for confirmation codes and service messages (including a new password when access is recovered). We do not send promotional SMS.

4. To whom we disclose data

We disclose data only to those who need it for the stated purposes, and in the minimum amount. The hosting provider and the hosting provider’s mail service, e-mail delivery, the SMS gateway and the error reporting service process data on our behalf, under a services contract and only for their specific task. Bank of Georgia, analytics and advertising measurement services, video and map services, sign-in with Google, Telegram, browsers’ push notification services, pti.ge and the AI service are independent recipients: they act under their own rules and decide for themselves how to use the data they receive. For details, see their privacy policies.

4.1. Other users and visitors of the Site

• The text, photographs, price, specifications, VIN and city (and the address, if you provided it) of your listing, the profile name or the name of the company and shop, the profile photo, reviews and entries in the seller’s feed are visible to all visitors, including through search engines.
• The phone number is shown on pressing the “Show phone number” button. Depending on the Site settings, this is available to all visitors or only to signed-in users.
• The results of checks are visible to everyone in the form of badges (“Phone confirmed”, “VIN confirmed”, “Owner confirmed”, “Verified company”). The photographs of the VIN and of documents themselves are not shown to anyone except moderators. The licence plate number is not shown to buyers. For a company, the identification code of the legal entity is shown; the code of an individual entrepreneur is not shown.
• Chat messages are seen by the person you are corresponding with. How we ourselves may access them is described in Section 12.
• If a seller has turned on the auto-responder, then after your action (message, adding to favourites, opening the number, subscription) an automatic message from the seller marked “Auto-reply” may arrive in the chat, and a conversation with the seller will appear for you.

4.2. Service providers

• Hostinger (hosting, outside Georgia) — storage of the Site, the database, files and daily backups, that is, all the data described in Section 2. Incoming e-mail to our mailboxes is handled by the hosting provider’s mail service (Titan, outside Georgia): your e-mails and enquiries to us are stored there. Access logs and backups are kept by the provider itself; the retention period is determined by the provider.
• gosms.ge (SMS gateway) — your phone number and the text of the SMS: a confirmation code or a new password.
• SendPulse (e-mail delivery, outside Georgia) — the recipient’s address and the content of each e-mail, including service e-mails (codes, links, a temporary password on access recovery, moderation decisions, payment). If you are subscribed to selections and news, your e-mail, name, phone number and language are also passed there for the mailing. Notices of non-delivery and spam complaints are returned to us, and the address is added to the block list (Section 11).
• Bank of Georgia (payments, Georgia) — the amount, order number, description of the service, language and return addresses. You enter your card details on the bank’s page. We do not pass your name, e-mail or phone number to the bank when an order is created.
• top.ge (traffic counter, Georgia) — your browser contacts the counter service, which receives the technical data of the visit (IP address, User-Agent). The counter is loaded when a page is opened.
• Google Tag Manager and the analytics and advertising measurement services connected through it (including Google Analytics, Yandex.Metrica and the Meta pixel; outside Georgia) — data about the visit: the page address, events on the Site, cookies, technical data of the browser and the IP address. The set of services is defined by the settings of the Google Tag Manager container. These services are loaded when a page is opened (on your first action or a few seconds after loading) without a separate consent window.
• Sentry (error reports, outside Georgia) — technical reports of failures in the form described in Section 2.3. We have configured the reports so that they do not contain your IP address, cookies or the contents of forms; when a report is sent from the browser, the service may technically be able to see the network address of the device.
• Telegram (outside Georgia) — correspondence with the support bot; service notifications to our administration about new listings, orders, requests and registrations (they may contain the user’s name, e-mail, phone number and city). The public parts of listings may be published automatically in our Telegram channel and on other social networks through an auto-publishing service (socposter, outside Georgia).
• Browsers’ push notification services (Google, Apple, Mozilla, Microsoft; outside Georgia) — the subscription address and the short text of the notification.
• OpenStreetMap (maps, outside Georgia) — on pages with a map, your browser loads map tiles and the service receives the IP address and the page address; when an address is searched, the address entered is passed to it. The map scripts are loaded from the unpkg.com service, which also receives the visitor’s IP address.
• Video services (for example, YouTube, Vimeo; outside Georgia) — if a listing contains a video link, your browser loads that service’s player.
• pti.ge (vehicle inspection check, Georgia) — the car’s licence plate number. No data about you or your IP address is passed there. If you check a number on our vehicle inspection check page, it is sent to the same website and is not stored by us.
• OpenAI (“AI” features, USA) — only if the corresponding feature is enabled on the Site. “AI description”, “Fill in from photo” and “AI search” are started by you pressing a button. For “AI description”, the form data and the description text are sent (phone numbers, links and e-mails are stripped out; the VIN and phone number are not sent); for “Fill in from photo” — up to 6 photos, without reading the licence plate number and VIN; for “AI search” — only the query phrase, without your identifier. Translation of listing descriptions into other languages may be performed automatically, without pressing a button (by a background queue or when a page is opened): only the public text of the listing is translated, and no data about the visitor is sent. Another provider may be connected on the Site instead of OpenAI (for example, Anthropic, USA, or MyMemory); in that case we will update this Policy.
• Google (sign-in with Google, outside Georgia) — Google learns that you are signing in to Autospot.ge.

4.3. Partners — at your request and with your consent

• CARS EXPERT (customs clearance expert partner). If you tick the consent to disclosure in the calculator form, we may pass your name, phone number and calculation parameters to the partner. Without this tick box, the request cannot be sent, and we do not pass data to the partner. Following a link to the partner’s WhatsApp or Telegram is your own independent approach to the partner.
• Car rental (localrent.com). On the rental page, the partner’s widget is loaded, and your browser contacts the partner’s service directly. From that point the partner’s policy applies.
• Car loan (planned). We are preparing a car loan selection service. Once it is live, you will submit an application voluntarily and will confirm its sending yourself. We will save it in our own database of applications and may pass it, at your request (Article 5 of the Law), to partner banks and credit institutions so that they can contact you. Before applications are first passed to banks, we will update this Policy and name the recipient banks. We are not a bank, we do not decide whether to grant a loan and we do not guarantee approval: the terms are set by the bank, and it processes your data under its own policy. If you ask us to withdraw an application, we will stop any further disclosure; data already passed to a bank is processed by the bank independently. We will send promotional messages about an application only on the basis of a separate tick box that you tick yourself. Until the service is launched, we do not collect car loan applications and do not pass them to banks.

4.4. Public authorities and protection of rights

We disclose data to the public authorities of Georgia if they have requested it in the manner provided by law. We may use and disclose data to the extent necessary to protect our rights and the rights of other users in a dispute or in an investigation of fraud.

4.5. Reorganisation or transfer of the Site

If the company is reorganised or the Site, together with the accounts, is transferred to another controller, we will notify you at least 14 calendar days in advance on the Site and by e-mail to the address in your account, naming the new controller and its details. Before the transfer, you have the right to demand deletion of your account and to receive a refund of the remaining balance under the rules of the Refund Policy (Section 8). The new controller must process data for the same purposes and on terms no less protective than this Policy; for any new purpose it needs your separate consent.

4.6. Transfer of data outside Georgia

Some of the providers listed in Section 4.2 are located outside Georgia. The Law allows such transfers if one of the following conditions is met (Articles 37–38 of the Law):

• the recipient’s country is on the list of countries with an adequate level of data protection approved by the Auditor General;
• the transfer is provided for by an international treaty of Georgia or by law;
• a contract obliging the recipient to protect the data has been concluded with the recipient, and the permission of the State Audit Office has been obtained for the transfer;
• you have given written (including electronic) consent after being informed that adequate data protection may not be ensured in the recipient’s country, and of the possible risks.

If you want to know on what basis data is transferred to a particular provider, write to us (Section 8). Please note: in some countries the level of data protection may be lower than in Georgia; the data may be accessible to local public authorities, and there may be fewer means of protecting your rights. Analytics and advertising services receive data when the Site is opened. To avoid this, disable third-party cookies and scripts in your browser or turn on a blocker: the Site will continue to work.

5. How long we keep data

We keep data no longer than is needed for its purpose and no longer than the period set by law. For some data, the deletion period is fixed and is applied automatically; for other data there is not yet any automatic deletion. We say so openly.

5.1. What is deleted automatically

• Visit log (IP address, User-Agent, page addresses): 180 days. After that only aggregated statistics without personal data remain.
• “Now watching” log (IP address and listing): 30 days.
• Conversation with “AI search”: 30 days after the last message; it can be erased earlier with the “Start over” button.
• Seller’s auto-responder log: 30 days.
• Sign-in attempts and code requests: about one day.
• “Remember me” cookie: 30 days; in our database only an irreversible digest of the token is stored. The lifetime of the other cookies is given in Section 10.
• Administrators’ action log (including the IP address and User-Agent of staff): 365 days.
• Payment logs (without card data): 12 months.
• Push subscription: until you unsubscribe; deleted earlier if the device stops accepting notifications.
• Photographs for “VIN confirmed”: 30 days after the moderator’s decision. An application without a decision is closed after 14 days, and the photographs are deleted.
• Photographs for “Owner confirmed”: 7 days after the moderator’s decision; after that only the result of the check and its date remain.

5.2. What is kept while the account exists or while it is needed for the purpose

• Account, profile, listings, favourites, subscriptions, reviews, balance history: while the account exists. When you ask for your account to be deleted, within 10 business days from receipt of the request (after confirmation that it is you who is submitting it) we delete the account data or tell you which data we are keeping, and on what basis (for example, payment records that we are required by law to keep), and how to appeal against the refusal (Section 9). Data that is needed only in connection with the account (profile, favourites, subscriptions, push subscriptions, passkeys, chat messages, the address in mailings) we delete or anonymise within the same period.
• Payment and accounting records (orders, payments, invoices, as well as the payer’s name, e-mail and phone number in the order parameters): for the period that the tax and accounting legislation of Georgia sets for accounting documents. There is not yet any automatic deletion at the end of this period; we delete or anonymise such data at your request (Section 8) if there is no other basis for keeping it.
• Listings. A listing that you have deleted stops being shown on the Site but remains in our database. If you need its data to be erased completely, write to us (Section 8): we will reply within the period given in Section 7 and delete it.
• Chat messages: while the account exists; after the account is deleted we delete or anonymise them within the period given in Section 7. Correspondence that is needed to handle a complaint or dispute is kept until the matter is closed.
• Licence plate number for the vehicle inspection check: while the listing exists. If you want to erase it earlier, or after the listing is deleted, write to us (Section 8): we will reply within the period given in Section 7 and delete the licence plate number.
• Results of checks (“Phone confirmed” — protected fingerprint and date; “VIN confirmed”, “Owner confirmed”, “Verified company” — result and date) and the check log: while they are needed to display the badge and to protect our rights; there is not yet any automatic deletion of the log. The “VIN confirmed” badge is valid for 90 days, “Verified company” for one year.
• Complaints about listings together with moderators’ decisions: there is not yet any automatic deletion; the archive is kept while it is needed for the safety of transactions and the protection of our rights, and is deleted at your request (Section 8) if there is no basis for keeping it.
• Mailings: until you opt out. Records of the subscription (the date and the fact of consent) and of the opt-out are kept for the whole period of the mailing and for 1 more year after it, in order to prove lawfulness. The IP address at the time of subscribing is kept together with the subscription record.
• IP address at registration: while the account exists.
• Listing views and actions of a signed-in user (by account ID, without the IP address): there is not yet any automatic deletion.
• Search queries with the IP address: there is not yet any automatic deletion; you may demand that queries from your IP address be deleted (Section 8).
• Enquiries, calculator requests, correspondence with the bot, referral visits: there is not yet any automatic deletion; the data is kept while it is needed to reply, to calculate the reward and to protect our rights, and is deleted or anonymised at your request (Section 8).
• E-mail block list (address, reason, date): while the address is unavailable for e-mails or until you have opted out of the mailing; deleted on request.
• Car loan applications (once the feature is live): until you ask for the application to be withdrawn and for as long as it remains relevant.

If a period for a category is not stated above, the general rule applies: we keep data while it is needed for its purpose, and delete or anonymise it at your request (Section 8).

The retention period of the hosting provider’s backups is determined by the hosting provider itself; we use them only to restore the Site after a failure. To test updates, we have a closed test copy of the Site (access only by password, not indexed by search engines; sending of SMS, e-mails and payments are disabled in it) and working copies of the database held by the developer. We keep them no longer than is needed for testing and development.

6. Automatic checking of listings

Some listings are checked automatically, according to pre-defined rules. A neural network makes no decisions in this check.

• What is checked: prohibited words; links, e-mails and phone numbers in the text; the presence of photographs; duplicates (by text, price, mileage, VIN and the “digital fingerprint” of photographs); the author’s history on the Site (rejections and complaints) and the “trusted author” marker (an author who has several listings approved without rejections or complaints). The assessment based on the author’s history is an automatic assessment based on your past actions on the Site (profiling within the meaning of the Law).
• Possible outcomes: the listing is published; it is rejected, with a reason that the author can see; or it is sent for checking by a member of staff. When a listing is rejected before a paid service has been activated, the cost of the service is returned to the balance (for details, see the Refund Policy).
• Checks carried out by people. Applications for “VIN confirmed” and “Owner confirmed” are reviewed by moderators.
• Review by a person. If you disagree with an automatic decision, you have the right to demand that a member of staff review it. Write to us (Section 8) and identify the listing. We will reply within the period given in Section 7. You may also correct the listing and submit it again.

7. Your rights

The Law gives you the following rights (Articles 13–22 of the Law). You may:

• obtain information on what data of yours we process, why, on what basis, where it was obtained from, to whom it has been disclosed and how long it is kept;
• obtain access to your data and a copy of it — free of charge;
• demand that inaccurate data be corrected or incomplete data be completed (you can change your profile data yourself in your account);
• demand that processing stop, or that the data be deleted or blocked;
• receive the data that you provided to us in a structured, machine-readable form or transfer it to another controller, if we process it automatically on the basis of your consent or a contract and this is technically possible;
• withdraw consent at any time — free of charge and as easily as it was given;
• object to direct marketing: after your request we stop the mailing no later than 7 business days later;
• in the cases provided for by the Law, demand that a decision significantly affecting you not be taken solely by automated means (Section 6);
• complain to the supervisory authority or to a court (Section 9).

Time limit for a reply. We reply to your request no later than 10 business days from receipt. In special cases this period may be extended by no more than 10 business days; we will tell you immediately about the extension and its reason. We inform you of the decision on a demand to block data without delay and no later than 3 business days. If you withdraw consent, we stop processing on that basis and delete the data at your request no later than 10 business days, unless we have another basis for processing it. We stop the mailing no later than 7 business days. Handling a request is free of charge.

When we may refuse. We may refuse in full or in part in the cases provided for by the Law, for example where we are obliged to keep the data or where fulfilling the request would infringe the rights of other people. We will explain the reason and explain how to appeal against the refusal (Section 9).

8. How to exercise your rights

1. Write to us: at support@autospot.ge (preferably from the address given in your account) or through the form at autospot.ge/feedback; you can additionally write to the Telegram support bot @autospotgeorgia_bot. State which right you want to exercise and your phone number or e-mail from the account.
2. We may ask you to confirm that the request is submitted by you, in a way that does not require excessive data, for example by writing from the e-mail in your account or by confirming the request with a code sent to the phone number of the account. This protects you: a stranger must not be able to obtain your data or delete your account.
3. We will carry out the request and tell you the result within the period given in Section 7.

Deleting an account. To delete an account, write to us in any of the ways above. The terms concerning the balance remaining are described in the Refund Policy: it is better to settle them before deletion.

What you can do immediately, without an enquiry. Change profile data and notification settings — in your account. Opt out of selections and news — using the “Unsubscribe” link in the e-mail. Switch off push — in the settings of your browser or device. Delete a listing — in your account. Manage cookies — in your browser settings.

If your data appears in someone else’s listing (for example, your photos, phone number or licence plate number), or you see on the Site a listing or information about yourself that you did not post, press “Complain” on the listing or write to us, giving the link. We will examine the matter, reply within the period given in Section 7 and, where necessary, hide or delete the data.

9. Complaint to the supervisory authority

If you consider that we are violating your rights, you have the right to apply to the State Audit Office of Georgia (სახელმწიფო აუდიტის სამსახური). Since 2 March 2026 it has performed the functions of the supervisory authority for personal data protection, in place of the former Personal Data Protection Service. Information on how to apply is on the website www.sao.ge (the section on personal data protection). You may apply to the State Audit Office without first contacting us. You may ask it to block your data until a decision on your application is taken; the Office’s decision can be appealed in court. You also have the right to apply to a court.

We would be grateful if you write to us: we will examine your enquiry. But this does not deprive you of the right to apply to the supervisory authority.

10. Cookies

Cookies are small files that a website saves in your browser. We use:

• Necessary cookies — to make the Site work: session and form protection, sign-in and “remember me”, “familiar browser”, the choice of language, currency and theme, dismissed hints. Without them the Site will not work as intended.
• The Site’s own statistics — the visit identifier and the visit log (Sections 2.3 and 5). We keep them ourselves on the basis of legitimate interest and do not pass them to third-party analytics services.
• Analytics and advertising cookies and counters of third-party services (top.ge, Google Tag Manager and the services connected through it) are loaded when a page is opened; there is not yet a separate choice window on the Site. You can switch them off in your browser settings (block cookies and scripts of third-party services) or with a blocker: the Site will continue to work. The cookies of these services are set by the services themselves: their content and lifetime are determined by them.

Cookies set by the Site itself:

• PHPSESSID — session (sign-in, form protection, codes), until the browser is closed.
• tokenAuth — “remember me”, 30 days.
• spot_dev_login, spot_dev_admin — “familiar browser”, 1 year.
• spot_vid — a random guest identifier for counting openings of the phone number in the seller’s statistics, 1 year.
• metrics_visit — the visit identifier in the Site’s own statistics, 31 days.
• ref_id — the inviter’s identifier when a referral link is followed, 31 days.
• spot_lang_pick, spot_lang_set — language choice, 1 year and 10 minutes.
• spot_cur — currency choice, 1 year.
• spot_theme — light or dark theme.
• cookiepolicy, sellersafety, registerBonus — dismissed interface hints.

Some settings (for example, comparison of listings, a draft listing, interface hints) are stored only in your browser and are not sent to our servers. General information about cookies is in the Cookie Policy.

11. E-mails and mailings

Autospot.ge sends three kinds of e-mail to your address. They differ in whether they are necessary for the operation of the account and whether you can opt out of them.

• Service e-mails. Codes and confirmation links; e-mails about registration, sign-in and access recovery (including a temporary password); e-mails about payment and about money movements on the balance (top-up, refund, bonus credit); moderation decisions on listings; replies to your enquiries. They are necessary for the operation of the account and are not advertising, so you cannot opt out of them. Basis — contract.
• Event notifications. New messages; the end of the term of a listing or paid service; new listings matching your saved searches and subscriptions to shops. These are not advertising: they are connected with your account, listings and subscriptions, and are on by default. Notifications about messages and about the end of services and listing terms can be switched off in the profile settings, and any kind of notifications and selections — using the “Unsubscribe from these e-mails” link in the e-mail (it leads to the unsubscribe page).
• Autospot.ge selections and news. These are promotional e-mails. We send them if the “Receive Autospot.ge selections and news” tick box is left ticked in the registration form. The tick box is ticked by default: untick it if you do not want to receive such e-mails; it can be unticked before registration is completed. When signing in with Google there is no separate form, so the address is subscribed to selections and news automatically. For the mailing we store your e-mail, name, language, IP address and the date of subscription; the e-mail, name, phone number and language are passed to the SendPulse address book. Every such e-mail contains an “Unsubscribe” link; you can also write to support@autospot.ge. We stop the mailing no later than 7 business days after your request. Records of the subscription and of the opt-out are kept for the whole period of the mailing and for 1 more year after it, in order to prove lawfulness.

If e-mails to an address are not delivered (the address does not exist or is entered with an error), the address is added to the block list and e-mails to it, including service e-mails, are no longer sent. If you reported an e-mail as spam or unsubscribed through the delivery service’s link, selections and news stop being sent to you; service e-mails and notifications continue to arrive. The block can be lifted by contacting support (support@autospot.ge).

The SendPulse service is used to deliver e-mails: it is passed the recipient’s address and the content of the e-mail (Section 4.2). We do not send promotional SMS: SMS are used only for confirmation codes and service messages.

12. Security

No system is absolutely secure, and we do not promise the impossible. But we take measures appropriate to the risks:

• the connection to the Site is protected by encryption (HTTPS);
• passwords are stored only as irreversible hashes, and so is the “remember me” token;
• the text of chat messages, voice messages and the organisation’s details for invoices are encrypted in storage. This is encryption on our server, not “end-to-end”: the Site decrypts them in order to show them to you and to the person you are corresponding with, and the Site’s administrators have access to correspondence in the control panel. Under our internal rules they access it only when handling complaints, combating fraud, handling support enquiries and where required by law. Chat photo attachments and finished PDF invoices are not encrypted;
• photographs for VIN and owner checks are seen only by moderators; photographs of documents are re-saved without metadata, and every opening of them is recorded in a log;
• the bank card number does not reach us at all: payment takes place on the bank’s side;
• limits apply to sign-in attempts, code requests and password resets; sign-in with a passkey is designed so that the secret stays on the device;
• the control panel is located at a separate address, and the actions of staff in it are recorded in a log;
• when access is recovered, we send a temporary password to your phone or e-mail. Change it immediately after signing in and never tell anyone the codes from SMS.

If a data breach occurs that creates a significant threat to your rights, we will notify the supervisory authority no later than 72 hours after discovery, and we will warn you without undue delay where there is a high likelihood of significant harm (Articles 29–30 of the Law).

13. Children

The Site is intended for persons aged 18 and over. We do not check age at registration and do not knowingly collect data of minors. If you learn that a child has registered or posted data, write to us (Section 8): we will examine the matter and delete the child’s data.

14. Changes to the Policy and applicable law

We may update the Policy, for example when new features appear or the law changes. The new version is published on this page with a new date at the top. We will notify you of material changes at least 14 calendar days before they take effect, on the Site and by e-mail to the address in your account. Only changes that improve your position, correct typing errors or are caused by a change in the law take effect immediately. If you do not agree with the changes, you have the right, before they take effect, to stop using the Site and to demand deletion of your account (Section 8). The changes do not affect what happened before they took effect. If the law requires your consent for new processing, we will request it separately; continuing to use the Site does not in itself constitute consent.

The legislation of Georgia applies to this Policy. Disputes are heard by the courts of Georgia; this does not limit your rights as a consumer, or your right to apply to the State Audit Office of Georgia (Section 9) and to the Competition and Consumer Agency of Georgia.

15. Contacts

For any questions about personal data, write to support@autospot.ge. Enquiries about personal data are handled at this address; you will be answered from it as well.

• Feedback form: autospot.ge/feedback
• Telegram support bot (additional channel): @autospotgeorgia_bot

The controller’s full details are in Section 1.