1. Who is responsible for your data
Xiamen Halcyon Trading Co., Ltd. (Unified Social Credit Code 91350211MAKRGFCF59; address: 2F-1, No. 585-5 Tieshan Road, Jimei District, Xiamen, Fujian, China), contact sales@craveuo.com.
After you sign, the export company named in the contract is responsible for the data it handles to perform it.
2. What we receive and why
| What | Why |
|---|---|
| Inquiries: name, WhatsApp / e-mail / Telegram, country, company (optional), the cars you want and your message | To reply and prepare a quote (steps you ask for before a contract) |
| The IP address when you send an inquiry (kept only as a one-way hash) and the browser type | To stop spam and abuse (legitimate interests) |
| Accounts: e-mail, display name, avatar, and what you post, comment and save | To provide your account and the features you use |
| Seller applications: company, city, brands, phone or WeChat, licences and credentials, stock and quotes | To review applications, send requests for quotation and compare quotes; phone and WeChat are seen only by our reviewers |
| Model page views | Counted per model and day, with nothing about you |
| Server logs (IP, browser, time, page) | Security and fixing faults, kept for the host's standard period |
4. Passing your details to a car dealer (marketplace)
In some countries the car pages show cars that local dealers sell themselves (the marketplace). When you ask about one of these cars or book a viewing, your message comes to CRAVEUO first; only if you tick the consent box do we pass your name, contact details and message to that dealer, and only for enquiries and viewings about that car. Legal basis: your consent (you can withdraw it at any time; this doesn't affect what was already passed on).
Once the dealer has it, the dealer is an independent controller of your data under its own privacy policy; its name, address and contact details are shown under About the seller on the listing. We keep a record of the hand-over (time, car, dealer).
We never sell your details to dealers, and never pass them on without your consent.
Passing an inquiry to the local official dealer: when the car you ask about has an official dealer in your country, the inquiry page lets you choose whether we may pass your inquiry to them (only your name, contact details and the cars chosen). We pass it on only if you tick the box, and keep the words you agreed to and the time with the inquiry; if you don't, your details are not passed on.
Used-car quotes: if you choose a used-car quote, your name and contact details go to the Chinese export company handling that order, because the export customs papers need them; they are used only for that export.
Partner applications: the company and contact details sent through the Partner with CRAVEUO page are used only for business contact and kept apart from buyers' inquiries; the encrypted IP is cleared after 30 days and the application deleted after 24 months.
5. How long we keep it
- Inquiries: while we deal with them and follow up; you can ask us to delete them at any time. Records of signed orders are kept as tax and export rules require.
- Accounts: deleted when you delete your account, except what the law requires us to keep.
- Seller applications: kept while we work together; you can ask us to delete them when we stop.
6. Your rights
You can ask to see, correct or delete the data we hold about you, or object to or restrict how we use it. Write to sales@craveuo.com; we deal with it free of charge within a month. You can also complain to the data protection authority in your country.
7. Children
You must be 18 to buy a car. We don't knowingly collect data from children under 13.
Account and posting data
| Data | Why | Lawful basis | How long |
|---|---|---|---|
| E-mail address | Send sign-in codes and account security notices | Contract (providing the account) | Until you delete the account |
| Sign-in codes (stored only as a hash) | Check it's you | Contract | Valid 10 minutes, deleted within an hour of expiry |
| Sign-in sessions (stored only as a hash), browser type | Keep you signed in; show your devices | Contract | 30 days after last use |
| Display name, bio, country (optional), photo (optional), 13+ confirmation | Show your profile and posts; check age | Contract; legal obligation (child protection) | Until you delete the account |
| Posts, photos, comments, likes, saves, block list | Provide the community | Contract | Until you delete them; rejected or removed content after 180 days |
| Reports (made by you or about you), moderation decisions | Handle reports, review appeals, answer regulators | Legal obligation; legitimate interests | 24 months after they're resolved |
| Marketing consent (off by default) and when you gave it | New arrivals and offers by e-mail | Your consent (withdraw any time) | Until you withdraw it or delete the account |
| IP address (stored only as a hash) | Rate limits, abuse prevention | Legitimate interests | 30 days |
Photos are shrunk on your device with location and other hidden data removed, and the server removes it again after upload. Photos are stored on Cloudflare R2, account and post data on Cloudflare D1 (Cloudflare is our processor); code e-mails are sent through Resend.
In Account settings you can download all your data (a JSON file) or delete your account at any time; deletion is immediate (reports stay, no longer linked to you). You can also write to sales@craveuo.com to use your rights of access, correction, erasure, restriction, objection and portability.