Version 1.0
This is an English translation for convenience. The Dutch version is legally binding.
Privacy Statement CarTwin
Version 1.0 — 27 August 2026
CarTwin is a service of ORshoots, registered with the Chamber of Commerce under number 77785142. This statement explains what personal data CarTwin processes, why, for how long, and what your rights are.
1. Two roles
CarTwin processes personal data in two different roles. The distinction determines who you should contact with a question or request.
As data controller — for the account data: the email address, name, invoicing data, and the use of the service. CarTwin determines for itself why and how this data is processed. This statement covers that.
As data processor — for the content of the videos a customer uploads and the models that result from them. The customer determines what they film and why; CarTwin processes this exclusively on their instructions. See Article 5.
2. What data CarTwin processes
Account data Email address, name, encrypted password, and the role within the service.
Usage data The scans you create, their title and status, the timestamps, and technical metrics of the processing. Furthermore, the number of available credits and the changes thereto.
Sharing data If you share a model: the sharing link and the number of times it has been opened.
Invoicing data Company name, address, VAT number, and the details that should be on an invoice.
Technical data IP address, browser type, and timestamps of use, recorded in the logs of the service providers that CarTwin uses.
Email data Whether a sent email has been delivered, refused, or bounced.
Content of recordings and models See Article 5. This may include number plates and identifiable persons.
3. Why CarTwin processes this data
| Purpose | Legal basis |
|---|---|
| Creating the account and granting access | Performance of the agreement |
| Performing scans and making models available | Performance of the agreement |
| Tracking credits and accounting for usage | Performance of the agreement |
| Sending messages about your scans and your account | Performance of the agreement |
| Invoicing and maintaining financial records | Legal obligation |
| Securing the service and preventing misuse | Legitimate interest |
| Improving the technology based on anonymised metrics | Legitimate interest |
CarTwin does not use your data for advertising, does not sell it, and does not provide it to third parties for commercial purposes.
4. How long CarTwin retains data
Recordings and models — until the end of the availability period of the package under which the scan was performed. They are then deleted.
Account data — as long as the account exists. After termination, it will be deleted within three months.
Invoicing data — seven years, based on the fiscal retention obligation.
Technical logs — for the shortest period the respective service provider allows, as a rule no longer than a few months.
Processing metrics — anonymised, without a retention period. These contain no personal data and no visual material.
5. Videos, models and number plates
This is the part where CarTwin does not determine what is processed.
A customer uploads a video of a vehicle. This may contain number plates, and possibly also persons, bystanders, buildings or property of third parties. A number plate can be personal data. The models that CarTwin creates display number plates legibly; this is a feature of the service and not accidental.
The customer determines what they film, why, and whether they share a model. The customer is the data controller for this purpose. CarTwin processes this material exclusively to provide the service and for no other purpose.
Do you recognise yourself, your vehicle, or your property in a model? Please contact the company that made the recording and shared the model. CarTwin cannot assess your request independently and will refer you to that company. If you do not know which company it is, please let CarTwin know via service@cartwin.nl; CarTwin will then put you in touch with them.
Upon request, CarTwin will conclude a data processing agreement with a customer.
6. Service providers that CarTwin engages
CarTwin uses the following parties. Agreements have been made with each of them regarding the handling of data.
| Party | For what purpose | Where |
|---|---|---|
| Supabase | Database, storage of videos and models, logging in | European Union (Frankfurt) |
| RunPod | Computing capacity for processing the videos | European Union (Romania) |
| Lovable | Hosting of the web application and the server routes | Globally distributed infrastructure |
| Cloudflare | Network and security layer for all web traffic | Globally distributed infrastructure |
| Resend | Sending email | United States |
Where your data is stored. All storage takes place within the European Union. Videos and models are in the database and storage at Supabase in Frankfurt. During processing, a video is briefly stored in the computing environment of RunPod in Romania and is deleted from there afterwards.
Where data passes through. The web application and server routes are served via a globally distributed infrastructure, and all web traffic runs through a network layer that is also globally distributed. Your requests may therefore be handled outside the European Union, even though the storage remains within the EU. For these parties, appropriate safeguards have been put in place, in the form of Standard Contractual Clauses of the European Commission or another recognised basis for transfer.
Furthermore, CarTwin only provides data to third parties if there is a legal obligation to do so.
7. Security
CarTwin takes appropriate technical and organisational measures. Among others:
- Videos and models are stored in protected storage that is not publicly accessible.
Access is exclusively via temporary, signed links.
- Each customer can only access their own scans. This is enforced at the database level
and not just in the website.
- Passwords are stored encrypted and checked against known
leaked passwords.
- All traffic is encrypted.
- Keys for the underlying services are stored exclusively on the server and
never in the browser.
A sharing link that a customer creates themselves deliberately grants access without an account. The customer determines to whom they provide that link.
8. Cookies
CarTwin only places functional cookies and similar technologies that are necessary to log in, remember the session, and show you the correct version of the application. Consent is not required for this. CarTwin does not use advertising cookies or cookies to track you across websites.
9. Your rights
You have the right to:
- access your data;
- have incorrect data rectified;
- have your data erased;
- have the processing restricted;
- receive your data in a commonly used file format;
- object to processing based on legitimate interest.
Send your request to service@cartwin.nl. CarTwin will respond within one month. To prevent misuse, CarTwin may ask you to identify yourself.
If your request concerns the content of a video or a model, please first read Article 5 — in that case, you should contact the customer who made the recording.
10. Complaints
If you do not agree with how CarTwin handles your data, please let us know via service@cartwin.nl. You also always have the right to lodge a complaint with the Dutch Data Protection Authority.
CarTwin has not appointed a Data Protection Officer; this is not mandatory for an organisation of this size and nature.
11. Changes
CarTwin may amend this statement. The current version is always on the website, with the date at the top. In the event of substantive changes, customers will be informed by email.
12. Contact
ORshoots — CarTwin Schildersplein 211 5172 BD Kaatsheuvel KvK 77785142 service@cartwin.nl