Privacy Policy

Effective as of 21 October 2026

Who we are

Automano is a vehicle-report service operated by Nova Labs Limited, a private limited company registered in Hong Kong (Unit 2904-05, 29/F, Universal Trade Centre, 3 Arbuthnot Road, Central, Hong Kong). We are the controller of the personal data described below. You can reach us at contact@automano.com.

What we collect

Order and account data. When you buy a report or sign in to the reports area, we process the email address you give us, the one-time code we send to it, and the reports and orders linked to that email address. Sign-in uses one-time codes — we do not hold passwords for customer accounts.

Vehicle and report data. The VIN or registration you look up, what our decoders returned for it, the report we generated, and the delivery status of that report.

Payment data. Payments are handled by Stripe. We receive the outcome of a payment (paid, refunded, declined), an amount, a currency and a transaction reference. We never receive or store your full card number.

Technical and usage data. Your IP address, the pages you open on automano.com, the actions you take on them, and a session identifier. We use our own analytics service for this: it records aggregate usage and, for a sample of sessions, a replay of the rendered page (what was shown and clicked). Form inputs are masked in those replays by default, and passwords and payment fields are never recorded at all.

Cookies and similar storage. We set cookies to keep you signed in, to remember your language and market, and to attribute a visit to a referral or affiliate link. Details are in the cookies section below.

Messages you send us. If you write to support, we keep the conversation and any details you choose to give.

Why we use it, and on what basis

To perform our contract with you — generating and delivering the report you bought, keeping it available in your account, handling refunds, and answering you about the order.
To comply with legal obligations — retaining invoices and accounting records for the period tax law requires, and responding to lawful requests.
On our legitimate interests — keeping the service secure and working (fraud and abuse prevention, rate-limiting, error diagnosis), measuring which pages and products work so we can improve them, and contacting business prospects about the service. We weigh these interests against your rights, and you can object at any time.
With your consent — for any optional cookie or communication that asks for it. You can withdraw consent at any time; it only affects the future.

We use a small set of processors, and we share personal data only so they can provide their service to us:

Stripe — payment processing, fraud screening and receipts.
Cloudflare — website hosting, content delivery, security and email routing.
Resend — transactional email (report delivery, sign-in codes, service notices).
Our own analytics service — usage measurement and session replay, operated on our infrastructure.

We do not sell personal data. We do not share it for third-party advertising. We disclose data to a public authority only when the law requires it, and to a professional adviser (for example an accountant or lawyer) only as necessary.

Where it goes

Our providers process data in the European Union, the United Kingdom and the United States. Where personal data leaves the country you are in, we rely on the transfer mechanism that applies to that provider — an adequacy decision where one exists, otherwise the European Commission’s standard contractual clauses, together with the provider’s own safeguards.

How long we keep it

Reports and the data behind them — while your access to them is active, plus a period afterwards in which you can ask us to re-issue or correct one.
Order, invoice and payment records — for the retention period tax and accounting law sets, which in the markets we sell in is generally between six and ten years.
Session replays — 30 days, after which they are deleted automatically.
Usage aggregates and error data — up to 26 months, in a form that does not identify a single visitor.
Attribution cookies — the referral cookie for 30 days and the affiliate cookie for 60 days on your device; the language and market preference cookie for up to 180 days.
Messages to support — for as long as we need them to answer you and to keep a record of the case.

When a retention period ends, we delete the data or irreversibly anonymise it.

Your rights

Depending on where you live, you have some or all of these rights:

Access — a copy of the personal data we hold about you.
Rectification — correction of data that is inaccurate or incomplete.
Erasure — deletion, where we do not have a legal or contractual reason to keep it.
Restriction and objection — limits on what we do with your data, including a right to object to processing based on our legitimate interests.
Portability — the data you gave us, in a machine-readable format.
Withdraw consent — for anything we do on the basis of consent.
Complain — to the supervisory authority in your country. If you are in the European Union or the United Kingdom, you can complain to the data-protection authority where you live or work; we would ask you to contact us first, so we can try to put it right.

To exercise any of these, write to contact@automano.com from the address you used with us. We answer within the period the law allows (usually one month) and we may need to confirm your identity first. There is no charge unless a request is manifestly unfounded or excessive.

Security

Data is sent over TLS, access to production systems is limited and credentialed, sign-in uses one-time codes rather than reusable passwords, and errors are logged without card data. No system is perfect: if a breach ever puts your rights at real risk, we will notify you and the competent authority as the law requires.

Children

The service is for people who can enter into a contract. We do not knowingly collect personal data from children, and if we learn that we have, we will delete it.

Cookies

Essential — session and sign-in state, so the site works. These cannot be switched off without breaking the service.
Preferences — your language and market.
Attribution — a referral or affiliate code, so a partner can be credited for a visit.
Analytics — usage measurement and session replay, as described above. Where the law requires consent for these, we ask for it before setting them and you can change your choice at any time.

You can also clear or block cookies in your browser; essential cookies are the ones whose loss you will notice.

Changes to this policy

We may update this policy when the service or the law changes. The effective date above always shows the current version, and we will post a notice on the site for a change that materially affects you.

Contact

Questions about this policy, or a request about your data: contact@automano.com.