Legal
Last updated : October 1, 2026
The controller of personal data collected through GarageOne is Michael Derrien, publisher of the Service (contact details in the legal notice). Contact for any question or request: contact@garageone.fr.
We only collect the data needed to run the Service:
Account and preferences
Google sign-in
If you choose this method, Google sends us your verified email address and your name. We receive neither your Google password nor access to other Google services.
Vehicles
Tracking
Sharing and fleet
Subscription and payment
Security and sessions
Notifications
Location
If you allow it in your browser, your position is used to find nearby stations, garages and car washes. It is not saved in your account: the last position is only remembered in your browser. The coordinates of the searched area are sent to our servers to query data sources, without being linked to your account.
Audience measurement
On public pages only (home, sign-in, sign-up, legal pages), we measure traffic with Umami, hosted by the publisher: page view, browser, system, screen size, country. No cookie, no persistent identifier and no measurement inside the signed-in area. Your browser's "Do Not Track" signal is honored.
We never collect sensitive data (health, origin, opinions, etc.). We do not carry out profiling or automated decisions with legal effects on you.
Create and manage your account, provide the Service
Performance of a contract
Storing and displaying your vehicles, fill-ups and maintenance, sharing, exports.
Manage subscriptions and payments
Performance of a contract and legal obligation
Through Stripe, and keeping accounting records.
Service emails
Performance of a contract
Email verification, password reset, sharing invitations.
Reminders and recaps
Performance of a contract
Maintenance, inspection, insurance and mileage reminders, monthly recap and inactivity reminder. Can be turned off at any time in Settings > Preferences.
News and announcements
Consent
Off by default, you enable them in your preferences.
Push notifications and location
Consent
Your browser asks for permission, which you can withdraw at any time.
Security, abuse prevention, session management
Legitimate interest
Rate limiting, intrusion detection, revocable sessions, accounts suspended for abuse.
Proof of acceptance of the terms
Legitimate interest
Keeping the acceptance date for the lifetime of the account.
Referral and badges
Performance of a contract
Awarding rewards and related notifications.
Anonymous audience measurement
Legitimate interest
Traffic statistics for public pages, under the consent exemption provided by the CNIL.
Your data is accessible to the publisher and, strictly within the scope of their services, to the following providers:
Stripe
Subscription payments (United States and European Union).
Resend
Sending the Service's emails (United States).
Authentication, only if you use Google sign-in (United States).
OVHcloud
Hosting of the application and database (France).
File storage
Your invoices and photos are stored in a private object storage managed by the publisher, accessible only through authenticated access.
Map and data providers
Map tiles (OpenStreetMap) and address search (Nominatim) are loaded directly from your browser: these services receive your IP address and the area viewed. Our servers query Overpass (OpenStreetMap), data.economie.gouv.fr and the public prix-carburants.2aaz.fr API on your behalf, without sending them any information about your account.
Push notification services
If you enable push notifications, they go through your browser's service (Google, Apple or Mozilla).
Other users
Only the people with whom you choose to share a vehicle or a logbook link.
We do not sell or rent your personal data, and do not use it for advertising. It may be disclosed to authorities only under a legal order.
Account, vehicles, fill-ups, maintenance, invoices and photos
Until the account is deleted, which is immediate. Any technical backups are purged within 30 days at most.
Unverified accounts with no data
Automatically deleted 30 days after creation.
Sign-in sessions
Deleted 30 days after being revoked, or 35 days after last activity.
Payment data and invoices
10 years from the transaction (accounting obligation), kept by Stripe and the publisher.
Technical server logs
Rolling 90 days.
Audience measurement
25 months maximum.
Under Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act, you have the following rights:
Right of access
Get a copy of your personal data.
Right to rectification
Correct inaccurate or incomplete data.
Right to erasure
Delete your data, directly from Settings > Account.
Right to portability
Download all your data in JSON format from Settings > Account, whatever your plan.
Right to object
Object to processing based on legitimate interest.
Right to restriction
Ask for processing to be temporarily suspended.
Withdrawal of consent
At any time, for processing based on consent (notification preferences, push, location).
Post-mortem directives
Define what happens to your data after your death.
To exercise your rights, contact us at contact@garageone.fr. We reply within one month. We may ask you to prove your identity.
You may also lodge a complaint with the CNIL (French data protection authority): cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.
We implement the following technical and organizational measures:
In case of a data breach likely to result in a risk to your rights and freedoms, we notify the CNIL within 72 hours and inform you as soon as possible.
GarageOne uses no advertising or tracking cookies. The only trackers set are strictly necessary for the service or purely functional, and therefore do not require your consent:
Session cookie (next-auth.session-token)
Keeps you signed in. Duration: 30 days at most, or until you sign out.
Language cookie (NEXT_LOCALE)
Remembers your chosen language. Duration: 1 year.
Browser local storage
Display theme, map filters and last known position. This data stays on your device.
The payment page and Google sign-in are hosted by Stripe and Google, which may set their own cookies under their own policies.
Some providers (Stripe, Resend, Google, push notification services) may process data in the United States. These transfers are covered by the European Commission's standard contractual clauses and, where the provider is certified, by the EU-US Data Privacy Framework.
No other data is transferred outside the European Union.
The Service is intended for people aged at least 16. If you know that a child under 16 has created an account, contact us at contact@garageone.fr so that we delete it.
This policy may change to reflect legal or practice changes. Any substantial change will be communicated by email or in the application. The date of the last update is shown at the top of this page.