Legal document
Privacy policy
Last updated: 11 October 2026MShield is committed to protecting your privacy and to processing your personal data in compliance with the General Data Protection Regulation (GDPR).
1Who am I?
MShield is a personal project that I develop on my own to test the interest in a platform connecting people looking for a vehicle with car dealers. I act only as an intermediary: I do not sell vehicles and I do not take part in transactions.
Data controller:
- Roman MELENTOV in Saulny 57140, Grand Est, France.
- Contact email: support@mshield.pro.
2What data do I collect?
I collect data in several distinct places on the site, depending on what you do there. The detail by feature:
Contact form
- Required: name, email address, message.
- Optional: phone number.
“Request a check” feature (on a vehicle page)
- Required: email address, message describing the check requested, acceptance of the terms of use, consent to be notified via MShield of the dealer's answers.
- Optional: phone number, only if you agree to be contacted directly by the dealer.
Vehicle page and inspection report
- Filled in by the dealer, not by you: photos of the vehicle, detail of the check points, estimated repair costs, sale information where applicable (price, mileage, warranty, status), the dealer's professional contact details.
- This data is hosted by MShield but filled in and published by the dealer, who is responsible for it.
Technical and security data (automatic)
- IP address, in particular for protection against abuse and fraud prevention.
- Information about the browser and the device.
- Cloudflare Turnstile anti-bot check: passing this test is required to send a check request or a message through the contact form; it then sets a technical session cookie (duration: 12 hours). Simply viewing a vehicle page or the Market catalogue does not require it.
Vehicle page view statistics
- Each display of a vehicle page is counted, as is each click on the dealer's contact details: phone number, email, website, stock. This count records nothing about you: no IP address, no cookie, no identifier.
- If you accept it in the banner (“Listing audience”), your browser also keeps a randomly generated identifier and the number of your visits to each vehicle page, to tell one visitor who comes several times from several visitors. This identifier is not linked to your name, your email address, your IP address or any other website.
- This identifier and the number of the visit are then recorded with each of your visits. Your IP address and your browser details never are.
- Without your consent, or if you withdraw it with “Manage my cookies” at the bottom of each page, no identifier is created, any existing one is erased from your device, and your visits are counted without an identifier.
- On a vehicle page, you can give your opinion on the listing with a thumbs up or a thumbs down. Only the dealer and MShield see the total. This opinion is counted with nothing about you: no identifier, no IP address, no information about your browser, even if you have accepted “Listing audience”.
Performance and audience analytics data (automatic, after consent)
- Vercel Speed Insights: anonymised browsing and performance data.
- Google Analytics (GA4): audience measurement.
3Why do I collect this data?
I process this data to:
- Read your contact message and reply to it.
- Handle the check requests sent from a vehicle page and notify you of the answers given by the dealer.
- Protect forms against automated submissions and abuse.
- Tell each dealer how many times their vehicle pages were viewed, by how many visitors, and how many times their contact details were displayed.
- Measure the site's audience and performance in order to improve it, only if you have accepted it.
Legal basis: pre-contractual measures (putting parties in touch) and the legitimate interest in improving and running this project.
Audience and performance measurement by Google Analytics and Vercel relies on your consent, which you can withdraw at any time.
The anonymous count of vehicle page views relies on the legitimate interest of informing dealers about the audience of their listings. The visitor identifier relies on your consent, which you can withdraw at any time.
The count of opinions given on a listing, which is also anonymous, relies on the same legitimate interest.
4Who do I share your data with?
I never sell your data and do not pass it on to any third party for commercial purposes. Here is what is actually shared, by recipient:
Partner dealers
A check request sent from a vehicle page is passed on exclusively to the dealer behind that report — their identity is determined on the server side from the report itself, never from a value sent by your browser. They then become an independent data controller for the rest of your exchanges.
In practice, your request is recorded in MShield's search database, then copied to the MShield Pro area of the dealer concerned, where they read it and answer it. When they indicate that an answer is available, you receive an email at the address given in your request.
The dealer also sees, for each of their vehicles, how many times the vehicle page was viewed, by how many visitors, and how many times their contact details were clicked. They only see numbers, never a visitor's identifier.
Technical service providers
- Resend: sending the contact form emails and the notifications of answers to a check request.
- Cloudflare: protection against abuse through Turnstile, and hosting of the dealers' MShield Pro areas, to which check requests are copied.
- Aiven: hosting of the search database (OpenSearch) where published reports, check requests and view statistics are recorded.
- Vercel: hosting and performance measurement of the site.
- Google Analytics (Google Ireland Ltd.): audience measurement.
These providers act within the scope of their respective services and apply their own commitments on security and data protection.
Transfers outside the European Union
Some of these providers are established outside the European Union or may process data there, in particular in the United States. These transfers are governed by the safeguards provided for by the GDPR: an adequacy decision of the European Commission or standard contractual clauses, depending on the provider.
5How long do I keep your data?
I keep the data for as long as needed to put the parties in touch, then I delete or anonymise it within a reasonable period (generally within 12 months of the last interaction, unless required otherwise by law). This includes the check requests sent from a vehicle page.
Inspection reports (including the photos they contain) are kept for as long as the dealer keeps them shared on the platform, then deleted or made inaccessible at their request or mine.
The view statistics of a vehicle page are erased as soon as the dealer withdraws the listing from the site or declares the vehicle sold or rented. The identifier kept in your browser is renewed after 13 months.
Opinions given on a listing are erased together with its view statistics. Your browser remembers the opinion you gave for 13 months at most.
6Security
The security of your data is an absolute priority.
I implement appropriate technical and organisational measures to guarantee the confidentiality, integrity and availability of the information entrusted to me.
These measures include in particular:
- encryption of communications between your browser and the platform through the HTTPS/TLS protocol;
- the use of secure APIs for data transmission;
- secure storage of secrets, API keys and technical credentials;
- strict restriction of access to authorised services and people only;
- systematic use of multi-factor authentication on critical services;
- protection of forms against automated abuse through Cloudflare Turnstile.
The site's infrastructure relies on specialised providers such as Vercel and Cloudflare, recognised for their high standards of security, availability and resilience.
Although no system can guarantee absolute security, I am committed to applying the industry's best practices at all times in order to protect your data.
7Your rights
At any time, you can:
- Access your data
- Rectify it, delete it or restrict its use
- Object to the processing
- Receive the data you have provided to me in a reusable format (portability)
- Withdraw your consent at any time: to audience measurement through the “Manage my cookies” button, to being called back by phone by writing to me
To exercise these rights, simply contact me at: support@mshield.pro.
You also have the right to lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).
9Changes to this policy
I may need to change this policy as the project evolves. The version in force is the one published on the site at the time you use it.