Privacy Policy

Effective Date: October 4, 2026 | Last Updated: October 4, 2026

This Privacy Policy explains how Vehicle Social Inc. ("Vehicle Social", "we", "us") collects, uses, discloses and protects personal information when you use vehiclesocial.com, the dealer portal and our related services (the "Services").

We are a Canadian company and handle personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA), Québec's Act respecting the protection of personal information in the private sector (Law 25) where it applies, and Canada's Anti-Spam Legislation (CASL).

1. Who is responsible for your information

Vehicle Social Inc. is responsible for the personal information described in this policy. We have designated a Privacy Officer who is accountable for our compliance with it.

Privacy Officer — Vehicle Social Inc., Toronto, Ontario, Canada — email: privacy@vehiclesocial.com

2. Information we collect

We collect only what we need to run the marketplace. Depending on how you use the Services, this includes:

Account information — your name, email address, password (stored only as a one-way hash), and, if you choose to add them, phone number, city and province, profile photo and short bio.
Sign-in with Google or Facebook — if you use social sign-in, we receive your name, email address and the provider's account identifier. We do not receive your social-media password or posts.
Listings you create — vehicle details (make, model, year, trim, VIN, mileage, condition, price), photos, description, your city, province and postal code, and an optional inspection report.
Messages, inquiries and appointments — when you contact a seller or book a viewing: your name, email, phone number (optional), message and the date you chose. Guests who are not signed in confirm their email with a one-time code.
Saved items and alerts — vehicles and searches you save, and whether you turned on email alerts (alerts are off unless you turn them on).
Dealer information — for dealer accounts: business name, address, contact details, licence and registration numbers, inventory, and the information dealers enter in their tools (for example, appraisals).
Payments — dealer subscriptions are paid through Stripe. Your card details go directly to Stripe; we never see or store full card numbers. We keep subscription, invoice and payment records.
Technical information — IP address, browser and device type, pages requested and error details, collected in our server logs to keep the Services secure and working.
Page-view history — if you are signed in and have accepted analytics cookies, the pages you visit on our site (not the query string), to understand how the Services are used.

3. Information we do not collect

We do not collect your Social Insurance Number, income, credit score, driver's licence, or any biometric information, and we do not offer financing or credit applications.

4. Information dealers enter about their customers

Dealers can record their own customers' contact details (name, phone, email, postal code) in our appraisal tool. For that information the dealer decides why it is collected and how it is used; we store and process it on the dealer's behalf, only to provide the tool. We automatically remove these customer contact details from appraisals two years after the appraisal was created. Questions about it should go to the dealer first; we will help them respond.

5. How we use your information

We do not sell personal information, and we do not use it for third-party advertising.

to create and secure your account, sign you in and keep you signed in;
to publish and moderate listings, and to show buyers the dealer or seller information they need;
to deliver your inquiries, messages and appointment requests to the seller, and their replies to you;
to send service emails you need (verification codes, password resets, listing status, invoices and receipts);
to send saved-search alerts — only if you turned them on;
to estimate vehicle values with our valuation tools;
to bill dealer subscriptions and keep the financial records the law requires;
to detect, investigate and prevent fraud, abuse and security incidents; and
to comply with the law and respond to lawful requests.

6. Consent

We rely on your consent for the uses described above, given when you create an account, submit a listing or an inquiry, or turn on a feature. Some uses (for example, keeping financial records or responding to a court order) are required or permitted by law.

Commercial email (such as saved-search alerts) is sent only with your express, opt-in consent, which we record. Every such email has an unsubscribe link that works without signing in. You can withdraw consent at any time, subject to legal or contractual restrictions; withdrawing may mean we cannot provide part of the Services.

7. When we share information

With the seller or buyer you choose to contact — your inquiry, booking or "sell to dealer" submission is shared with the dealer or seller it is addressed to. Once they receive it, their own privacy practices apply.
On public listings — a listing shows the vehicle details, photos, price and approximate location, and the dealer's business details. Private sellers' email and phone number are not shown publicly.
With service providers that process information for us under contract, only to provide the Services (see section 8).
For legal reasons — when required by law, to protect the rights, safety or property of our users or the public, or in connection with a merger or sale of our business (with notice to you).

8. Service providers and storage outside Canada

Our servers, databases and photo storage are hosted by DigitalOcean in Toronto, Canada. Some service providers process information outside Canada, mainly in the United States; while there, it may be accessible to authorities under the laws of that country:

Resend — sends our emails (your email address and the message content).
Stripe — processes dealer subscription payments.
Google — Sign in with Google; Gemini AI for vehicle valuation and trim matching (vehicle details and, for valuations, your province or postal code — never your name or contact details); Firebase Cloud Messaging for browser notifications you enable.
Meta — Sign in with Facebook.
Sentry — error monitoring (technical error details, which can include your user ID and IP address).
US National Highway Traffic Safety Administration (NHTSA) — vehicle VIN decoding and recall look-ups (the VIN only).

9. Cookies and similar technologies

We use a small number of cookies and browser-storage entries. Strictly necessary ones (keeping you signed in, your language) are always on; analytics is off until you accept it. See our Cookie Policy for the full list and to change your choices.

10. How long we keep information

Your account — while it is open. When you delete it, it is deactivated immediately and permanently erased after a 30-day grace period (you can cancel by signing back in). If the account has financial records (invoices, payments, paid subscriptions), we instead remove your personal details and keep those records for six years, as Canadian tax law requires.
Deleted listings — kept hidden for one year (for disputes, fraud review and recovery), then erased with their photos. Records of vehicles sold are kept.
Messages, inquiries and appointments — until the account they belong to is deleted.
Appraisal customer contact details entered by dealers — removed after two years.
Page-view history — 30 days. Account activity log — 90 days. Server logs — up to 90 days. In-app notifications — up to 180 days.
Backups — database backups are stored privately for up to 12 months and then destroyed.
Consent records — for as long as the account exists, so we can show when you agreed or withdrew.

11. Your rights and choices

We answer requests within 30 days. We may need to verify your identity first.

Access — download a copy of your personal information any time from Settings → Security → Download my data, or ask us by email.
Correction — update your profile in Settings, or ask us to correct anything inaccurate.
Withdraw consent — turn off email alerts in your saved searches or use the unsubscribe link in any alert email; change cookie choices in the Cookie Policy.
Deletion — delete your account from Settings → Security (accounts that sign in with Google or Facebook confirm with an emailed code).
Complaints — contact our Privacy Officer first. You may also complain to the Office of the Privacy Commissioner of Canada, or in Québec to the Commission d'accès à l'information.

12. How we protect information

We use encryption in transit (HTTPS), hashed passwords, encrypted storage of two-factor authentication secrets and stored provider credentials, role-based access for our staff, rate limiting and monitoring. Optional two-factor authentication is available in your account settings. No system is perfectly secure; if a breach of security safeguards creates a real risk of significant harm, we will notify you and the Privacy Commissioner as the law requires.

13. Children

The Services are intended for adults who have reached the age of majority in their province or territory. We do not knowingly collect information from minors.

14. Changes to this policy

We will post any change here with a new "Last Updated" date. If a change materially affects how we use information you already gave us, we will tell you in advance by email or in the Services, and ask for your consent where the law requires it.

15. Contact us

Privacy Officer, Vehicle Social Inc. — Toronto, Ontario, Canada — privacy@vehiclesocial.com