Privacy Policy

What we collect and why

• Account data — email, hashed password, and optional Google profile if you sign in with Google. Used to create and secure your account (contract performance).
• Profile data — name, dealership, photos, videos, and contact details you choose to publish. Used to provide the Service (contract performance).
• Reviews — your rating, comment, and (optionally) the last four characters of a vehicle VIN used to verify purchase. Used to display verified reviews (legitimate interest in trust and safety).
• Support messages — anything you send us. Used to respond to you (legitimate interest).
• Usage and security data — request logs, IP address, and rate-limit events. Used to operate the Service and prevent abuse (legitimate interest).

What's public vs. private

Rep profile content (name, photo, dealership, reviews, ratings) is public. Buyer contact info in quote requests is visible only to the rep who received it. Partial VIN data is never shown to anonymous visitors.

Who we share data with

• Merchant of Record — Paddle.com for the sale of paid plans, subscription management, payments, tax compliance, and invoicing. Paddle is a separate data controller for the payment data it collects; see Paddle's Privacy Notice.
• Infrastructure providers that host our database, authentication, and email delivery, acting as processors on our behalf.
• Authorities where required by law.

We do not sell your personal data and we do not use third-party advertising cookies.

Retention

We retain your account and profile data while your account is active and for a short period after deletion to satisfy legal or accounting obligations. Rate-limit and log data is kept for a limited period and then anonymised or deleted.

Security

Passwords are hashed; new passwords are checked against known-compromised lists. Database access is protected by row-level security policies and encrypted in transit. No system is perfectly secure — please use a strong, unique password.

Your rights

Depending on where you live, you may have rights to access, correct, delete, or export your personal data, restrict or object to processing, withdraw consent, and lodge a complaint with your local data-protection authority. You can edit or delete your profile and reviews at any time. To exercise any other right, contact us via the email listed on your account dashboard; we aim to respond within one month.

International transfers

Our providers may process data outside your country. Where required, transfers are covered by appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

Cookies

We use only cookies strictly necessary to keep you signed in and to protect the Service. We do not use analytics or advertising cookies.

Changes

Material changes to this policy will be announced via the Service or email.