Privacy Policy

Effective Date: November 1, 2026. Draft: subject to attorney review prior to launch.

This Privacy Policy describes how ScanAutos.com (“ScanAutos,” “we,” “us,” or “our”) collects, uses, discloses and retains personal information in connection with the website scanautos.com and related services (the “Services”). This Policy is provided in accordance with the California Online Privacy Protection Act (“CalOPPA”) and the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (collectively, the “CCPA”).

1. Personal Information We Collect

1.1 Account Holders. Email address; optional first name; vehicle information, pricing, photographs and listing links submitted by the account holder; plan and transaction status. Photographs are resized, and location metadata is removed, on the user’s device prior to upload. Payment card information is collected and processed by our payment processor and is not stored by ScanAutos. For verified dealer accounts: business name, business address, dealer license number, logo and business telephone number.

1.2 Visitors. Visitors are not required to provide personal information. We record aggregate page visits and retain a one-way hashed (non-reversible) form of the Internet Protocol (“IP”) address for fraud prevention and abuse reporting. Where a visitor submits a report, we collect the report content and any email address provided.

1.3 Buyer Safety Acknowledgment. Before a visitor first views a listing, we display a safety notice. When the visitor selects “I understand,” we record the date and time, the sign code, the version of the Terms of Service in effect, the device type (for example, “iPhone, Safari”) and a one-way hashed (non-reversible) form of the visitor’s IP address. This record is used solely to document that the safety notice was presented and accepted, and is deleted three (3) years after it is created. A setting stored on the visitor’s device (local storage, not a cookie) prevents the notice from being shown again.

1.4 Technical Information. Our hosting provider processes standard request data, including IP address and browser type, to deliver and secure the Services.

1.5 Categories. Within the meaning of the CCPA, we collect identifiers, commercial information and, for dealer accounts, professional information. We do not collect sensitive personal information.

2. Sources

We collect personal information directly from you, automatically when you use the Services, and from our service providers in connection with authentication and payment.

3. Use of Personal Information

We use personal information to: (a) provide, operate and secure the Services, including account authentication; (b) publish listing preview pages and generate signage; (c) send transactional communications relating to accounts and listings; (d) detect, investigate and prevent fraud, abuse and violations of our Terms of Service; (e) process payments; and (f) comply with legal obligations. We do not send marketing communications.

4. Disclosure of Personal Information

4.1 Service Providers. We disclose personal information to service providers that process it on our behalf under written contracts restricting its use, including: Cloudflare, Inc. (hosting, database, storage and security); Resend (email delivery); Stripe, Inc. (payment processing); Google LLC (optional account sign-in); Twilio Inc. (dealer telephone verification); and the National Highway Traffic Safety Administration vPIC service (vehicle identification number decoding, which receives the VIN only).

4.2 Public Listing Information. Vehicle information, photographs, city and listing links are displayed to visitors of a listing’s preview page. The telephone numbers and email addresses of private sellers are not displayed. Business contact information of verified dealers is made available through contact functions during the dealer’s designated business hours.

4.3 Legal Requirements. We may disclose personal information where required by law, legal process or governmental request, or where reasonably necessary to protect the rights, property or safety of ScanAutos, our users or others.

4.4 No Sale or Sharing. We do not sell or share personal information, as those terms are defined in the CCPA, and have not done so in the preceding twelve (12) months.

5. Cookies and Similar Technologies

We use only strictly necessary cookies. We do not use advertising, analytics or cross-site tracking cookies.

Browser local storage is used to record dismissal of the cookie notice. Our hosting provider may set a temporary security cookie to protect the Services against automated abuse. Cookies may be blocked or deleted through browser settings; doing so will prevent sign-in.

6. Do Not Track; Global Privacy Control

We do not track users across third-party websites and do not permit third parties to do so through the Services. Accordingly, we do not alter our practices in response to Do Not Track signals. We treat a Global Privacy Control (“GPC”) signal as a valid request to opt out of the sale or sharing of personal information.

7. Retention

Listing photographs and vehicle information are deleted within seven (7) days after a listing ends, or immediately upon deletion by the account holder. Account information is retained until the account is deleted. Buyer safety acknowledgment records are deleted three (3) years after they are created. Transaction records and fraud-prevention records are retained only as long as reasonably necessary for legal, tax, accounting and security purposes.

8. California Privacy Rights

8.1 Your Rights. California residents have the right to: (a) know the categories and specific pieces of personal information collected, the sources, the purposes, and the categories of third parties to which it is disclosed; (b) obtain a copy of their personal information; (c) request correction of inaccurate personal information; (d) request deletion of personal information, subject to legal exceptions; (e) opt out of the sale or sharing of personal information; and (f) limit the use of sensitive personal information. ScanAutos does not sell or share personal information and does not collect sensitive personal information.

8.2 Submitting a Request. Requests may be submitted by email to [email protected] with the subject line “Privacy Request.” Account holders may also delete listings and accounts directly within the Services. We will verify requests by confirming control of the email address associated with the account, and will respond within forty-five (45) days, subject to extension as permitted by law.

8.3 Authorized Agents. An authorized agent may submit a request on your behalf with your signed written permission. We may require you to verify your identity directly.

8.4 Non-Discrimination. We will not discriminate against you for exercising any rights under the CCPA.

8.5 Shine the Light (Cal. Civ. Code § 1798.83). We do not disclose personal information to third parties for their direct marketing purposes.

9. Children

The Services are intended for individuals eighteen (18) years of age or older. We do not knowingly collect personal information from minors.

10. Security

We maintain reasonable administrative, technical and physical safeguards, including encryption in transit, one-time passcode authentication and email confirmation of changes to listing links. No method of transmission or storage is completely secure. In the event of a security breach affecting personal information, we will provide notice as required by applicable law, including Cal. Civ. Code § 1798.82.

11. Changes to This Policy

We may amend this Policy from time to time. Material changes will be indicated by an updated Effective Date and communicated to account holders by email prior to taking effect.

12. Contact

ScanAutos.com, California. Email: [email protected].