CarWhoWa Privacy Policy

Last updated: 28 October 2026

Welcome to CarWhoWa (also referred to below as “the Service”).

The Service is operated by Next Innovation Ltd. / 勝崨有限公司 (referred to below as “the Company”, “we”, or “us”).

We take users’ privacy and personal-data protection seriously. This Privacy Policy explains how we collect, process, use, retain, and protect personal data when we provide the CarWhoWa website, owner-member services, parking QR Codes, move-car notices, subscription payments, and related features, and how you may exercise your rights.

This Policy is based on the laws of the Republic of China (Taiwan). Where the Service involves users in other countries or regions and local personal-data rules apply, we will also meet those applicable obligations.

This Policy applies to members of the Service, people who scan a parking QR Code to contact an owner, and other users who interact with us through the Service.

Please read this Policy before using the Service. Providing a privacy policy does not mean you have consented to every personal-data processing activity. Where consent is required by law, we will obtain it separately as applicable law requires.

1. Key definitions and the data collector

(1) Data collector

The Company is the collector of personal data related to the Service and, depending on the actual processing and applicable law, bears corresponding personal-data protection duties.

(2) Definitions

Personal data: information that can directly or indirectly identify a natural person, including name, contact details, online identifiers, and other information that can be linked to a specific individual.

Owner member: a user who registers an account through the Service, manages vehicles, and uses a parking QR Code.

Scanner / contacting person: a person who scans a parking QR Code and contacts the owner through the web page. Scanners do not need to register as members.

Parking QR Code: a QR Code provided by the Service that links to a specific vehicle’s contact page.

Third-party services: external services we use to provide login, notifications, cloud computing, payments, invoicing, analytics, advertising, and similar functions.

2. Personal data we collect

We collect personal data that is necessary for each use case and service need.

(1) Owner-member data

When you register, create vehicle records, or use the Service, we may collect:

This data is used mainly to create accounts, manage vehicles, send move-car notices, keep the Service running, and handle member requests.

(2) Third-party login information

The Service supports LINE Login and Google Login.

When you choose to sign in through a third-party platform, we may receive, within the scope you authorize:

The data actually received depends on the scope you authorize, what the platform provides, and the fields the Service needs.

We do not obtain the password you use on that third-party platform.

(3) Scanner data

When you scan a CarWhoWa parking QR Code and use the contact page, you do not need to register or provide your name, email, or mobile number.

To provide contact features, keep the system secure, and handle abnormal use, the Service may process:

Do not put sensitive personal data in a message unless it is needed for parking contact.

If you voluntarily write a name, phone number, or other identifying information in a message, that content may be passed to the owner with the message.

(4) Move-car notices and conversation data

To provide parking contact, we may process:

This data is used to send notices, display conversations, calculate plan quotas, maintain service quality, and handle disputes.

(5) Payment and e-invoice data

When you buy a paid plan or use related transaction features, we may collect and process:

The Service uses third-party payment providers to process payments.

Full card numbers and security codes are handled by the relevant payment providers under their own mechanisms. We do not make storing full card numbers or security codes a condition of providing the Service.

(6) Data you provide through support

When you contact support, ask a question, request a refund, or exercise personal-data rights, we may process:

(7) Data generated automatically

When you use the Service, the system may automatically generate:

This information may be used to keep the Service running, for security, troubleshooting, traffic analysis, and other uses permitted by law.

3. Purposes and ways we use personal data

We collect, process, and use personal data for specific purposes needed to provide the Service and as allowed by applicable law.

(1) Main purposes

  1. Member and identity management: creating accounts, handling third-party login, verifying identity, and maintaining member records.
  2. Vehicle and QR Code management: creating vehicle records, generating and managing QR Codes, and keeping vehicles linked to contact details.
  3. Move-car contact and notices: receiving messages, sending notices, managing notice counts, and displaying contact information.
  4. Subscriptions and transactions: handling plan purchases, payments, renewals, refunds, e-invoices, and related billing.
  5. Support and disputes: answering questions, handling complaints, investigating abnormal use, and resolving transaction or service disputes.
  6. Information security: detecting unusual traffic, keeping the system stable, and preventing unauthorized access and abuse.
  7. Service analysis and improvement: analysing how the site is used and improving flows and quality.
  8. Advertising and operations: displaying ads, measuring ad performance, and supporting operations, in line with applicable law and your privacy choices.
  9. Legal compliance: meeting tax, accounting, consumer-protection, personal-data, and other legal duties.

(2) Period, region, recipients, and methods of use

Period: for as long as each collection purpose exists, while a contract relationship lasts, and for periods required by law or other legitimate necessary purposes. Retention by data type is described in Section 5.

Region: Taiwan, and other countries or regions where our cloud, messaging, payment, analytics, and advertising providers process data.

Recipients: personnel we authorize by law, vendors and processors needed to provide the Service, and others who may receive data as required by law. How owner contact details and scanner messages are disclosed is also described in this Policy.

Methods: collection, recording, storage, query, transmission, update, deletion, and other lawful processing, automated or not, through websites, databases, APIs, messaging platforms, and other necessary systems.

(3) Necessary data and optional data

Some personal data is required to create an account, send move-car notices, process transactions, or meet legal duties.

If you refuse to provide necessary data, you may be unable to use member registration, vehicle management, move-car notices, payment, or related features.

Scanners do not need to register, but using the contact page may still generate technical records needed to provide the Service and keep it secure.

For processing that is not necessary, we will provide notice, choice, or consent as applicable law requires.

(4) Use beyond the original purpose

We will not arbitrarily use personal data for purposes unrelated to the original collection purpose.

Where the law requires a separate consent, we will explain the use and obtain valid consent before that use begins.

4. Third-party services, data sharing, and contact-information disclosure

(1) Third-party providers

To provide the Service, we use the following third-party services:

Category Provider Main use
Cloud infrastructure Cloudflare Workers, D1, R2, and related site, compute, and data processing
Cloud and email Amazon Web Services (AWS) SES email and related cloud services
Member login LINE Login Third-party account login
Member login Google Login Third-party account login
Move-car notices LINE Messaging API Sending move-car notices
Move-car notices Telegram Bot API Sending move-car notices
Site analytics Google Analytics (GA4) Traffic and usage analysis
Search management Google Search Console Search performance and site management
Advertising Google AdSense Ad display and related measurement
Payments PayUNi Payments, transactions, and refunds
E-invoices Third-party e-invoice providers Invoice issuance and related tax processing

These third parties may receive, store, or process related data to the extent needed to provide their services.

How each provider handles data may also be governed by its own privacy policy and applicable law.

We will take appropriate measures, according to the actual engagement, to manage the scope of processing and security requirements.

(2) Passing scanner messages to the owner

When a scanner sends a message through a parking QR Code, the Service provides the message content needed for contact to the corresponding owner, so the parking-contact purpose can be completed.

Scanners do not have to provide a name or phone number.

If a scanner reveals personal information in the message, the owner may learn that content.

The Service does not, merely because a scanner opened the contact page, give the owner the scanner’s full IP address or device technical logs as ordinary contact information.

(3) Rules for showing the owner’s phone number

CarWhoWa lets owners configure how they can be contacted.

Owners may choose to display a phone number immediately, or to receive move-car notices through the QR Code first.

To reduce the risk that an urgent contact need is blocked because the owner does not reply in time, the Service has a phone-number display mechanism.

When either the notice count or the waiting time reaches the system threshold, the contact page will show the phone number the owner provided.

At that point, anyone who opens the corresponding QR Code contact page may obtain that number and call it.

Even if an owner chooses message-first contact, the Service does not guarantee that the phone number will stay hidden in every situation.

Owners should understand this contact mechanism before creating and using a QR Code, and should confirm that the number they provide is suitable for parking contact.

(4) Disclosure required by law

Where required by law, lawful legal process, or a competent authority’s lawful request, we may provide related data to the extent necessary.

(5) Corporate transactions or organizational change

If the Company merges, transfers its business, reorganizes, or otherwise hands over the Service, related data will be transferred in accordance with applicable law and any required notice or consent.

(6) International transfers of personal data

The Service is offered to users worldwide and uses cross-border cloud and third-party technology services.

Your data may therefore be stored, accessed, processed, or transmitted outside Taiwan.

We will handle cross-border transfers under Taiwan’s personal-data laws and other applicable law, and will take contractual, technical, or organizational safeguards where needed.

Data-protection laws differ by country or region. Transferring data abroad does not by itself relieve us of personal-data duties we owe under law.

5. Retention, deletion, and information security

(1) Retention principles

We set retention periods by data type, collection purpose, service need, legal duty, and the need to handle disputes.

When the purpose ends or the retention period expires, we will delete the data, stop processing or using it, or take other necessary steps according to applicable law and the actual state of the data.

(2) Member and vehicle data

Member accounts and vehicle data are usually kept for as long as needed to provide the related service.

When a member asks to delete an account or stop using the Service, we handle different data types separately.

Transaction, invoice, accounting, or other records that must be kept by law may not be deleted at the same time as member-account data.

(3) Move-car conversation records

Different member plans may offer different viewing windows for conversation history.

After a conversation exceeds the plan’s viewing window, it stops being shown to the member. That does not mean the data has already been deleted from backend systems.

Data kept on the backend remains limited to what is needed for service maintenance, necessary records, dispute handling, information security, or other lawful purposes.

We will handle later deletion or cessation of use according to each data type’s retention rules and applicable law.

(4) Payment, invoice, and transaction records

Payment, subscription, refund, e-invoice, and related billing data may be kept for the periods required by tax, accounting, and other applicable law.

Even after a member account is deleted, data that must still be kept by law may be retained until the statutory period ends.

(5) System logs and backups

To keep the system secure, fix faults, handle anomalies, and maintain data integrity, the Service may keep necessary system logs and backups.

Backup deletion or overwrite times may differ from deletion in the primary database.

We will manage backup retention, access, and deletion according to the nature of the data and applicable law.

(6) Security measures

We take technical and organizational security measures appropriate to the nature of the personal data and the processing risk, including:

The internet and information systems cannot be guaranteed free of all security risk. We will continue to maintain data security according to actual operations and applicable law.

(7) Personal-data security incidents

If a security incident involving personal data occurs, we will investigate, contain, remediate, and notify as required by the nature of the incident, its impact, and applicable law.

Where the law requires notice to data subjects or authorities, we will follow those rules.

6. Your personal-data rights and cookie choices

(1) Rights under Taiwan’s Personal Data Protection Act

Under Article 3 of Taiwan’s Personal Data Protection Act, you have the following rights regarding your personal data:

  1. To inquire or request to review it.
  2. To request a copy.
  3. To request supplementation or correction.
  4. To request that collection, processing, or use be stopped.
  5. To request deletion.

These rights may not be waived in advance or limited by contract.

You may send requests to [email protected].

To prevent impersonation or improper access, we may verify the requester’s identity to the extent necessary.

We will handle requests within the procedures and time limits set by applicable law. If we may lawfully refuse all or part of a request, we will do so under the relevant rules.

If some data cannot be deleted immediately because of legal duties, transaction-record retention, dispute handling, or other legitimate necessary reasons, we will handle it according to law and explain the reason where appropriate.

(2) Data-protection rights in other applicable regions

Where the law of your region applies to particular processing by the Service, you may also have rights to:

The scope and conditions of these rights follow the relevant law.

Withdrawing consent does not affect processing that was lawful before the withdrawal.

(3) Cookies and similar technologies

The Service and related third-party services may use cookies, browser storage, or similar technologies.

Depending on purpose, these may include:

Necessary technologies: used for login, authentication, site security, and basic features you request.

Analytics technologies: used to understand traffic, how pages are used, and to improve quality, such as Google Analytics (GA4).

Advertising technologies: used to display ads, measure performance, control frequency, and, where applicable and lawful, provide personalized ads, such as Google AdSense.

Related data may include cookie IDs, IP addresses, browser information, device information, and site-interaction records.

Such data is not necessarily anonymous. If it can identify a person directly or indirectly, personal-data law may still apply.

(4) Third-party advertising

The Service uses Google AdSense to display ads.

Google and its advertising-technology partners may, under their mechanisms and applicable law, use cookies or other identifiers to handle ad display, measurement, and related data.

You can learn about or manage some advertising privacy settings through:

Google’s settings may affect only certain ad uses. They do not mean all necessary processing or third-party logs will stop.

(5) Cookie management and consent

You can manage, limit, or delete cookies in your browser settings.

Disabling necessary cookies or related browser storage may stop login or some features from working.

Where applicable law requires prior consent for non-essential cookies, advertising identifiers, or tracking, we will obtain valid consent before that processing.

Where the law requires a way to refuse or withdraw consent, we will provide a corresponding choice.

(6) Site analytics and search services

The Service uses Google Analytics (GA4) to analyse traffic and usage, and Google Search Console to manage how the site appears in search.

How those services collect and process data depends on the features in use, our settings, and the providers’ rules.

7. Children’s privacy

The Service allows minors to register and use member features after obtaining any consent that applicable law requires from a legal guardian.

Minors and their guardians should confirm, under applicable law, the consent or authorization needed to register, use the Service, and make subscription purchases.

We do not make collecting unnecessary personal data from minors a condition of providing the Service.

If a guardian finds that a minor provided personal data without the required consent, they may contact [email protected] to inquire, correct, delete, or make other requests allowed by law.

Because the scan-to-contact feature does not require registration, minors may also reach the public contact page. We will handle related data under applicable law, and we remind users not to reveal unnecessary personal information in messages.

Age, consent, and personal-data rules for minors differ by country or region. If applicable law requires extra safeguards, we will follow them.

8. Changes to this Privacy Policy

We may update this Privacy Policy because of feature changes, third-party-service changes, legal amendments, or changes in how we process personal data.

The updated Policy will be posted on the official website of the Service, with a last-updated date.

If a change involves important personal-data processing, we will give necessary notice through a site announcement, in-service notice, email, or other appropriate means, according to the change and applicable law.

If the law requires fresh consent, we will obtain it before the related processing.

Updates to this Policy do not affect personal-data rights you already have under law.

9. Contact us

If you have questions about this Privacy Policy, how we process personal data, or your related rights, or if you wish to inquire, correct, delete, or make other personal-data requests, please contact:

Company name: 勝崨有限公司 (Next Innovation Ltd.)

Email: [email protected]

Address: 3F.-3, No. 186, Shizheng N. 7th Rd., Xitun Dist., Taichung City, Taiwan

Official website: https://carwhowa.com

We will confirm and handle requests according to their content and applicable law.