Privacy Policy.

GTRotation (“the site”) is an independent, one-person fan project operated by Besian Shala from Italy, in the European Union. For any privacy question or to exercise your rights, reach out through the contact page. As the data controller, the operator decides what data is processed and why, as described below.

If you create an account: your email address, a password (stored only as a salted hash by our authentication provider, never in plain text), and an optional display name.

If you use wishlist or garage features: the cars you save. While signed out these stay in your browser only; when signed in they are linked to your account so they sync across devices.

If you enable car alerts: a preference flag and a log of which alerts were sent, so the same alert is not emailed twice.

When the Apple app becomes available, if you enable its wishlist notifications: an Apple device token and app environment. The token is linked to your account only to tell you when a car from your wishlist appears; it is removed when you sign out of the app or delete your account.

If you email support: the message you send to me@gtrotation.com, and your email address so we can reply. It is used only to handle your request.

Everyone: anonymous, aggregated usage counts (daily site visits and per-car page views) that are not tied to your identity, plus cookieless analytics and performance metrics provided by Vercel. Advertising data is only processed if you consent to cookies (see section 5).

Account data is processed to provide the service you ask for (Art. 6(1)(b) GDPR: performance of a contract). Anonymous analytics and basic security are processed on the basis of our legitimate interest in keeping the site working and improving it (Art. 6(1)(f)). Advertising cookies and any non-essential tracking are processed only with your consent (Art. 6(1)(a)), which you can withdraw at any time. Car alert emails are sent only after you opt in.

We do not sell your data. We rely on a small number of processors that handle data strictly on our behalf:

• Supabase: database, authentication, and account storage.
• Vercel: hosting, plus cookieless analytics and performance monitoring.
• Google AdSense: advertising, only after you consent to cookies.
• Resend: delivery of car-alert emails, if you opt in.
• Apple Push Notification service: delivery of wishlist notifications in the future Apple app, if you enable them.

Some of these providers may process data outside the EU, including in the United States. Where that happens, transfers are covered by appropriate safeguards such as the EU Standard Contractual Clauses or an adequacy framework.

We use essential cookies and local storage to run the site, and (only with your consent) Google AdSense advertising cookies. No advertising or profiling cookie is set before you accept. Full details and a way to change your choice are in the Cookie Policy.

Account data is kept for as long as your account exists. When you delete it, your profile, wishlist, garage, alert preferences, delivery history and registered Apple devices are removed together. Anonymous usage counts contain no personal data and are retained in aggregate. Support emails are kept only as long as needed to handle your request.

Under the GDPR you can request access to your data, correction, deletion, restriction or objection to processing, and portability, and you can withdraw consent at any time. To exercise any of these, contact us through the contact page. You can permanently delete your account yourself from the Account page and, once available, from the Apple app. You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali.

The site is not directed at children under 14. In Italy, that is the minimum age to consent to online services on one's own; younger users need a parent or guardian's consent. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy as the site evolves. Material changes will be reflected here with a new “last updated” date.