Who we are
TurningAuto is operated by Turning, a company registered in Delaware, United States ("we", "us"). We decide how and why your personal information is used on TurningAuto, which makes us its data controller under Nigeria's Data Protection Act 2023 (NDPA) and the GDPR, and the business responsible for it under California law.
Our data protection team handles privacy questions and requests: privacy@turningauto.app.
What we collect
Account. Your name, email, optional company name, and how you sign in. If you sign in with Google, we receive your name, email and a unique ID from Google through Firebase Authentication. If you use a password, we store it only as a salted hash.
Listings. The details and photos of cars you list. We remove EXIF data, including GPS location, from every photo when you upload it.
Activity. Your bids, purchases, and your bidding agents' settings and activity.
Payments. Order amounts, status and payment references. Card numbers are handled by our payment provider and never reach our servers.
Technical. IP address, browser and request logs, kept for security and to fix problems. When you sign in, sign up or reset a password, Cloudflare Turnstile reads signals from your browser to check you're not a robot.
Visits. To count visitors without cookies, we record each page seen with the site that sent you, your device type and your browser's time zone. Instead of your IP address we keep a code made from it with a secret that changes every day, so we can count unique visitors per day but can't recognise you the next day. We keep these records for 13 months.
We don't collect sensitive personal data, such as health, religion, ethnicity or biometrics, and we ask you not to put it in listings.
How we use it, and why
The law asks us to name a lawful basis for each use (NDPA section 25, GDPR article 6):
- To perform our contract with you: run your account, show your listings, run auctions and agents, and complete sales.
- Our legitimate interests: review listings, stop bots and fraud, and keep the marketplace safe. We weigh these against your rights, and you can object.
- Legal obligations: tax, accounting and anti money laundering records.
- Your consent: analytics and marketing cookies, and marketing emails. You can withdraw it any time, as easily as you gave it.
Automated checks and agents
Bot checks. Cloudflare Turnstile decides automatically whether a sign in looks like a robot. If you're wrongly blocked, email us and a person will help you in.
Bidding agents bid only on your instructions, within the limits you set, and you can pause them any time. Every listing is reviewed by a person before it goes live. We don't make decisions about you that have legal or similarly significant effects by automated means alone.
How long we keep it
We keep your account while it's open. When you close it we delete or anonymise your personal information within 30 days, except records we must keep: completed orders and payment records for 7 years for tax and accounting, and audit records of admin decisions on your account. Server logs are kept for up to 90 days.
Security and breaches
Data travels over encrypted connections. Sessions are httpOnly cookies scripts can't read, passwords are hashed with scrypt, sign in forms are protected from bots, and access to admin tools is limited and logged.
No system is perfectly secure. If a breach puts your information at risk, we'll tell the regulator within 72 hours of becoming aware of it, as the NDPA and the GDPR require, and tell you without undue delay, with what happened and what you can do.
Your rights
Wherever you live, you can ask us to:
- Tell you what we hold about you and give you a copy.
- Correct anything that's wrong or incomplete.
- Delete it, unless we must keep it by law.
- Send it to you or another service in a common, machine readable format.
- Stop or limit a use you object to, including anything based on our legitimate interests.
- Withdraw consent you've given, without affecting what happened before.
- Have a person review an automated decision about you.
Email privacy@turningauto.app from your account's address, or have an authorised agent write for you. We may ask you to confirm it's you, and we'll respond within 30 days. It's free, and we won't treat you differently for using these rights.
Where you live
The rights above meet the laws below. If you think we've got something wrong, please tell us first; you can also complain to your regulator at any time.
- Lawful basis for every use (s. 25)
- Access, correction, erasure, portability and objection (ss. 34 to 38)
- Breach reported to the NDPC within 72 hours (s. 40)
- Transfers abroad only with safeguards (ss. 41 to 43)
- Lawful basis for every use (art. 6)
- Access, rectification, erasure, restriction, portability, objection (arts. 15 to 22)
- Breach reported within 72 hours (art. 33)
- Transfers under standard contractual clauses (chapter V)
- Right to know, delete and correct
- We don't sell or share personal information
- Global Privacy Control honoured as an opt out
- No discrimination for using your rights
International transfers
We're based in the United States and our providers may process data in other countries. When information leaves Nigeria, the EU, the EEA or the UK, we only send it where the law allows: to countries with adequate protection, or with safeguards such as standard contractual clauses (NDPA sections 41 to 43, GDPR chapter V). Ask us for a copy of the safeguards that apply.
Children
TurningAuto is for adults. We don't knowingly collect information from anyone under 18, and we delete it if we learn we have.
Changes and contact
If we change this policy in a way that matters, we'll tell you before it takes effect. Questions: privacy@turningauto.app. See also our terms and conditions.