Privacy Policy

CarSkipper, LLC ("CarSkipper," "we," "us," or "our") is a Texas-based used-car marketplace that connects private-party buyers and sellers. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our website, mobile application, or any related services (collectively, the "Services").

By using our Services you agree to the practices described in this policy. If you do not agree, please do not use our Services.

1. Information We Collect

We collect information you provide directly and information generated by your use of the Services:

• Account Information — name, email address, mobile phone number, and password (stored as a secure hash).
• Identity Verification — government-issued ID images and related data processed by our identity verification partner (Stripe Identity). We store only a reference token; raw ID images are not retained on CarSkipper servers.
• Vehicle Information — VIN, year, make, model, mileage, condition, and photographs you submit as part of the sell intake or listing process.
• Transaction Data — deposit amounts, payment method tokens (no raw card numbers — handled by Stripe), order status, and payout information.
• Communications — messages exchanged between buyers, sellers, and Skippers through the in-app messaging system.
• Usage Data — pages viewed, searches performed, features used, device type, IP address, and browser/app version, collected automatically via server logs and analytics.
• Location Data — ZIP code or city you enter to find listings in your area. We do not collect precise GPS location without your explicit permission.

2. How We Use Your Information

• Facilitate vehicle transactions between buyers, sellers, and Skippers.
• Verify your identity and prevent fraud.
• Process payments and initiate seller payouts via Stripe Connect.
• Send transactional communications: account verification, two-factor authentication (2FA) codes, appointment reminders, order status updates, and login codes.
• Improve and personalise the Services through aggregate analytics.
• Comply with legal obligations and enforce our Terms of Service.

3. SMS / Text Message Communications

CarSkipper sends SMS messages for the following transactional purposes only:

• Phone number verification one-time passcodes (OTP)
• Two-factor authentication (2FA) sign-in codes
• Passwordless login codes
• Appointment reminders for test drives and vehicle handoffs

Consent. By providing your mobile phone number and checking the SMS opt-in checkbox on the registration or account settings page, you expressly consent to receive the transactional text messages described above from CarSkipper. Consent is not required as a condition of purchasing or selling a vehicle on our platform.

SMS messages are delivered via Brevo SAS acting as our messaging service provider. Your phone number is transmitted to Brevo solely to deliver the messages described above and is not used for any other purpose. For Brevo's data practices see brevo.com/legal/privacypolicy.

4. Cookies and Tracking

We use cookies and similar technologies to maintain your authenticated session, remember your preferences, and collect aggregate analytics. For full details see our Cookie Policy.

5. How We Share Your Information

We do not sell your personal information. We share it only in the following circumstances:

• Service Providers — Stripe (payments & identity), Azure Communication Services (email), Twilio or Brevo (SMS — see Section 3), Azure Blob Storage (photo storage), Azure Application Insights (analytics), and Azure Notification Hubs (push notifications). Each provider is contractually bound to use your data only to perform services for us.
• Transaction Counterparties — limited profile and contact information is shared with the buyer, seller, or Skipper involved in a specific transaction to facilitate the handoff.
• Legal Requirements — we may disclose information when required by law, court order, or to protect the safety of users or third parties.
• Business Transfers — in the event of a merger, acquisition, or asset sale, your information may be transferred. We will provide notice before your data becomes subject to a materially different privacy policy.

6. Data Retention

We retain your account information for as long as your account is active or as needed to provide the Services. Transaction records are retained for a minimum of 7 years to satisfy tax and legal obligations. SMS consent and opt-out records are retained for a minimum of 4 years in accordance with CTIA guidelines. You may request deletion of your account at any time (see Section 7); certain transaction records may be retained even after account deletion to satisfy legal obligations.

7. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal information:

• Access — request a copy of the personal data we hold about you.
• Correction — update inaccurate information via your account settings or by contacting us.
• Deletion — request deletion of your account and associated personal data, subject to retention obligations.
• Opt Out of SMS — reply STOP to any CarSkipper SMS, or disable SMS notifications in your account settings.
• Portability — request an export of your personal data in a machine-readable format.

To exercise any of these rights, contact us at privacy@carskipper.com. We will respond within 30 days.

8. Security

We protect your personal information using industry-standard security measures, including:

• AES-256-GCM application-layer encryption for sensitive fields (addresses, driver's licence numbers).
• HMAC-SHA256 blind indexes for phone number lookups so that plaintext phone numbers are never used in database queries.
• PBKDF2-SHA256 password hashing.
• TLS 1.2+ for all data in transit.
• Azure Key Vault for all cryptographic keys and secrets in production.

No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately at support@carskipper.com.

9. Children's Privacy

Our Services are not directed to children under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us at privacy@carskipper.com and we will promptly delete it.

10. Texas Residents

The Texas Data Privacy and Security Act (TDPSA) provides Texas residents with rights including access, correction, deletion, portability, and the right to opt out of the sale of personal data. CarSkipper does not sell personal data. To exercise your rights under the TDPSA, contact us at privacy@carskipper.com. We will respond within 45 days as required by law.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page with an updated "Last Updated" date and, where appropriate, by sending you an email notification. Your continued use of the Services after the effective date constitutes acceptance of the updated policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us: