Privacy Policy

Who processes your data

Maydanchyk (the "Platform") is a service for car dealers: a dealer maintains its vehicle catalogue in the dashboard, and the Platform displays it on the dealer's branded website and publishes listings to Telegram, Instagram, Facebook and TikTok on the dealer's behalf, and places listings on OLX from the OLX account the dealer connected.

The controller of personal data relating to the operation of the Platform itself is Individual entrepreneur Dmytro Bondarchuk (registration number 3608503538), Kyiv, Ukraine.

Data requests go to dmytro.bondarchuk.wm@gmail.com. We reply within 30 calendar days and charge nothing for it.

On Meta for Developers the Platform is registered as the app Maydanchyk; on Telegram it operates through the bot @car_dieller_publisher_bot; with OLX, through the OLX partner API.

Who is responsible for what

The same data passes through different responsible parties on the Platform, and that determines whom you should contact.

• For dealer staff accounts, sessions, technical logs and cookies, the Platform is the controller: we decide what is collected and why.
• For listing content, photographs, contact details and opening hours, and for buyers' callback requests from the dealer website, the dealer is the controller. Here the Platform is only a processor: we store and publish this data on the dealer's instructions and do not use it for our own purposes.
• Once a listing is published to a social network or placed on OLX, that network or OLX processes the data as well, under its own policy, which we do not control.

If your data appears on a dealer website as the seller or author of a listing, contact that dealer first. If they do not respond, write to us: we will either pass the request on or apply the technical means ourselves.

What data we process, for what purpose and on what legal basis

The table covers all data the Platform stores in its own database and object storage. We do not collect special categories of data — health, political opinions, biometrics — and we ask that they are not entered into listing descriptions.

We do not sell data, do not pass it to advertising networks and do not use it to display advertising.

The legitimate interest we rely on for sessions, logs, enquiries and the support activity log is keeping the service running, protecting dealer accounts from takeover, keeping support access to dealer dashboards accountable, and being able to evidence that a deletion request was carried out. We have balanced it against your interests and keep the minimum this requires.

Visitors to the platform website and dealer websites

The public pages — the platform website and the dealer websites on subdomains — require no registration. Their only form is «Call me back» at the bottom of a dealer catalogue (see «Callback requests from dealer websites»); there are no subscriptions or mailing lists. We ask a visitor for no other personal data.

Opening a page leaves a technical record on the server: IP address, user agent, page path, response code and timestamp. It is needed to keep the service running and to investigate a fault or an attack, and it is kept for up to 90 days.

There is no web analytics, no advertising pixels and no third-party trackers on the public pages, and no cookies are set there at all. Vehicle photographs are fetched by the Platform server from Cloudflare object storage and served by the Platform itself; the browser loads only the dealer website icon directly from Cloudflare, when the dealer has added a logo. Cloudflare sees the technical details of such a request but does not link them to your identity or profile you for advertising.

When a dealer has marked their location, the contacts block of their website carries a map. The browser loads its tiles directly from OpenFreeMap (Hyperknot Software Kft., Hungary) — only as the block nears the screen. OpenFreeMap sees the IP address and the request address, sets no cookies and does not write IP addresses to its regular logs (only to an error log kept for up to 7 days). The get-directions button is a plain link to Google Maps: Google receives data only once you press it.

If you call a dealer on the number shown on the website, or message them on a social network, that is direct communication with the dealer — the Platform neither sees nor stores it.

Callback requests from dealer websites

At the bottom of the catalogue on a dealer website there is a «Call me back» form: your name, your phone number and, if you wish, what car you are looking for. The catalogue filters you left the request with are stored with it, so that the dealer sees at once what to offer you.

• The controller of this data is the dealer on whose website you left the request. The Platform stores the request on their instructions and does not use it for its own purposes.
• Only the owner and the staff of that dealer see the request, in their dashboard; it is not passed to other dealers or third parties.
• The legal basis is your own request: you ask to be called back.
• A request is kept for 12 months and then deleted automatically; earlier as soon as the dealer deletes it or the dealer account is deleted.
• To keep the form free of spam we count attempts from one address and for one phone number. The counter holds only a SHA-256 hash, not the IP address or the number itself, and it disappears once the limit window passes (up to one day).

To change or delete a request, contact the dealer; if they do not respond, write to us.

Cookies and similar technologies

We use strictly necessary cookies only — the dashboard does not work without them. There are no advertising, analytics or tracking cookies, which is why we show no consent banner for them.

• "better-auth.session_token" (over HTTPS — "__Secure-better-auth.session_token") — the httpOnly dashboard session cookie. Signing in is impossible without it. It lives until sign-out or session expiry.
• "meta_oauth_nonce" — an httpOnly cookie holding a one-time value that proves the Facebook dialog was opened by this browser. It lives about 10 minutes and only while a channel is being connected.
• "meta_oauth_session" — an encrypted httpOnly cookie that carries the Meta user token between the return from Facebook and the page selection step. It lives 15 minutes and is erased as soon as a page is chosen.
• "tiktok_oauth_nonce" — an httpOnly cookie holding a one-time value that proves the TikTok sign-in was opened by this browser. It lives about 10 minutes and only while a channel is being connected.
• "instagram_oauth_nonce" — an httpOnly cookie holding a one-time value that proves the Instagram sign-in was opened by this browser. It lives about 10 minutes and only while a channel is being connected.
• "olx_oauth_nonce" — an httpOnly cookie holding a one-time value that proves the OLX sign-in was opened by this browser. It lives about 10 minutes and only while an OLX account is being connected.
• "better-auth.state" ("__Secure-better-auth.state" over HTTPS) — a signed httpOnly cookie that proves the Google or Facebook sign-in was opened by this browser. It lives 5 minutes and only during such a sign-in.

All seven are set on the dashboard domain. You can delete them through your browser — that is equivalent to signing out.

On the «Location» page of the dashboard the map and the address suggestions come from Google Maps. While it is in use, Google may use its own cookies and similar technologies under its own privacy policy. Dealer websites do not load Google Maps — the map there is OpenStreetMap, without cookies.

Transfers to social networks

Publishing happens only to accounts the dealer connected themselves, and only to the extent of the listing: the post text, the link to the vehicle page and the selected photographs.

• Telegram: the post is sent by the bot @car_dieller_publisher_bot, which the dealer adds as an administrator to their own channel. We receive no data about channel readers — the Bot API does not expose it. We store only the channel identifier and the message identifiers of what we sent, so that a post can later be updated or deleted.
• Instagram: publishing goes through the Instagram API on behalf of the professional Instagram account the dealer connected by signing in with Instagram; no Facebook page is needed. We store the encrypted access token (it is valid for 60 days, and we extend it while the channel stays connected), the account identifier and name, and the Instagram user identifier within our app.
• Facebook: publishing goes through the Graph API on behalf of a Facebook page. We store the encrypted page access token, the page identifier and the identifier of the Meta user who performed the connection.
• TikTok: the post is published through the Content Posting API to the account the dealer connected by signing in with TikTok. For every post the dealer chooses who can see it, whether comments are allowed and whether it is promotional. We store encrypted access tokens, the TikTok user identifier (open_id) in plain text, the account name and the post identifier.

The Meta and TikTok user identifiers are stored in plain text, unlike the tokens. This is deliberate: Meta's data deletion request and Meta's and TikTok's notices that access was revoked identify the person by that identifier alone, and an encrypted value would make it impossible to find whose tokens to erase. The Instagram user identifier is kept in plain text for the same reason: Instagram's data deletion requests and notices that access was revoked name it alone. The identifiers are not secrets and are meaningful only within our app.

Once published, a post lives by the rules of the network itself. We do not control how Meta Platforms, Telegram and TikTok further process published content, and we cannot remove a post that the dealer deleted with us but left in the network by hand. TikTok does not allow deleting a post through its API at all — it can only be removed in the TikTok app.

Placing listings on OLX

OLX is a classifieds marketplace operated by EMARKET UKRAINE LLC. A listing is placed there only from the OLX account the dealer connected themselves by signing in with OLX, and only for a vehicle the dealer chose in the "Publish" form. We work through the OLX partner API.

• What we send to OLX: the listing title and description, the vehicle details (including the VIN if one is given), the price, the photographs (OLX downloads them by link from our storage), the dealer's name and main phone number as the listing contact, the city and district and, when they were found from the map pin, its coordinates.
• When an account is connected, and when the dealer asks to find the place from the «Location» page, we send OLX the coordinates of the pin on the map so that OLX names the city and district for the listings. Without a pin, we look up the dealer's city and address on the map (through Nominatim) and send OLX the coordinates of the point found; we neither store those coordinates nor put them in the listings.
• What we store: encrypted access tokens, the OLX user identifier, name and email address, the account type, the listing identifiers and their state on OLX. Without them a listing cannot be updated with the vehicle or taken down once it is sold.

OLX decides on moderation, how long a listing is shown and what placement costs, and the dealer pays OLX for placement directly. We take down or delete a sold, withdrawn or deleted vehicle from OLX ourselves while OLX is connected. While OLX is disconnected we cannot change or take down listings already placed: they stay on OLX until the dealer connects the same account again or removes them on OLX. Listings placed on OLX other than through the Platform we neither see nor change.

Processors and transfers abroad

The Platform runs on third-party infrastructure. Each provider receives only the data its function requires.

Transfers to the United States and other countries outside the EU take place on the terms the providers themselves offer (standard contractual clauses and participation in the applicable frameworks). Publishing to Instagram, Facebook, Telegram and TikTok and placing listings on OLX are transfers initiated by the dealer: without them the service does not perform its primary function.

No email provider is connected yet: in the current version transactional email, including team invitations, is not handed to an external service. As soon as a provider is in place we will add it to this table and update the revision date.

How long data is kept

The general rule: data lives while the dealer uses the service. Platform support deletes a dealer account on request (see "How to delete your data"): the data leaves the database at once and for good — the deletion cannot be postponed or undone — a background job removes the files from storage, and the data ages out of backups within 30 days as they are overwritten.

• Social network access tokens are erased immediately when the dealer disconnects the channel in the dashboard, and likewise as soon as Facebook, Instagram or TikTok tells us that access was revoked: the person who connected the page or the Instagram account removed the app in their Facebook or Instagram settings, or the TikTok account was disconnected from the app, deleted or banned. Scheduled posts for such a channel are cancelled.
• OLX access tokens are erased immediately when the dealer disconnects OLX in the dashboard. A partner app cannot revoke access on the OLX side, so the access OLX issued, once nobody uses it, expires by itself within a month at the latest.
• The listing of a deleted vehicle is deleted from OLX — at once if OLX is connected, or as soon as the same account is connected again. The record of such a listing is kept until OLX confirms the deletion or the dealer connects another OLX account.
• Listings and photographs are deleted together with the listing; a background job removes the files from storage.
• Publication history remains while the listing it belongs to exists: without it there is no record of what went where. Only a draft or an archived listing can be deleted, and its publication history goes with it; disconnecting a channel does not touch the history.
• Buyers' callback requests — 12 months; older ones are removed by a background job.
• Technical logs — up to 90 days.
• The support activity log — 12 months; a background job removes older entries.
• Database backups are rotated and are not kept longer than 30 days.

Deleting data with us does not automatically remove a post already published to a social network. It can be removed in the dashboard with "Delete post", or by hand in the network itself. The same goes for OLX: deleting the dealer account entirely does not take its listings off OLX — take the vehicles off sale before the deletion, or remove the listings on OLX.

How we protect data

• Passwords are stored only as a hash — the password cannot be recovered from it.
• Social network and OLX access tokens are encrypted with AES-256-GCM, and the encryption key is stored separately from the database.
• Dealer data is isolated at the database level: row-level security policies prevent one dealer's query from seeing another dealer's rows even if the application code has a bug.
• All traffic to the Platform goes over HTTPS.
• Only the service owner has access to the infrastructure; the application itself uses a database role that cannot bypass the access policies.

Absolute security does not exist. If a breach occurs that puts your rights at risk, we will notify you and, where the law requires it, the competent authority.

Platform support may sign in to a dealer dashboard on behalf of one of its staff members to help or to fix a fault. Such a session lasts no longer than an hour and does not change the staff member's password. Every support sign-in to a dashboard is recorded in the support activity log, and its end is recorded when support leaves the session itself. At a dealer's request, support may also add a staff member to the team, change their role or remove them from the team — together with their account and sessions if they belong to no other dealer; every such action is recorded in the support activity log.

Your rights

In respect of data for which the Platform is the controller, you have the right to:

• know what data we process and receive a copy of it;
• correct inaccurate data or complete incomplete data;
• have data erased once there is no longer a basis for keeping it;
• restrict processing while we consider your objection;
• object to processing that relies on legitimate interest;
• withdraw consent — for example, by disconnecting a social network channel or OLX; withdrawal does not undo processing that already took place;
• receive your data in a machine-readable format in order to move it to another service;
• lodge a complaint about us with the competent data protection authority.

Send your request to dmytro.bondarchuk.wm@gmail.com from the address the account is registered to. We reply within 30 calendar days; if a request is complex, we will tell you the deadline is extended and explain why.

Rights in respect of data for which the dealer is the controller — listing content, the dealer's own contact details — are exercised by that dealer. We will help technically and pass the request on if the dealer does not respond.

How to delete your data

The right to deletion is available to every user of the Platform. Step-by-step instructions, and a status check by confirmation code, are on the "Data deletion" page: maydanchyk.com/data-deletion.

• Disconnect a channel: in the dashboard open Integrations, pick the network and press "Disconnect" — access tokens are erased immediately.
• Through Facebook: Settings → Apps and Websites → find Maydanchyk → "Remove". Facebook notifies us automatically and we erase the stored access tokens for your pages.
• Through Instagram: in the Instagram settings open "Apps and websites", find Maydanchyk and remove it. Instagram notifies us automatically and we erase the stored access tokens for that account.
• Through TikTok: in the TikTok app, remove the access of Maydanchyk in the security settings, among the permissions of apps and services. TikTok notifies us and we erase the stored access tokens for that account.
• Disconnect OLX: in the dashboard open Integrations → OLX and press "Disconnect" — access tokens are erased immediately. Listings already placed stay on OLX afterwards: take the vehicles off sale before disconnecting, or remove the listings on OLX.
• Delete the account entirely: write to dmytro.bondarchuk.wm@gmail.com from the registered address. We will delete the account, the dealer profile, the listings and the photographs within 30 days and send you confirmation. The deletion is final — the data cannot be restored afterwards. It does not take listings off OLX — do that before the request.

Children

The Platform is a business tool and is not intended for anyone under 18. We do not knowingly collect children's data. If you believe an account was created by a child, write to us and we will delete it.

Automated decisions and profiling

We make no decisions about you by solely automated means and build no profiles. The only automated processes are publishing scheduled posts, processing uploaded photographs and keeping OLX listings in sync with the vehicles — they carry out the dealer's instruction and decide nothing about you.

Changes to this policy

We may change this policy: a provider is added, the set of data changes. The current edition is always published at maydanchyk.com/privacy, and the date in the header shows when it was last updated.

We will notify dealers of changes that materially affect them at the account email address at least 14 days before they take effect. Continuing to use the service after that date means the new edition is accepted.