Privacy Policy

[COMPANY LEGAL NAME, LLC] ("CarTour", "we", "us") runs a marketplace where car shoppers browse vehicle listings published by licensed dealerships. This policy explains what we collect, why, who it is shared with, how long we keep it, and the choices you have.

It applies to the CarTour mobile app, the [DOMAIN] website, and the dealership dashboard.

The short version

• You can browse listings without an account.
• We do not sell your personal information and we do not share it with anyone for their own advertising.
• We use no third-party analytics or advertising SDKs, and we do not track you across other companies' apps and websites.
• When you send an inquiry to a dealership, your contact details go to that dealership — that is the point of an inquiry, and it is the main way your information leaves us.
• You can delete your account yourself, permanently, at any time.

What we collect

If you are a shopper

• Account details — name, email address, phone number and a password when you create an account, on the website or in the app.
• Activity — vehicles you save, feed preferences (body style, budget, favourite makes), inspection checklists and the notes you add to them, and the inquiries you send.
• Inquiries to dealerships — when you contact a dealership about a vehicle (a message, an availability check, or a test-drive request), the name, email address, phone number, preferred contact method, message and any requested date and time you enter are delivered to that dealership. You can send an inquiry with or without an account.
• Location (optional, app only) — with your permission, your approximate location is used while the app is open to show how far cars are from you and to centre the map. It is used on your device and, when you search "near me", sent as part of that search. We do not keep a history of your location and we never access it in the background.
• Camera and photos (optional, app only) — the camera is used to scan VIN barcodes; the image is processed on your device and only the decoded VIN is used. Photo-library access covers only the media you choose to attach.

If you are a dealership

• Business details — dealership name, address, dealer licence details, rooftop information and contact details.
• Team members — the name, email address and role of each person you invite, and the invitation's status. An invitation is delivered by email to the address you enter.
• Inventory — vehicles, VINs, stock numbers, pricing, mileage, condition, warranty disclosures, descriptions, and the photos and videos you upload.
• Leads — the inquiries shoppers send you, and the notes, status changes and assignments your staff record against them.
• Billing — your subscription plan, seat count and payment status. Payments are processed by Stripe; card numbers go to Stripe and never to us.

Technical information, on both surfaces

• Session cookies (website) — signing in sets HTTP-only cookies that keep you signed in as you move between pages. They are strictly necessary, and there are no advertising or analytics cookies on this site. Full detail is in the Cookie Policy.
• App handoff codes (website) — when you open your session in the app from the website, we mint a single-use code tied to your account. We store a one-way hash of it, never the code itself, it expires in about two minutes, and it is destroyed when redeemed.
• Theme preference (website) — stored in your browser's own storage on your device. It never reaches us.
• Push token (app) — if you turn on notifications.
• Diagnostics — basic app and site events and error reports we use to keep the product working, and security logs of sign-ins and sensitive actions.

How we use it

• Operate the marketplace: show listings, deliver your inquiries to dealerships, and sync your saves, preferences and checklists across your devices.
• Run dealership accounts: publish inventory, route leads, manage team access and seats, and bill subscriptions.
• Personalise your feed when you set preferences — you can clear them at any time.
• Send the notifications and service email you have enabled or that your account requires: confirmations, security notices, team invitations, lead alerts and billing notices.
• Keep the platform safe and honest: reviewing reported listings, preventing fraud and abuse, enforcing our Acceptable Use Policy, and debugging errors.
• Meet legal obligations and respond to lawful requests.

We do not use your personal information to build advertising profiles, and we do not make decisions about you by automated processing that produce legal or similarly significant effects.

Who we share it with

• Dealerships — the contents of an inquiry you choose to send. Once it arrives, that dealership holds it as its own business record and its own privacy practices govern what it does with it. We cannot withdraw a message on your behalf; contact the dealership directly.
• Service providers, who process data on our instructions:
  • Supabase — database, authentication and file storage for listing media.
  • Stripe — payment processing for dealership subscriptions. We never see full card numbers.
  • Resend — delivery of transactional email such as team invitations.
  • Expo — push-notification delivery for the mobile app.
• Public data sources — when you use VIN decoding or the recall checker, the VIN or the vehicle's year, make and model is sent to the U.S. National Highway Traffic Safety Administration's public APIs. No information about you goes with it.
• Maps — tapping "Get directions" hands the destination to Apple Maps or Google Maps on your device.
• Legal and safety — where we are required by law, or where it is necessary to investigate fraud, enforce our terms, or protect the rights and safety of users or the public.
• A business transfer — if we are involved in a merger, acquisition or sale of assets, your information may transfer as part of it. We will say so on this page before it takes effect.

We do not sell your personal information, and we do not share it with third parties for their own advertising or cross-context behavioural advertising.

Cookies

The website uses strictly necessary cookies to keep you signed in, and nothing else. There are no advertising, tracking or third-party analytics cookies. See the Cookie Policy for the full list.

How long we keep it

• Account data — while your account exists, and until you delete it.
• Listings and media — while the dealership's subscription is active, and for a limited period afterwards as described in the Dealer Subscription Agreement.
• Leads and inquiries — as the dealership's business record, for as long as that dealership keeps them.
• Billing records — as long as tax and accounting law requires.
• Security and audit logs — for a limited retention period, then deleted or anonymised.
• Handoff codes — about two minutes, or until redeemed.

Deleting your account

You can permanently delete your account in the app: Profile → Delete account. That removes your account, profile, saved cars, checklists, preferences and push tokens. If you would rather we handled it, write to [PRIVACY EMAIL].

What survives deletion, and why:

• Inquiries you already sent remain with the dealership as its record of your conversation — like an email you sent someone. Ask that dealership to delete it.
• Security and audit logs are kept for their retention period with the link to your account removed.
• Billing and tax records, for dealerships, are kept as long as the law requires.

Deleting a dealership account is different: it affects other people's access and its billing. See the Dealer Subscription Agreement.

Your choices

• Browse without an account.
• Location, camera, photo-library and notification permissions are optional and can be changed at any time in your device settings. The app works without them.
• Access or correct your profile details in the app or in your account settings on the website.
• Turn off marketing email at any time using the unsubscribe link. Service messages about your own account continue while you hold one.
• Request a copy of your data, or its deletion, at [PRIVACY EMAIL].

If you live in California, Colorado, Connecticut, Virginia, Texas or another state with a comprehensive privacy law, you have additional rights and a right to appeal a refusal. Those rights, and how to use them, are set out in Your Privacy Rights.

Children

CarTour is not directed to children under 13 and we do not knowingly collect personal information from them. You must be at least 18 to create an account. If you believe a child has given us information, write to [PRIVACY EMAIL] and we will delete it.

Security

Data is transmitted over HTTPS and stored with row-level access controls that scope every record to its owner: shoppers see their own data, and a dealership sees only its own inventory, media and leads. Session cookies are HTTP-only, so page scripts cannot read them. Handoff codes are stored as one-way hashes and expire in about two minutes. Passwords are hashed by our authentication provider and are never visible to us.

No system is perfectly secure. Use a strong, unique password, and tell us at [SUPPORT EMAIL] if you think your account has been compromised.

Where your data is held

CarTour is operated from the United States and your information is stored and processed there. If you use the Service from outside the United States, you understand that its privacy laws may differ from your own.

Changes to this policy

If we materially change this policy we will update this page and the "last updated" date above, and note the change in the app or by email where it matters. Continued use after a change means you accept the updated policy.

Contact

[COMPANY LEGAL NAME, LLC]
[STREET ADDRESS], [CITY], Illinois [ZIP]
Privacy: [PRIVACY EMAIL]
General: [SUPPORT EMAIL]