Privacy policy
Last updated: 21 October 2026
This is a translation for convenience; the German version is legally binding.
This version applies to visitors who are not signed in. Signed-in users find the complete privacy policy (in German) under the same address after signing in.
1. Controller
log42 GmbH, Am Lehmstich 57, 33609 Bielefeld, Germany, represented by the managing director Jan Gleitsmann
Phone: +49 170 90 34561 · E-mail: jan [at] log42 [dot] com
No data protection officer has been appointed because the legal requirements for this are not met.
2. What this is about
Carpool is a closed editorial tool of log42 GmbH for invited automotive journalists (see terms of service). Without signing in, only the home page, the sign-in page, the legal notice, this privacy policy, the terms of service, the data deletion page and individual vehicle data sheets that a user deliberately shares by link are accessible. Apart from the server logs, we store nothing about visitors. There is no advertising, no tracking and no analytics.
3. Hosting and server logs
Carpool runs on a server of log42 GmbH at Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) in a data centre in the EU; a data processing agreement is in place with Hetzner. Whenever a page is requested, the web server processes technically necessary data: IP address, date and time, requested address, amount of data transferred, status code, referrer, and browser and operating system. These logs serve secure operation and troubleshooting (Art. 6(1)(f) GDPR) and are deleted after 14 days at the latest.
4. Cookies
When you visit these public pages, Carpool sets no cookies and stores nothing in your browser’s storage. A technically necessary session cookie is only created when you sign in or open a page that requires signing in – Carpool then remembers the requested page in order to take you there after signing in. The cookie becomes invalid when you close the browser. No consent is required for this (§ 25(2) no. 2 German Telecommunications Digital Services Data Protection Act, TDDDG).
5. External content
Your browser loads the page layout (Bootstrap) from jsDelivr (cdn.jsdelivr.net); in doing so, your IP address is transmitted to the provider (Art. 6(1)(f) GDPR, fast and reliable delivery). A transfer to the USA is possible; the provider relies on the EU-US Data Privacy Framework or standard contractual clauses.
6. Interfaces to YouTube, Instagram, Facebook, TikTok and blogs
Signed-in users can connect their own channels with Carpool so that Carpool can assign their published posts as coverage. For this, Carpool uses the YouTube API Services of Google Ireland Limited / Google LLC, the Instagram and Facebook interfaces of Meta Platforms Ireland Ltd., the TikTok Login Kit, and for blogs the public WordPress REST API or the RSS/Atom feed. Carpool retrieves information about the user’s posts – such as title, publication date, thumbnail, and views, likes and the number of comments (no comment texts); thumbnails are stored on the Carpool server. The legal basis is the use of Carpool (Art. 6(1)(b) GDPR). Facebook and TikTok are connected only by the user themselves with their consent (Art. 6(1)(a) GDPR); Carpool stores the access tokens issued for this until the user removes the connection – in the Carpool settings or additionally in the TikTok app or the Facebook settings (Business integrations). For Facebook, Carpool also stores the app-scoped ID of the Facebook account used to connect, solely to match Facebook’s notifications about the removal of the app or a deletion request to the right channel. See Data deletion. No data of visitors who are not signed in is processed in this context. The YouTube Terms of Service, the Google Privacy Policy, the Meta Privacy Policy, the Instagram Privacy Policy and the TikTok Privacy Policy apply. Details are given in the complete policy for signed-in users.
7. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future. Please contact the address given above. How to remove connected channels and have data deleted is described under Data deletion.
You also have the right to lodge a complaint with a data protection supervisory authority; the authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.