Privacy Policy

Last updated: 29 October 2026

This policy explains what personal data Rarespec collects, why, who we share it with and what your rights are. Rarespec (rarespec.eu) is a curated classifieds site for rare used car parts and wheels. We review every listing before it goes live. Buyers and sellers arrange the deal between themselves; we do not take payments for parts.

1. Who we are

The data controller is Justinas Beneckas, a natural person carrying out individual activity in Lithuania under individual activity certificate (individualios veiklos pažyma) no. 1274994, at Kalvarijų g. 188A-44, Vilnius, Lithuania ("Rarespec", "we", "us").

Contact for anything about your data: info@rarespec.eu.

2. What we collect

Account data. When you sign in with Google we receive your name, email address and Google account ID. We create a profile with that name and email. You can add a phone number in Account settings.

Listing data. When you list a part we store what you enter: title, description, brand, part number, car fitment, condition, specifications, price, photos, city, country and delivery options. We also keep a history of each listing's status changes (submitted, info requested, approved, rejected, hidden, sold) and any notes our admin writes during review.

Contact reveals. When a signed-in buyer clicks to see a seller's contact details, we log who revealed which listing and when. This lets us limit reveals (currently 50 per 24 hours) and spot misuse. Sellers can see how many times their listing's contact was revealed, not by whom.

Wishlist. The listings you save. Admins can see counts only, to understand demand.

Marketing emails. If you sign up on the home page or turn on "Marketing emails" in Account settings, we store your email address and your choice. You can turn it off at any time.

Emails you send us. If you write to info@rarespec.eu (for example to report a listing, request featuring, or delete your account), we keep the conversation.

Featured listing payments. Featuring is paid by bank transfer outside the site. When you pay, our bank shows us the payer's name, bank account number (IBAN) and payment reference. We use these only to match your payment to your request and for our invoices and accounts. We keep the invoice details (name, email, and billing address if you give one).

Moderation records. If an account is suspended or a listing is taken down, we keep the reason and the date.

Technical data. Our hosting and database providers process your IP address and basic request data (browser, time) to deliver the site and keep it secure. We do not run analytics or advertising trackers.

The site itself never asks for bank or card details.

3. What other users see

• Public: your listings (title, description, photos, specs, price, city, country, delivery options). Your name is never shown.
• Signed-in buyers who click "reveal contact": the seller's email address and phone number (if added). Your name is not shown.
• Our admins: everything in section 2, to review listings and run the site.

Please don't put personal details (your name, address, number plates of a car you own) in listing text or photos.

4. Why we use it and our legal basis (GDPR)

We don't make decisions about you using fully automated processing. Every listing is reviewed by a person.

5. Who we share it with

We use these providers (processors) to run the site. They only process data on our instructions.

Where data goes outside the EEA, we rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.

We also share contact details with buyers as described in section 3, and we may disclose data if the law requires it (for example to the police or a court). We never sell your data.

6. How long we keep it

• Account data: while your account exists. After you ask us to delete it, we delete or anonymise it within 30 days.
• Listings and photos: while your account exists, or until you delete the listing (drafts, info-requested and rejected listings can be deleted by you).
• Contact reveal logs: 12 months, then deleted.
• Moderation records: 24 months after the event, so suspended users can't simply re-register.
• Marketing list: until you unsubscribe.
• Invoices, bank transfer records and accounting records: as long as tax law requires (currently 10 years under Lithuanian law).
• Emails to info@: 24 months.

7. Your rights

You can ask us to:

• give you a copy of your data (access and portability),
• correct it (you can also edit your name and phone in Account settings),
• delete it,
• restrict or object to how we use it,
• stop marketing emails (toggle in Account settings or the unsubscribe link in any marketing email).

Write to info@rarespec.eu. We reply within one month. To delete your account, email us from the address on your account.

You can also complain to your data protection authority. Ours is the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt).

8. Cookies

We only use strictly necessary cookies: the sign-in cookies that keep you logged in (set through Supabase). We don't use analytics, advertising or tracking cookies, or store tracking data in your browser's local storage, so we don't show a cookie banner. If that changes, we will ask for your consent first and update this policy.

9. Security

Photos are stored in a private storage bucket, contact details are only released through a logged, rate-limited action, and access to data is restricted at the database level. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

10. Children

Rarespec is for people aged 18 and over. We don't knowingly collect data from children.

11. Changes

We may update this policy. We'll change the date at the top, and email you about important changes.