Your Privacy Rights

This page explains the privacy rights you have under U.S. state law, how to use them, and what [COMPANY LEGAL NAME, LLC] does with personal information. It adds to our Privacy Policy, which describes our practices generally.

Do Not Sell or Share My Personal Information

CarTour does not sell your personal information, and does not share it for cross-context behavioural advertising. We have never done either. There is no opt-out to submit here, because there is nothing to opt out of.

We also do not use or disclose sensitive personal information for any purpose beyond what is necessary to provide the Service, so no "limit the use of my sensitive personal information" request is required.

One thing worth being precise about: when you send an inquiry to a dealership, your contact details go to that dealership. That is a disclosure you initiate and it is the point of the feature — it is not a sale, and we receive nothing for it. Once your inquiry arrives, that dealership holds it as its own record under its own privacy practices, and a request to us cannot delete it from their systems. Contact the dealership directly for that.

Who has these rights

Comprehensive state privacy laws apply if you are a resident of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky or Rhode Island, among others. The rights differ slightly between them.

We extend the rights below to everyone in the United States, whichever state you live in. It is simpler than operating one process per state, and there is no good reason your rights should depend on your address.

Your rights

• Know and access — what personal information we hold about you, where it came from, why we collected it, and who we disclosed it to.
• Copy (portability) — receive it in a portable, machine-readable format.
• Correct — fix information that is inaccurate. Most of it you can correct yourself in your account settings or in the app.
• Delete — have it deleted, subject to the exceptions below.
• Opt out of sale, of sharing for targeted advertising, and of profiling that produces legal or similarly significant effects. We do none of these.
• Limit sensitive information — we do not use sensitive personal information beyond providing the Service.
• Non-discrimination — we will not deny you service, charge you a different price, or give you a lesser experience for exercising any of these rights. We do not offer financial incentives for personal information.
• Appeal — if we refuse a request, you can ask us to look again. See below.

How to make a request

Email [PRIVACY EMAIL] from the address on your account, or write to [COMPANY LEGAL NAME, LLC], [STREET ADDRESS], [CITY], Illinois [ZIP]. Tell us which right you are exercising and what you want.

Some things are faster to do yourself:

• Delete your account — in the app, under Profile → Delete account, immediately and permanently.
• Correct your details — in account settings on the website, or in the app.
• Stop marketing email — the unsubscribe link in any marketing message.

Verifying who you are

Before we act on a request about personal information, we have to be reasonably sure it is really you asking — handing someone else's data to the wrong person is the harm these laws exist to prevent. Ordinarily we verify by confirming you control the email address on the account. For a request to delete or to receive a copy, we may ask for more. If we cannot verify you, we will tell you why, and we will not use anything you send for verification for any other purpose.

How long we take

We acknowledge requests promptly and respond within 45 days. If we need longer — up to a further 45 days — we will tell you why before the first period ends. There is no charge, unless a request is manifestly unfounded or repetitive, in which case we will tell you before doing anything.

Authorised agents

You may use an authorised agent. We will ask for written proof that you authorised them, and we may still ask you to verify your own identity directly.

If we say no — your appeal

If we refuse a request, our answer will say why and how to appeal. To appeal, reply to that answer or write to [PRIVACY EMAIL] with "Appeal" in the subject line. A different person reviews an appeal, and we will respond within 45 days with our decision and the reasons for it. If we refuse again, we will tell you how to complain to your state Attorney General.

When we cannot delete everything

Deletion has limits, and it is better to know them in advance:

• Inquiries already delivered to a dealership stay with that dealership as its business record. Ask them.
• Billing and tax records are kept as long as the law requires.
• Security and fraud-prevention logs are kept for their retention period, with the link to your account removed.
• We may keep information where it is needed to complete a transaction, detect security incidents, comply with a legal obligation, or exercise or defend legal claims.

What we collect, in the statutory categories

Set out the way California's law asks for it. Detail on each is in the Privacy Policy.

• Identifiers — name, email address, phone number, account identifier, IP address. From you. To operate your account and deliver your inquiries. Disclosed to dealerships you contact, and to our hosting, email and payment providers.
• Commercial information — for dealerships: subscription, plan, seats and payment status; inventory records. For shoppers: vehicles saved and inquiries sent. From you. To run the marketplace and bill subscriptions. Disclosed to our payment processor.
• Internet or network activity — app and site events, error reports, and security logs of sign-ins and sensitive actions. Automatically, from your use. To keep the product working and secure. Not disclosed for anyone's advertising. We use no third-party analytics or advertising SDKs.
• Geolocation (approximate, optional) — only with your permission, only while the app is open, to show distance and centre the map. From your device. Not stored as a history, never accessed in the background.
• Audio, visual and similar information — photos and video uploaded by dealerships for listings; VIN barcode scans, which are processed on your device so that only the decoded VIN is used. From you. To publish listings and to fill in vehicle details.
• Professional or employment information — for dealership staff: your role and permissions at a rooftop. From your dealership. To control access.
• Inferences — feed preferences you set, such as body style, budget and favourite makes. From you. To personalise your feed. You can clear them at any time.

We do not collect biometric information, precise background location, government identifiers, health information, or information about your race, religion, union membership, sexual orientation or political views. We do not knowingly collect information from anyone under 13, and we do not sell or share the personal information of anyone under 16.

We keep each category for the periods set out under "How long we keep it" in the Privacy Policy.

Browser opt-out signals

We honour Global Privacy Control and similar opt-out preference signals. Because we do not sell or share personal information, such a signal does not change what we do — but it will never be ignored.

California "Shine the Light"

California Civil Code § 1798.83 lets California residents ask about personal information disclosed to third parties for their direct marketing. We make no such disclosures. Ask at [PRIVACY EMAIL] if you would like that in writing.

Nevada

Nevada residents may direct us not to sell certain personal information. We do not sell it. Requests to [PRIVACY EMAIL].

Contact

[COMPANY LEGAL NAME, LLC]
[STREET ADDRESS], [CITY], Illinois [ZIP]
Privacy requests and appeals: [PRIVACY EMAIL]