Privacy Policy

Please note: we do not control what appears in a document you photograph. Receipts frequently contain personal information beyond what the Service needs. You may redact sensitive details before uploading.

• Usage data — pages viewed, features used, actions taken, timestamps.
• Device and connection data — IP address, browser type, operating system, device identifiers, approximate location derived from IP address (city/region level).
• Image metadata — photographs may contain embedded EXIF data, including precise GPS coordinates and the device that captured them. We do not display or use this data, and it is removed from files we serve on a Vehicle Passport.
• Cookies and similar technologies — see Section 10.

Payments are processed by Stripe, Inc. You provide card details directly to them. We never receive or store your full card number, CVC, or expiration date. We receive only a payment token, the last four digits, card brand, billing ZIP, and transaction status.

Documents you upload may contain information about third parties, such as a service advisor's name or a prior owner's details. You are responsible for having the right to upload that information.

When you create a Vehicle Passport, the records and fields you select become visible to anyone who has the link, until the link expires or you revoke it. This is a disclosure you initiate and control. We cannot retrieve information from someone who has already viewed, copied, or forwarded a Passport.

We share information with vendors who process it on our behalf under contract, limited to what they need:

Automated extraction means the contents of your uploaded documents are transmitted to a third-party AI provider for processing. We use API-tier terms under which that provider does not use your content to train models and retains it only transiently for abuse monitoring.

We update this table when our vendors change.

We may disclose information when we believe in good faith it is necessary to comply with law, a subpoena, court order, or government request; to enforce our Terms; to investigate fraud or security incidents; or to protect the rights, property or safety of any person. Where permitted by law, we will make reasonable efforts to notify you of a legal demand for your data before responding.

If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. We will notify you by email at least 30 days before your information becomes subject to a materially different privacy policy, and you will have the opportunity to delete your account and data first.

We may create and use aggregated or de-identified data that cannot reasonably identify you or your vehicle. We commit to maintaining such data in de-identified form and not attempting to re-identify it.

• Access and export — download your records at any time from account settings.
• Correct — edit any vehicle, record, or extracted value directly in the Service.
• Delete — delete individual records or your entire account from account settings.
• Revoke Passports — revoke any active Passport link at any time.
• Marketing emails — unsubscribe using the link in any marketing message.

Depending on your state of residence — including Connecticut (Connecticut Data Privacy Act), California (CCPA/CPRA), Colorado, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws — you may have the right to:

• know what personal information we collect, use, and disclose, and obtain a copy in a portable format;
• correct inaccurate personal information;
• delete personal information we hold about you;
• opt out of the sale of personal information, targeted advertising, and profiling with legal or similarly significant effects (we do not engage in any of these);
• not be discriminated against for exercising a right.

How to exercise: use the controls in account settings or reach out through our contact form. We will verify your identity through your account credentials or by confirming information we already hold. We respond within 45 days, extendable once by an additional 45 days with notice. Authorized agents may submit requests on your behalf with proof of authorization.

Appeals: if we decline your request, you may appeal through our contact form with "Appeal" in the subject line. We will respond in writing within 60 days with our decision and reasoning. If we deny the appeal, Connecticut residents may contact the Connecticut Attorney General at portal.ct.gov/AG; residents of other states may contact their state attorney general.

We have collected the following CCPA categories in the past 12 months: identifiers; commercial information; internet activity; approximate geolocation; and, within uploaded documents, categories of personal information described in Cal. Civ. Code § 1798.80. Sources, purposes and recipients are described in Sections 2, 3 and 5.

We do not sell or share personal information as those terms are defined by the CCPA, and we do not have actual knowledge of selling or sharing the personal information of consumers under 16.

We honor the Global Privacy Control (GPC) and similar universal opt-out signals as required by Connecticut and California law. Because we do not sell personal information or conduct targeted advertising, the signal does not change our processing, but we will not disregard it.