Privacy Policy

Our role: controller vs. processor

For our own website, account, and billing data, Private Car Finder is the business/controller. For the lead, contact, and message data a dealership uploads or generates in Reach (“Customer Data”), the dealership is the controller and Private Car Finder acts as a service provider / processor that handles the data on the dealership’s behalf and under its instructions.

Information we collect

Account information you provide (name, email, organization, billing details).

Customer Data you upload or generate while using Reach, including consumer names, phone numbers, email addresses, vehicle details, and message content.

Usage and device data collected automatically to operate, secure, and improve the Service.

How we use information

To provide the Service (including transmitting messages you originate through your own connected accounts, surfacing listings, and booking appointments) and to process payments, provide support, maintain security, and improve the product. We do not use consumer mobile phone numbers, opt-in data, or SMS content for our own marketing.

Messaging and your phone number

Reach sends SMS through a phone number included with your Dealership or Enterprise membership (or your own lines, if you connect them), which we provision and configure. The dealership is the registered brand of record and is responsible for consent and opt-outs. See our SMS Compliance page for details on A2P 10DLC, TCPA, CASL, and opt-out handling.

Google user data (Google Calendar)

Connecting a Google Calendar is optional and always starts with you. When you click Connect in Reach, we send you to Google to sign in and approve access, and we only receive data for the Google account you choose. If you never connect a calendar, we never receive any Google user data.

What we access. With your permission we request your Google account email address, the list of calendars on that account, and the ability to create and manage calendars and events. We use the email address to show you which Google account is connected, the calendar list to find or create a dedicated “Private Car Finder” calendar, and calendar and event access to check availability and to create, update, and delete the appointments Reach books on your behalf. We do not use Google user data for any other feature.

How we store it. Your Google access and refresh tokens are encrypted at rest with AES-256 before they are written to our database, and they are used only to make Google Calendar API calls for your account. Appointment records we sync are stored alongside your other Reach data and protected the same way.

How we share it. We do not sell Google user data, share it with data brokers, use it for advertising, or use it to train generalized machine learning or AI models. We do not transfer Google user data to third parties except to the hosting and database providers that run the Service on our behalf, where you direct us to, or where the law requires it.

How to revoke, and what we delete. You can disconnect Google Calendar at any time from Reach settings. Disconnecting immediately revokes our tokens with Google and deletes the stored connection, and you may choose to remove the synced appointments at the same time. You can also revoke access directly at myaccount.google.com/permissions.

Private Car Finder’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Sharing

We share data with sub-processors that power the Service, for example messaging, email, calendar, analytics, and payment providers, under contracts that require them to protect it and use it only to provide their services. We do not sell personal information, and we do not share, sell, lease, or rent consumer mobile numbers, SMS opt-in data, or SMS content to third parties for their own marketing.

U.S. privacy rights (including California)

Depending on your state, you may have rights to access, correct, delete, and know about the personal information we hold, and to opt out of “sale” or “sharing” (we do not sell or share personal information as those terms are defined). California residents have these rights under the CCPA/CPRA. We do not discriminate against you for exercising them.

Canadian privacy rights (PIPEDA)

If you are in Canada, our handling of personal information is subject to PIPEDA and applicable provincial privacy laws. You may request access to, and correction of, your personal information, and you may withdraw consent (subject to legal or contractual limits). Consumers may withdraw consent to messaging at any time as described on our SMS Compliance page.

Data retention and security

We retain data for as long as your account is active or as needed to provide the Service and meet legal obligations, then delete or de-identify it. We use reasonable administrative, technical, and physical safeguards to protect personal information. Data may be processed in the United States and Canada.

Your choices and contact

You can access, correct, or request deletion of your data, and message recipients can opt out at any time. If you are a consumer, contact the dealership that messaged you; you may also reach us and we will route your request. To exercise any right or ask a question, email jordan@privatecarfinder.com.