Developer research dashboard

After a new, explicit site-analytics opt-in, first-party research records route templates, page entries, click categories and coarse coordinates, maximum scroll depth, visible time, device class, and online-session heartbeats. Signed-in visits may be associated with your account identifier and display name for authorized administrators; guests are represented by random 30-minute session identifiers. Research does not attempt to identify guests across sessions or devices.

A separate record of committed messaging metadata covers marketplace, applicant-assistance, and staff messages: participating account identifiers, channel, conversation or assignment identifier, and send time. It supports research on communication flows and operating the service under proportionate documented legitimate interests, subject to applicable rights to object. Collection begins with rollout and does not backfill historical messages. No message body or attachment is copied into this dashboard.

Only active administrators with multi-factor authentication can read or export these research records. Browser collection stops when you withdraw analytics consent; Do Not Track and Global Privacy Control also suppress it. Authentication pages, administrator pages, private document/detail routes, form values, keystrokes, search strings, IP addresses, and raw page identifiers are excluded.

Research records are deleted in bounded maintenance batches after 30 days; deletion may require additional cycles while a backlog clears. Research exports must be secured, used only for this purpose, and erased on the same schedule. Original operational records and backups have separate retention. Cookie settings controls browser collection; the data-request process covers access, objections, and erasure where applicable.

Operator and policy status

This is a draft notice for Kardel. The legal operator name, public business address, and monitored privacy contact have not been set. The Business details page identifies this gap. This draft does not certify legal compliance.

The service is principally intended for the Philippine market. A visitor’s nationality alone does not determine whether GDPR or Japan’s Act on the Protection of Personal Information (APPI) applies. Applicable protections depend on the activity and territorial scope of each law.

Information and purposes

Account identifiers, name, email or mobile number, sign-in and device records support account access, security, and account recovery. Optional contact verification is separate from marketing consent.

Listings, storefronts, uploaded media, saved vehicles, messages, and reports support browsing, inquiries, and moderation. Public listing and storefront information is visible to other visitors.

Vehicle applications and financing reviews can include contact and address details, date of birth, employment and income information, identity evidence, and information supplied about a spouse, guarantor, references, or dependents. The current forms collect some family details; their necessity and the handling of children’s data require review before launch. Do not submit another person’s information without authority and an applicable notice.

Kardel messages are hosted by us and are not end-to-end encrypted. Authorised staff may review a specific conversation for a participant report, abuse, fraud, safety, or a legal obligation; messages are not available through a general administrator inbox.

Optional first-party site and listing analytics uses a browser identifier and limited acquisition information only after you opt in. Security and operational logs are separate. The Cookie policy explains browser storage and external media.

Kardel may store invoice, payment instruction, proof review, cash receipt, and hosted-checkout references where those features are enabled. A submitted proof or checkout return is not confirmed payment. Kardel does not provide escrow. The named payee and payment provider for each transaction must be identified before payment.

Legal grounds and consent

The proposed processing grounds are steps you request before a contract and service performance for account and inquiry functions; applicable legal obligations; and proportionate, documented legitimate interests for security and abuse prevention. Consent is used for optional analytics, external homepage video, SMS choices, and specified disclosures that require it.

Philippine sensitive personal information, including certain identity, age, marital, health, or education information, requires a separate ground permitted by Section 13 of the Data Privacy Act. A general privacy checkbox or a legitimate-interest claim alone does not authorise it. The operator must complete a field-level purpose and legal-basis assessment before these workflows launch.

Where GDPR applies, special-category data requires an Article 9 condition in addition to an Article 6 basis. Where APPI applies, acquisition of special care-required personal information generally requires prior consent unless an exception applies. These categories are not identical across the three laws.

Optional choices must be separate from accepting service terms. You can withdraw optional browser consent in Cookie settings without losing access to browsing or applications. Withdrawal does not undo processing that was lawful before it.

Recipients and disclosures

Authorised seller reviewers and assigned or attributed agents may receive application information within their permitted scope. Assigned financing institutions receive application evidence and quotations under the authorization recorded at financing submission, or a one-time financing terms confirmation for an earlier application. Assignment does not require another buyer approval. Access remains limited to that application and stops when withdrawn or when the review closes. A lender’s own notice and assessment remain separate from Kardel’s.

After a seller records an external vehicle sale as completed, the credited Kardel agent can see the customer's confirmed or staff-attested shareable email and mobile number in Sales History. The active assisting agent receives credit first; if none is active, the referring agent may receive it. Agents cannot search another agent's ledger. Assisted applicants’ contact details are stored separately from a private sign-in username.

The code integrates Supabase for authentication, infrastructure for hosting and media storage, Resend for email, and Twilio for SMS when enabled. Google receives connection information for hosted icon fonts and when you choose Google sign-in. Mux receives connection information when you permit the homepage video; player analytics is disabled.

Google Cloud Translation can process public listing or storefront text when translation is enabled. IndexNow can receive published page URLs for search discovery. Seller-provided external video and contact links take you to separate services when opened.

Provider contracts, enabled services, processing locations, onward transfers, and any identity-verification provider must be confirmed before this notice is final. Information may also be disclosed where required by a valid legal obligation.

Retention and security

Retention must be tied to the purpose and any applicable recordkeeping requirement. Current code has separate schedules for verification evidence, application documents, messages, analytics, notifications, and audit records. No single deletion deadline applies to every document.

The final schedule must identify each category’s period or criteria, backup expiry, legal holds, and how deletion is verified. Automated jobs in source code are not proof that production deletion has completed. This draft makes no blanket 90-day promise.

Access controls and scoped review limit who can use records. No system can guarantee perfect security. The operator must maintain incident response, processor oversight, and applicable breach-notification procedures.

Your Philippine rights

Under the Data Privacy Act, applicable rights include being informed, access, objection, correction, erasure or blocking, data portability, indemnification where available, and complaint to the National Privacy Commission. Conditions and lawful exceptions can apply.

The Data requests page explains how to request access, correction, account closure, deletion, or consent withdrawal. Its contact action remains unavailable until a monitored privacy address is configured. You do not need to send an ID copy with an initial request. Proportionate identity checks may be needed before disclosure or deletion.

Additional EEA rights where GDPR applies

You may have rights to access, rectification, erasure, restriction, portability, objection, and withdrawal of consent, and to complain to your competent supervisory authority. You may object to direct marketing at any time.

Requests must be answered without undue delay and normally within one month of receipt. Where legally permitted because of complexity or number, an extension of up to two further months requires notice and reasons within the initial month. Any refusal must explain its grounds and available complaint or judicial remedies.

The operator must identify any applicable EU representative or data protection officer and disclose any qualifying automated decisions, their logic, significance, and consequences before use. This draft does not assert that every decision is human or that all such assessments are complete.

Additional Japan rights where APPI applies

Purposes of use must be specified and notified or published as required. Requests may include notification of purposes, disclosure of retained personal data and applicable third-party provision records, correction, and cessation of use, erasure, or cessation of third-party provision on statutory grounds.

The operator must publish the required business identity, address, representative information where applicable, request procedures, and information about safeguards. Responses and reasons for decisions must follow APPI; GDPR’s one-month period is not presented as an APPI rule. Complaints may be directed to Japan’s Personal Information Protection Commission.

International processing and changes

Providers may process information outside your country. Actual recipient countries and safeguards are not yet verified. Before covered transfers, the operator must meet Philippine accountability requirements and, where applicable, GDPR Chapter V and APPI foreign-transfer requirements.

The operator must identify the relevant transfer basis and provide required information about safeguards. This page does not claim that standard contractual clauses, an adequacy decision, or foreign-transfer consent is already in place. Material changes require an updated notice and fresh consent where necessary.

Children and other people’s data

Kardel proposes an 18-and-over account and applicant policy. This is a service eligibility rule, not a universal statutory age for privacy consent.

Adult eligibility does not resolve the collection of children’s information in dependent fields. Those fields require a documented necessity assessment, an appropriate legal basis and guardian process where required, and understandable notices before launch. A parent’s account or a generic checkbox is not a substitute.