Privacy Policy

1. Who we are

Curated Car Collection ("we", "us") operates the platform at curatedcarcollection.app, dedicated to the curation, management, publishing and sharing of classic and collectible vehicles. This policy explains what personal data we collect, why we collect it, how long we keep it and the rights you have over it.

2. Data we collect

• Account data: name, email address and account role, provided when you register.
• Content you submit: vehicle records, photographs, videos, documents, captions and notes.
• Usage data: pages visited and actions taken inside the platform, used to operate and improve the service.
• Connected social accounts: the identifiers and access tokens returned by the platform you connect.

3. TikTok OAuth and the Content Posting API

If you choose to connect your TikTok account, you are redirected to TikTok's own authorisation screen, where you review and approve the requested permissions. We never see or handle your TikTok password.

• Scopes requested: user.info.basic, video.upload and video.publish. We request no additional permissions.
• What we receive: your TikTok open ID, basic profile information (display name and avatar), and access and refresh tokens.
• Purpose: to display which account is connected (user.info.basic), to upload videos as drafts to your TikTok inbox (video.upload), and to publish directly only the videos you explicitly select, caption, set a privacy level for and confirm (video.publish).
• Consent: nothing is ever uploaded or published to TikTok automatically. Every publication requires an explicit final confirmation from you, after previewing the video, the caption and the privacy setting.
• Storage: TikTok tokens are stored encrypted on our servers and are accessible only to backend processes. They are never exposed to the browser, to other users or to third parties. The TikTok client secret is held exclusively as a server-side secret.
• Retention and renewal: access tokens are short-lived and are renewed automatically using the refresh token while the connection remains active. Tokens are kept only for as long as the account stays connected.
• Revocation and deletion: you can disconnect the account at any time from the Social Media Control Center, or revoke access directly in TikTok under Settings → Security and permissions → Manage app permissions. Disconnecting revokes the token with TikTok and permanently deletes the access token, refresh token and stored profile data from our database.

4. Other social integrations

Where you connect Instagram or Facebook, we use Meta's official APIs solely to publish content you have approved. As with TikTok, we never store social media passwords and access can be revoked from your Meta account settings at any time.

5. Legal basis and purposes

We process your data to perform the contract you enter into when you use the platform (operating your collection and publishing the content you request), on the basis of your consent (social media connections and publishing), and on our legitimate interest in keeping the service secure and functional. We do not use your data for advertising profiling and we never sell personal data.

6. Third parties

We share data only with the processors strictly required to run the service: our cloud hosting and database provider, our email delivery provider, our payment processor for paid transactions, and the social platforms you personally connect (TikTok, Instagram, Facebook). Each acts under contract and only on our instructions. We may also disclose data where required by law.

7. Retention

Account and content data is retained while your account remains active. Social media access tokens are retained until you disconnect the account or they expire. When you delete your account, personal data is erased within 30 days, except where we are legally required to retain records (for example, transaction records for tax purposes).

8. Data deletion

You can delete your account and your data yourself from Profile → Account → Delete my account, or by writing to info@curatedcarcollection.app. / Puedes eliminar tu cuenta y tus datos desde Perfil → Cuenta → Eliminar mi cuenta, o escribiendo a info@curatedcarcollection.app.

Abusive content is not tolerated in the Paddock: any message can be reported and any user blocked from the «⋯» menu; reported messages are reviewed within 24 h and repeat offenders are suspended.

You may also request deletion of your account and all associated data at any time through the Data Deletion page or by contacting us. Disconnecting a social account immediately deletes the tokens we hold for it. Deletion requests are processed within 30 days and confirmed by email.

9. Your rights

Under the GDPR and equivalent legislation you have the right to access your data, to rectify inaccurate data, to erase it, to restrict or object to its processing, to withdraw consent at any time, and to receive your data in a portable format. You also have the right to lodge a complaint with your national data protection authority (in Spain, the Agencia Española de Protección de Datos).

10. Security

Data is transmitted over HTTPS and stored on access-controlled infrastructure. Credentials and API secrets are held server-side only and are never included in frontend code or public records.

11. Children

The platform is not directed at children under 16 and we do not knowingly collect their data.

12. Changes and contact

We will update this page whenever our practices change, revising the date above. For any privacy question, data access or deletion request, contact us at info@curatedcarcollection.app or through the Contact page of this platform.