Privacy, plainly.

When you use AutoScout, we may process account and profile details, contact information, city and ZIP shown with listings, vehicle listing details and images, saved preferences, messages, reports you submit, and account and service activity. You choose what you include in a listing or conversation.

Vehicle report requests can include vehicle identifiers and the details needed to produce the report. Confidential ownership documents are not sent to AI providers for report generation. City and ZIP can be public as part of marketplace listings; account and contact details are not made public unless you choose to include them.

We use information to authenticate accounts through Clerk, operate listings and messaging, generate requested reports, process subscriptions and identity-verification flows, deliver optional activity email notifications when you opt in, respond to support requests, review submitted reports, and protect the service. Billing and renewal notices are service messages. Aggregate marketplace statistics may describe activity such as listing views and saves; anonymized aggregate event data may be retained for up to 90 days.

First-party site analytics and Meta advertising measurement have separate controls. If Meta advertising measurement is available and you have not opted out, AutoScout may send hashed email addresses and account IDs, IP address and browser user-agent, Meta browser identifiers such as fbp/fbc, and limited page, report, listing, registration, lead, and confirmed purchase events. This data is used for advertising measurement and event matching. It does not include VINs, report contents, vehicle notes, private messages, or payment-card details. Purchase events are sent only after a server-confirmed payment.

Use “Your privacy choices” in the footer to opt out of Meta advertising measurement. The existing first-party analytics opt-out also disables Meta advertising tracking. We honor Global Privacy Control and Do Not Track signals for optional tracking, and these signals cannot be overridden in the browser. These choices do not disable records needed to provide the service. Short-lived event metadata is retained only as needed for delivery and deduplication, then expires under configured retention controls.

Service providers include Clerk for authentication, Stripe for payments, subscriptions and identity verification, Replit storage for application data and files, and Resend for email delivery. Report generation may use AI providers to process relevant vehicle and request information. We do not represent these providers as receiving confidential ownership documents for AI processing.

Reports you submit may be reviewed by the team and used to investigate safety issues. Messages are visible to participants in that conversation and may be reviewed when needed to handle reports or support. A meeting location is encrypted and restricted to consenting participants in the relevant conversation. Other participants may retain information they need for their own transaction history.

We retain information while needed to provide the service, support accounts, address reports, and maintain records required for billing or other participants’ transaction history. Meeting locations are automatically purged 24 hours after the meeting. Deleting an account does not promise immediate removal from providers or backups, nor does it purge provider-held billing records or another participant’s necessary transaction history. An anonymized user anchor and some limited shared history may remain.

For first-party page analytics, AutoScout may set a random browser identifier in an HttpOnly cookie named autoscout_visitor with a sliding 180-day lifetime. We do not use browser fingerprinting or collect new IP addresses for this tracking. When you are signed in, your account ID can link your signed-in activity. Cookie blocking or privacy signals can cause visits to be omitted. Known bots and administrator activity are excluded where identified, but filtering is not bot-proof and these counts do not claim to represent exact people. Historical records may contain IP hashes retained under the existing policy.

Do Not Track and Global Privacy Control signals always override an analytics opt-in. When either signal is detected, analytics remain off and the control cannot enable them in that browser.

You can manage profile information in Settings, control optional email alerts where available, submit a support request, or request account deletion. Deletion scrubs your profile, own content and report files through processing, withdraws your listings, and removes access to credits and reports, subject to the limits above. Requests may be blocked while there are open disputed sales, active auction commitments, or when removal would leave no administrator.

Questions about this notice can be sent through Support. This notice describes current product practices; please seek independent legal advice for your circumstances. It is not a claim of legal compliance.