Privacy

AttractCars is operated by Attractor Oy (business ID 3592322-7), Haukilahdenkatu 1 A 89, 02200 Espoo, Finland, which is the data controller for the processing described here. This page describes what the service actually does. Where a section says we do not collect something, that is a statement about the code, not an aspiration.

If you are searching for a car

Browsing needs no account. Accounts are optional and use a one-time email code or Google sign-in. The account section below describes what we keep when you choose to sign in or post a car.
Two preference cookies, each only if you make a choice. Prices are shown in a currency the page picks from your browser’s time zone and language settings; that guess is made on your device and stored nowhere. If you choose a currency yourself, in the menu at the foot of every page, the site keeps your choice in a cookie named cur. It holds the three-letter code of that currency and nothing else (cur=SEK, for example), and it lasts a year from the last time you chose, unless you delete it sooner in your browser’s settings. Your browser sends it with each request to attractcars.com, as it does any site’s cookies, but our servers neither read nor record it: only the page in your browser reads it, to show prices in the currency you chose.
Distances, such as how far a car has been driven, are shown in kilometres, or in miles where your browser’s time zone or language points to a country whose roads are measured in miles; that guess is made on your device too, and stored nowhere. If you choose kilometres or miles yourself, in the menu at the foot of every page, the site keeps your choice in a cookie named dist. It holds km or mi and nothing else (dist=mi, for example), and it lasts a year from the last time you chose, unless you delete it sooner. Like cur, your browser sends it with each request, and our servers neither read nor record it: only the page in your browser reads it, to show distances in the unit you chose.
Your favourites, comparison and recent searches, on your device. When you tap the heart on a car, the site keeps it in your browser’s own storage (localStorage): the car’s listing number, its name and price as the card showed them, and when you saved it, for up to 100 cars. The site also keeps your last 10 searches (each search’s address and heading) and the last 20 cars whose seller’s page you opened from the site (the same four things). This is what fills your Favourites page, the “Recent” row on the home page and the suggestions in an empty search box, and it is kept until you remove it. None of it is sent to us, with these exceptions: when you open your Favourites page, the page asks our server about your saved cars by their listing numbers, to show what each costs now and whether it is still for sale. Comparison keeps only up to four selected listing numbers in localStorage. To restore their names or show the comparison, it asks our server for their current public facts using those numbers in a request body, never in the page address. Remove choices in the comparison tray or comparison page, or clear this site’s browser data. If storage is unavailable, comparison choices work only in the current tab and disappear when it closes. Nothing about that request is stored, and our log records only that the page was asked, not which cars. To remove it, use Remove on your Favourites page, Clear beside your recent searches (on the home page, or at the foot of an empty search box’s suggestions), or clear this site’s data in your browser’s settings. If your browser does not let the site keep anything, the heart says so and nothing is kept.
Your location, only if you ask for it. “Use my location” in the filters asks your browser for your position, and your browser asks you first. The page rounds it to about a kilometre and puts it in that search’s address, like any other filter, so we can show the cars near you and how far away each is. We do not store it: our log records that a search was made, not its filters, and a search made from your location is not kept among your recent searches on your device. A town or postcode you type instead is looked up in our own copy of GeoNames’ place names, never sent to anybody else.
A copy of our offline page. Where your browser supports it, the site installs a service worker: a small script of ours that keeps two of our own files in your browser’s cache — the page shown when you are offline, and the logo on it — and shows that page when a page cannot be reached because your connection failed. It keeps no car, no search and no page, and nothing about you. Clearing this site’s data removes it.
No advertising or tracking cookies. Your filters live in the URL, which is why a search is shareable and why the back button works properly. Cloudflare, which delivers the site (see Sharing and transfers), may set a strictly necessary security cookie, such as cf_clearance, if it shows a visitor a security check. It is used only to protect the site, and it needs no consent.
No third-party analytics, tag managers, advertising pixels or social widgets. Pages load nothing from anyone else’s servers except, where a source’s policy permits it, the listing photograph from the seller’s own site. Your browser fetches that photograph directly from the seller’s server, which sees your IP address as any website does, and learns that the request came from attractcars.com, but not which page or search you were on. Some sellers’ servers try to set their own cookie on it, such as a content-delivery network’s bot-protection cookie, so we ask your browser to fetch these photographs without cookies (Cross-Origin-Embedder-Policy: credentialless): the seller’s server can then neither read nor set one. A browser that does not support that instruction applies its own rules for third-party cookies. We never receive those cookies either way.
No profiling and no cross-site tracking. We do not build a picture of you and there is nothing to sell. What we do count is daily totals that name nobody (see What we count).

Server logs

Our servers write an ordinary access log: the time, the request method and route, the response status, how long it took, a randomly generated request identifier, and the network the request came from — your address with its last part removed (203.0.113.9 is kept as 203.0.113.0), never the full address. These are kept only to operate and debug the service, and to defend it against abuse, under our legitimate interest in running a working, secure website (GDPR Art. 6(1)(f)). They are deleted after 30 days.

Rate limiting

The public API is rate-limited per client, which requires holding a client address in memory briefly. It is not written to a database and is not used for anything else.

What we count, and what we do not

To learn what people look for and whether the site helps them find it, we count a few things as daily totals: how many searches were made, which filters and which sort order they used (and, for make, model, country, fuel, body and gearbox, which value), how deep into the results people went, how many cars were shown and of which make, model and country, how many times a seller’s page was opened from the site and for which make, model and country, how many searches found nothing and with which filters, and how many times somebody saved or removed a favourite, reused a recent search, sent a report or added the site to their home screen. A total reads like “on 5 October, 1 204 searches chose BMW”.

Nothing in it identifies you or your device. There is no cookie, no identifier of any kind, no record per visit and no list of what any one person did; your address is not stored or hashed for this, and your browser’s user agent is looked at once, to leave out search engines and other programs, and never kept. The page tells our server about a favourite or a reused search with the name of the action alone (for example {"event":"favourite_added"}), never which car. The words you typed are kept only when a search found nothing, reduced to lower-case letters, digits and spaces and at most 40 characters, for 30 days, and we look at them only once the same words have been searched on at least three days or at least five times — so something typed once, such as a name, never reaches us as anything but a count. The totals are kept for 400 days and are used only to improve the service, under our legitimate interest in a search that works (GDPR Art. 6(1)(f)).

If your browser sends Global Privacy Control or Do Not Track, nothing about your visit is counted at all: the page sends nothing, and our server does not count your searches or the sellers you open.

Reporting a problem with a listing

Every result has a “Report a problem” link. If you send a report, we store which listing and seller it is about, what you chose is wrong, the note you wrote if you wrote one, and when you sent it. We do not ask who you are and cannot reply. To stop one network sending thousands of reports, we also store a keyed one-way code made from the network your request came from (your address with its last part removed, as in the server logs): it lets us tell many reports from one network apart from reports from many, and cannot be turned back into an address. Please do not write personal details in the note. Reports are used only to correct how we read sellers’ pages, under our legitimate interest in listings that are accurate (GDPR Art. 6(1)(f)), and are deleted automatically twelve months after they are sent.

Submitting your dealership’s website

If you use List your dealership, we store what you enter — the business name, its website, the contact e-mail address, the country, any sitemap or feed address and note — the version of the consent text you agreed to, when you sent it, and the same keyed one-way code made from your network as for reports, to stop one network sending thousands. The e-mail address is used only to contact you about that submission, under the consent you give on the form and our legitimate interest in listing your cars correctly (GDPR Art. 6(1)(a) and (f)); it is never shown anywhere or passed on. The submission is deleted automatically twelve months after it is sent; the fact that your website is a source we read is about the business, not you, and stays until you ask us to stop. To have a submission deleted sooner, write to us at the address below.

Accounts and your own adverts

If you request sign-in, we send a one-time link through our existing Cloudflare Email Service. It expires after 15 minutes and is bound to the browser where you requested it. The provider receives your email and the login message for delivery. We do not store passwords.

The site keeps an essential HttpOnly sign-in cookie for up to seven days, and a temporary browser-binding cookie for up to 15 minutes. Better Auth manages revocable server-side sessions; email-link secrets are stored as hashes. Short-lived login request records, including the recipient email, are retained for about two days, with hourly cleanup to enforce abuse and sending-cost limits. They are not used for marketing or browsing profiles. Abuse prevention keeps only a keyed code of your network, rather than your address in these records.

When you choose Google sign-in, your browser visits Google to confirm your choice. Google provides a stable account identifier and your verified email address. We store the identifier to recognise your linked account and use the same essential sign-in cookie. We request only identity and email permissions; we do not request Gmail, Drive, Calendar or other account data. Google access tokens are used only during sign-in, and are not kept. Existing email accounts must explicitly connect Google while signed in. Deleting your AttractCars account removes that link. Google processes its sign-in service under its own privacy policy.

Your account contains your verified email and the car adverts you submit. Drafts are private. When you explicitly publish with consent, your advert, photos, verified email and optional phone are visible to visitors. These seller-provided adverts are separate from the verified dealer inventory. Published adverts expire after 30 days unless you renew them.

You can edit, unpublish, mark sold or delete your adverts, and delete the account from its page. Deleting the account revokes its sessions and removes its adverts from public access. Deleted photos become inaccessible immediately. Unreferenced photo files are removed after 30 days. Restricted recovery copies follow the database backup schedule: recent daily, weekly and monthly restore points, with at least four successful backups retained. They are not publicly accessible. We remove uploaded photo metadata and resize large images. Existing device-local favourites and recent history are not automatically copied into an account.

If you sell cars, or run a site we read

We read sale listings from dealers’ own websites. A classified-ad site, multi-dealer portal or car-search site, where private individuals can advertise too, is read only where its publisher has given permission. Our crawler takes the facts about the car and deliberately leaves the seller’s personal details behind: we do not extract sellers’ names, phone numbers, email addresses or street addresses into our records (the one exception, page copies kept to repair our software, is described below), and none of these crawled personal details appears on AttractCars. We link to the advert instead, which is where a buyer should be reading them anyway. The permission to store personal data is off by default in every source’s policy record and gates the columns that could hold it.

For each listing we store its URL and title; the facts its page states about the car, such as make, model, year, odometer reading, price and equipment, and its vehicle identification number where the page publishes one (we do not show it); the town and postal code the car is offered in; the name of the dealer or website that published it; when we saw it; and how its price changed. We keep a hash of the description rather than the description itself.

Facts about a car that a business offers for sale are not personal data. Where the seller is a private individual, the listing and the link to their advert can be, and we treat them accordingly. When the site’s own data marks an advert as a private individual’s, we do not store it, and a listing we already held from such an advert is stripped at once of its address, VIN, town, postal code, title and photographs. Where a site does not say who placed an advert, we process what we hold under our legitimate interest, which is also the seller’s, in making a car that has been publicly advertised for sale easy for buyers to find and to reach at its original advert (GDPR Art. 6(1)(f)). They come from the publicly accessible page where the listing was published.

A listing leaves the search when it is sold or withdrawn, or when we can no longer confirm that it is for sale. We keep a record of retired listings, including their price history, to measure our own accuracy and to recognise a listing that appears again. Twelve months after a listing is retired we remove its address, the seller’s reference for it, its VIN, town, postal code, coordinates, title and photographs, and keep only the facts about the car and how its price changed.

When our software fails to read a page correctly, we may keep a copy of that page, at most five pages from any one site a day, so that we can repair the software. These copies are internal and never shown. They contain whatever the page contained, including any contact details on it, and are deleted after 30 days, or after twelve months when kept as the record of a fault we fixed.

Your rights

If you are in the EU or EEA you have the rights to access, rectification, erasure, restriction, objection and portability under the GDPR, and the right to complain to your supervisory authority — in Finland, the Office of the Data Protection Ombudsman.

Your right to object. Where we rely on our legitimate interests, as we do for the server logs and for listings that relate to you, you may object at any time on grounds relating to your particular situation, and we will stop unless we have compelling legitimate grounds that override your interests, rights and freedoms.

To exercise any of these rights, email info@attractor.fi. The statutory deadline is one month; in practice we aim to answer within five working days.

For content we crawled, the same route removes it: we locate the records by source and listing URL, delete them, and keep them from coming back on a later crawl. Deleted records leave our backups as those expire, within about a month. Site owners can also stop us with robots.txt; our crawler page says how, and how soon it takes effect.

We do not sell data and we do not share it with advertisers or data brokers. The service runs on servers we operate, hosted in Germany by netcup GmbH.

Every request to attractcars.com passes through Cloudflare, Inc., which provides the site’s network delivery and protection: DNS, encryption, caching and defence against attacks and abusive traffic. To do that, Cloudflare processes your IP address and the technical details of each request, as our processor under its data processing agreement. Cloudflare is a US company. Transfers outside the EEA rely on its certification under the EU–US Data Privacy Framework and on the EU standard contractual clauses.

Every supplier that processes data on our behalf does so under a written processing agreement, and only for the purpose of running this service.

Security

How the service is secured, and how to report a vulnerability, is on the security page.

Changes

If this page changes materially, the new version replaces this one here. Updates are published on this page. Optional account contact details are used to operate the requested account service, not for marketing.