AttractCarsBot

AttractCars is an independent search index for cars for sale, operated by Attractor Oy (Finland). We read publicly published vehicle listings, extract the factual details, and send people to your page to continue. We are not a marketplace and we never handle the sale.

This page is for the person who found AttractCarsBot in their server logs. It tells you what we are, what we take, how to restrict us, and how to reach a human who will answer.

If you sell cars and would like them found, you can also tell us about your website — a submission puts it in the queue of sites we check, and robots.txt still decides.

How to recognise us

Every request we make carries both of these headers:

User-Agent: AttractCarsBot/1.0 (+https://attractorhq.github.io/attractcarsbot/)
From: info@attractor.fi

We publish no fixed egress IP range yet, so please identify us by the user agent rather than by address. If we ever operate from stable addresses, they will be listed on this page — we would rather say “we do not have one” than publish a range you cannot rely on.

Anything claiming to be AttractCarsBot from an address you find suspicious is worth reporting to us at info@attractor.fi. We do not disguise our crawler, and we do not use residential proxies or any other form of identity evasion.

How to control us

We implement the Robots Exclusion Protocol (RFC 9309) and honour it as the first check on every request, against the copy of your robots.txt we last read. To stop us entirely, add this to /robots.txt:

User-agent: AttractCarsBot
Disallow: /

To let us in but ask us to slow down:

User-agent: AttractCarsBot
Crawl-delay: 10

A named group for AttractCarsBot overrides a wildcard group, longest matching path wins, and an Allow rule wins a tie — as the standard specifies. We ask whether your robots.txt changed at least once a day, with a conditional request that an unchanged file answers with a 304, and re-classify a source as soon as it has; a site whose robots.txt we have not been able to re-read for 30 days is not crawled at all.

We also honour text-and-data-mining reservations under Article 4 of the EU DSM Directive, expressed as a /.well-known/tdmrep.json reservation, a TDM-Reservation: 1 response header, the equivalent meta tag, or a statement in your robots.txt, comments included, that automated access needs your written permission. A reservation stops us regardless of what the rest of robots.txt says.

What we take, and what we leave

We store the factual fields that let somebody find your car:

• make, model, variant, year and first registration
• odometer reading, price and currency
• fuel, transmission, body type, power, doors, seats, colour
• the equipment and technical figures your page lists
• the vehicle identification number, where your page publishes one (we use it to recognise the same car elsewhere, and do not show it)
• the country, town and postal code the car is in
• the URL and title of your listing, so we can send people to it

We deliberately do not take:

• Your listing description. Descriptive text is yours. We neither store nor show it: we keep only a hash of it, so we can tell when a listing changed. (When our parser fails on a page, we may keep a copy of that page internally for up to 30 days to repair the parser. It is never shown or published.)
• Copies of your photographs. We never copy, store, resize or proxy them. Where your page publishes a photograph of the car, and we have found nothing in your terms, your robots.txt or your server’s behaviour that says otherwise, a visitor’s browser may load it from your own server, beside the link to your listing. A hotlink or anti-framing control on your server is respected, never worked around; and if you would rather we did not show your photographs at all, tell us and we stop.
• Personal data. We read dealers’ own inventory; a classified-ad site is read only with its publisher’s permission. Where such a site also carries private sellers’ adverts, we do not extract their names, phone numbers, email addresses or street addresses, and we never show them; an advert your own data marks as a private seller’s we do not store at all.

How we behave

• We identify ourselves on every request, with a contact address in the From header.
• We rate-limit ourselves per site and cap how many connections we open at once. Our cost scales with our own budget, never at your expense.
• We send conditional requests. If nothing changed, you serve a 304 instead of a full page.
• A 429 or 403 stops us. Repeated failures open a circuit breaker and pause the source. We back off; we never work around a block.
• We never bypass anything. No logins, no paywalls, no CAPTCHAs, no bot walls, no access controls of any kind. If your content is behind one, it is not ours to read.

If a site is unavailable to us under these rules, we record that and go elsewhere. We would rather have a smaller index than an argument.

Opting out, and takedowns

The simplest route is robots.txt, as described above, which needs nothing from us and takes effect the next time we re-read it, usually within a few days.

If you would rather tell us directly, or you want listings already indexed removed, email info@attractor.fi from an address at the domain concerned, or from any address if you tell us how to verify you. We undertake to reply within five working days.

An opt-out is applied at the registry level, so it survives re-discovery: we will not quietly start again because we found your sitemap from somewhere else. Reversing one needs a written request from the site owner.

The same route handles data-subject requests under the GDPR. We locate the records by source and listing URL, delete them, and keep them from coming back on a later crawl. Statutory deadline is one month; in practice we aim for the same five working days.

Security

To report a vulnerability in AttractCars, see our security page, which says what a report should include.

What we cannot promise

We will not tell you that our index is complete, that every listing in it is currently for sale, or that every field we extracted from your page is correct. We publish exactly how we count what we count, we re-check listings on a schedule and drop the ones that have gone, and we keep the provenance of every field so that a dispute is answerable with evidence. That is a method, not a guarantee, and we would rather describe it accurately than promise something we cannot inspect.