Privacy Policy
LuWay – Vehicle Owner Search & Auto Marketplace
✅ YOUR DATA, YOUR CHOICE — IN SHORT
Everything you give Luway, you give voluntarily. Nobody is obliged to provide personal data to use Luway, beyond what is technically required to have an account (an email address or a Google / Apple sign-in).
- Voluntary data. Your name, photo, phone numbers, city, cars, plate numbers, documents, posts, comments, gifts and location are added only by you, only if you want to. You can leave any of them out and still use the app.
- You decide what is public. Phone numbers, city, gifts and profile details each have a visibility setting (Settings → Edit profile). A plate number is shown only after you add the car yourself.
- Location is used only when you allow it (SOS, drivers nearby, fuel prices) and you can turn it off at any time in your phone's settings.
- Notifications can be switched off at any time, in the app or in the phone's settings.
- Change or remove anything, any time. You can edit or delete your posts, comments, cars, photos, phone numbers and profile details whenever you want.
- Delete your account at any time, free of charge and without giving a reason: Profile → Settings → Delete account. Your profile, cars, listings, posts and personal data are removed from the app immediately; a protected copy is kept for 30 days only for legal obligations and fraud prevention, then permanently erased. Messages you sent may remain visible to the people you sent them to.
- Withdraw your consent for any optional processing at any time; this does not affect processing done before.
- We do not sell your personal data and we do not share it with advertisers.
- Your rights: access, correction, deletion, restriction, portability and objection (GDPR / Law 195/2024 of the Republic of Moldova). Write to info.studio085@gmail.com — we answer within 30 days.
- Content that breaks the community rules can be reported by anyone; content reported by several people is removed automatically and its author is notified with the reason.
📜 Copyright
Certificate of Registration of Copyright and Related Rights Series PC Nr. 8403 dated 20.01.2026 Issued by the State Agency on Intellectual Property of the Republic of Moldova
© All Rights Reserved Authors: Alexandrov Pavel and Macovschi Tudor-Alexei
Effective Date: December 1, 2025 Last Updated: August 24, 2026 (Compliance with Law 195/2024) Version: 2.0
⚠️ IMPORTANT: By creating an account or using LuWay, you expressly confirm that you have read, understood, and fully accepted this Privacy Policy and Terms and Conditions.
If you do not agree, please do not use the application.
📋 2026 UPDATE: This Policy has been updated for compliance with Law No. 195/2024 on personal data protection of the Republic of Moldova (in force August 23, 2026), which transposes GDPR (EU) 2016/679 and replaces Law 133/2011.
1. Data Controller
Your data is processed by:
Alexandrov Pavel – natural person, citizen of the Republic of Moldova Address: Chisinau, Republic of Moldova Email: privacy@studio085.com Phone: +373 6840 1239
Within the meaning of Law 195/2024 / GDPR (EU Regulation 2016/679), Alexandrov Pavel is the Data Controller.
2. What Data Do We Collect?
2.1 Data Provided Directly by You
• First and last name (optional) • Email address (optional – when signing in via email) • Phone number – OPTIONAL (used only for verification and account recovery) • Profile photo (optional) • Data from published listings (brand, model, year, price, photos, description) • License plate numbers searched or entered • Messages sent to other users • Payment data for subscriptions (processed exclusively via Apple App Store, Google Play, and Stripe)
2.2 Automatically Collected Data
• IP address • Device type and model, OS version • Device ID (IDFA / Advertising ID – only with your consent for personalized ads) • Precise and approximate location data (only with explicit permission) • Technical data (crash logs, usage time, errors)
2.3 Location Data (detailed)
We collect location only if you grant explicit permission in the app:
Precise location (GPS) – for distance calculation, navigation, displaying local listings Approximate location – for regional filters and local pricing Background location – ONLY during active navigation and with separate consent
❌ We NEVER use background location for tracking or advertising
2.4 Stripe Payments (if you choose direct in-app payment)
When purchasing Premium/Dealer subscriptions via card:
• Card data (number, expiration date, CVV) NEVER reaches us • Transmitted directly to Stripe Inc. (USA) – PCI DSS Level 1 certified payment processor • We only receive a secure token and the last 4 digits of the card • Stripe stores card data encrypted and automatically deletes after expiration
✅ Bank card data is NOT stored on our servers and CANNOT be accessed by anyone on the LuWay team.
3. Where and How Do We Store Your Data?
All data is stored exclusively in Google Firebase (Google Cloud) – certified data centers:
• ISO 27001, 27017, 27018 • SOC 1/2/3, PCI DSS Level 1 • 100% GDPR compliance • AES-256 encryption at rest + TLS 1.3 in transit
🔒 Your data is NOT and will NEVER be sold, rented, or transmitted to third parties for purposes other than those strictly necessary for LuWay's operation.
4. What Do We Use the Data For? (Purposes and Legal Bases)
Pursuant to Law 195/2024 / GDPR Art. 6, we process data only on an identified legal basis:
| Purpose | Legal basis (Art. 6) |
|---|---|
| Searching and contacting owners by license plate number | Consent + legitimate interest |
| Publishing and managing auto listings | Performance of contract |
| Distance calculation, Google Maps navigation | Explicit consent (location) |
| Processing payments and subscriptions | Performance of contract |
| Notifications about messages, offers, account updates | Performance of contract + consent |
| Fraud and abuse prevention | Legal obligation + legitimate interest |
| App improvement, analytics | Legitimate interest (anonymised) |
| Direct marketing, promotions | Explicit consent (withdrawable) |
| Cooperation with authorities upon legal request | Legal obligation |
You may withdraw consent at any time: Settings → Privacy → Manage Consents or at privacy@studio085.com.
5. Who Do We Share Data With? (Recipients and International Transfers)
5.1 Recipients
| Provider | Purpose | Country | Transfer mechanism |
|---|---|---|---|
| Google Firebase | Storage, authentication, analytics | USA / EU | SCCs + ISO 27001 |
| Stripe Inc. | Card payment processing | USA | SCCs + PCI DSS Level 1 |
| Apple App Store | iOS subscriptions | USA | SCCs + Apple regulations |
| Google Play | Android subscriptions | USA | SCCs + Google regulations |
| Google Maps API | Navigation, distance calculation | USA | SCCs |
5.2 International Transfers (Law 195/2024 / GDPR Chapter V)
All transfers outside the Republic of Moldova are made under Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914/EU), ensuring an equivalent level of protection.
5.3 Authorities
We disclose data to authorities exclusively upon valid written legal request (court order, criminal investigation warrant). No voluntary access without legal basis.
6. Partner Offers (service, insurance, dealers)
All offers and ads in the app appear only based on prior agreement with the partner. Partners have NO direct access to your personal data unless you initiate contact.
7. Your Rights (Law 195/2024 / GDPR Art. 13–22)
You have the right AT ANY TIME and FREE OF CHARGE to exercise:
| Right | What it means | Response time |
|---|---|---|
| Access (Art. 15) | Copy of all data processed about you | 30 days |
| Rectification (Art. 16) | Correction of incorrect or incomplete data | 30 days |
| Erasure (Art. 17) | "Right to be forgotten" — deletion when no longer necessary | 30 days |
| Restriction (Art. 18) | Temporary suspension of processing | 30 days |
| Portability (Art. 20) | Data in machine-readable JSON/CSV format | 30 days |
| Objection (Art. 21) | Against processing based on legitimate interest or marketing | Immediately (marketing) |
| Automated decisions (Art. 22) | We do not subject you to solely automated decisions with legal effects | Permanent |
| Withdraw consent (Art. 7) | Without penalty, without retroactive effect | Immediately |
How to exercise your rights:
- 📧 Email: privacy@studio085.com
- 📱 In-app: Settings → Account → Privacy Rights
- 📞 Phone: +373 6840 1239 (Mon–Fri 9:00–18:00)
Supervisory authority: 🏛️ CNPDCP (National Center for Personal Data Protection)
- www.datepersonale.md · centru@datepersonale.md · (022) 820 801
It is not mandatory to contact us before lodging a complaint with CNPDCP, but direct resolution is usually faster.
8. How Long Do We Keep Data?
• Active account → as long as you use the app • After account deletion → data permanently deleted within 30 days • Technical logs → maximum 12 months • Stripe payment data → kept only by Stripe according to law
9. Protection of Minors (Law 195/2024)
The application is intended for persons of minimum 16 years of age.
- Under 16: may not create an account or use the services; we do not knowingly collect data from minors under 16.
- 14–15 years: pursuant to Law 195/2024, if access is necessary, written consent of the parent or legal guardian is required, verifiable upon request.
- If we discover an underage account created without parental consent: account deleted immediately, all associated data removed within 30 days.
⚠️ We do not display behavioural advertising to minors and do not use their data for marketing purposes.
10. Security Breach Notification (Art. 33–34, Law 195/2024)
In the event of a security incident (unauthorised access, loss, unauthorised disclosure):
- ⏱️ 72 hours — we notify CNPDCP from discovery of the breach, if it poses a risk to your rights
- 📧 Without delay — we notify you personally if the breach poses a high risk to your rights and freedoms
- The notification will contain: nature of the breach, categories of data affected, approximate number of persons affected, likely consequences, measures taken
11. Data on Luway Credits (L-Coins) and Boosts
If you purchase Luway Credits (L) or activate Listing Boosts, we additionally collect:
- Transaction history with the virtual currency (purchases, expenses, balance)
- Boost activity (boost type, boosted listing, date, cost)
- Auto-republish history (schedule: days, time, period)
Legal basis: Performance of contract (IAP purchase) + legitimate interest (fraud prevention) Retention: While account is active + 30 days after deletion
12. Policy Changes
Any significant change will be announced at least 30 days in advance via:
- 🔔 Push notification in the app
- 📧 Email to the address associated with your account
- 📌 Visible banner upon opening the app
Continued use after changes take effect constitutes acceptance.
13. Contact & Data Protection Officer
Controller: Alexandrov Pavel – natural person, citizen of the Republic of Moldova General email: info.studio085@gmail.com Website: https://luway.app
Contact for data rights (Law 195/2024): 📧 privacy@studio085.com · 📞 +373 6840 1239 ⏰ Response within max. 30 days (usually 48 hours, business days)
⚠️ DPO Note: Pursuant to Law 195/2024, appointment of an independent Data Protection Officer (DPO) is required for operators processing location data and conducting systematic monitoring. LuWay processes location data and license plate numbers, activities that may require a DPO. We commit to appointing an independent DPO by 31 December 2026 or earlier if CNPDCP requires. Until then, all requests are handled by Alexandrov Pavel at the address above.
🏛️ CNPDCP — www.datepersonale.md · centru@datepersonale.md · (022) 820 801
By continuing to use LuWay you confirm that you have read and fully accepted this Privacy Policy.
© 2025 Studio 085 – Alexandrov Pavel. All rights reserved.