Privacy Policy

Effective Date: October 1, 2026

1. Introduction

CarScout is operated by Bruno Amorim as a sole proprietor based in Indiana. CarScout is a vehicle search monitoring and market intelligence platform that helps car buyers find and track vehicles across dealerships and marketplaces. This Privacy Policy explains how CarScout collects, uses, discloses, and protects your personal information when you use usecarscout.com and related services (collectively, the "Service").

Read this policy to understand our data practices and the choices available to you. Our Terms of Service govern your use of the Service.

2. Information We Collect

2.1 Account Information

When you create an account, we collect information through our authentication provider, Clerk. This includes:

  • Email address
  • Name (first and last)
  • Profile image (if provided through your identity provider)
  • Authentication method and session data

2.2 Payment Information

When you subscribe to a paid plan, payment processing is handled entirely by Stripe. We store:

  • Stripe customer ID and subscription ID
  • Subscription plan, status, and billing period
  • Billing interval and renewal status

We do not store your credit card number, CVV, or full billing address. All sensitive payment data is handled directly by Stripe in accordance with PCI DSS standards.

2.3 Search and Scout Data

When you create vehicle search monitors ("scouts"), we collect and store the search criteria you define:

  • Vehicle make, model, year range, and trim preferences
  • Price range (minimum and maximum)
  • Mileage limits
  • Location (ZIP code or city) and search radius
  • Color preferences (exterior and interior)
  • Transmission type, drivetrain, body style, and fuel type
  • Desired features and other filters

2.4 Activity and Usage Data

As you interact with the Service, we collect data about your activity:

  • Vehicle listings you view, save, or dismiss
  • Alert history and notification preferences
  • Feedback you submit about listings or the Service
  • Feature usage patterns and navigation behavior

2.5 Technical Data

We collect technical information to improve the Service and assist with support requests:

  • Browser user agent string
  • Viewport dimensions and device type
  • Page URL at the time of feedback submission
  • IP address (collected by Cloudflare as part of standard request handling)

2.6 Advertising and Attribution Data

To measure the effectiveness of our marketing, we collect attribution parameters when you arrive at our site:

  • UTM parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content)
  • Google Click ID (gclid)
  • Facebook Click ID (fbclid)
  • TikTok Click ID (ttclid)
  • Facebook browser ID (_fbp) and click ID cookie (_fbc)
  • TikTok browser ID (_ttp)
  • Google Analytics client ID (gaClientId)

2.7 Lead Capture Data

On our public market intelligence pages, you may optionally provide your email address to join a list for future vehicle, market, or product updates. When you do, we collect:

  • Email address
  • The vehicle (make, model, year) you expressed interest in
  • Any UTM or attribution parameters from your session

2.8 Cookies and Local Storage

We use cookies and browser storage to operate the Service, understand usage, and measure advertising performance:

  • Essential cookies: Clerk uses cookies to authenticate you and maintain your login session
  • Analytics technologies: Google Analytics and Microsoft Clarity collect usage and interaction data
  • Advertising technologies: Google Ads, Meta Pixel, and TikTok Pixel collect browser and attribution identifiers, such as _fbp, _fbc, and _ttp
  • Browser storage: Local and session storage temporarily hold attribution parameters and interface state

These analytics and advertising technologies load when the related service is configured. You can limit cookies through your browser settings, but blocking essential cookies may stop account features from working.

2.9 Connected AI services

If you connect your account to ChatGPT or another supported AI service, CarScout receives authentication tokens to verify your account and permissions through Clerk. We also receive the requests that service sends to CarScout, including search criteria, selected scout or match identifiers, and feedback you ask it to submit.

3. How We Use Your Information

We use the information we collect for the following purposes:

  • Service delivery: To run vehicle searches, send daily match digests, and display market intelligence data
  • Payment processing: To manage subscriptions, process payments, and handle billing inquiries through Stripe
  • Transactional emails: To send match alerts, subscription confirmations, and account-related notices through Resend
  • Advertising measurement: To measure ad campaign effectiveness and attribute conversions to the correct marketing channels
  • Analytics: To understand how users interact with the Service, identify issues, and improve features
  • Requested updates: To send future vehicle, market, or product updates to people who join an update list
  • Support: To diagnose issues and respond to feedback submissions

4. How We Share Your Information

We share your information with the following third-party service providers, each for a specific purpose:

Identity and Authentication

  • Clerk: Manages user accounts, authentication, and session management. Receives your email, name, and profile image.

Payments

  • Stripe: Processes all payments and manages subscriptions. Receives your payment method details directly (we never see your full card number).

Email Delivery

  • Resend: Delivers transactional emails including match alerts and account notifications. Receives your email address and message content.

Analytics and Advertising

  • Google Analytics 4 and Google Ads: Receive page views, browser identifiers, events, and purchase data for analytics and conversion measurement.
  • Meta Pixel and Conversions API: Receive browser identifiers, purchase events, and hashed identifiers such as email, name, and user ID for ad measurement and attribution on Facebook and Instagram.
  • TikTok Pixel and Events API: Receive browser identifiers, purchase events, and hashed identifiers such as email and user ID for TikTok ad measurement and attribution.
  • Microsoft Clarity: Receives interaction data used to create session replays and heatmaps that help us improve the interface.

Infrastructure

  • Cloudflare: Hosts the Service and processes requests, IP addresses, application data, and stored media on our behalf.

Vehicle Data Providers

  • MarketCheck: Receives vehicle search queries (make, model, year, location) to return matching listings. No user identity information is shared.
  • Google Maps Platform: Receives location text for geocoding purposes. No user identity information is shared.

AI and Public Data Services

  • Cloudflare Workers AI: Processes vehicle listing images for analysis. No personally identifiable information is sent.
  • NHTSA and EPA: Public government APIs used for vehicle specifications and safety data. No user data is shared with these services.

Connected AI services

When you use a connected AI service, such as OpenAI's ChatGPT, we return the results of its permitted requests to that service. These results can include your scouts and search criteria, saved matches, account usage limits, and confirmations of account actions or feedback submissions. The AI service handles information it receives under its own privacy policy and retention settings. Use that service's controls to manage the connection and data it retains.

We may also disclose information when required by law, when needed to protect people or the Service, or as part of a merger, financing, acquisition, or sale of assets. We require any recipient to handle the information as required by applicable law.

We do not sell personal information for money. Our use of analytics and advertising services may be considered a sale, sharing, or targeted advertising under some state privacy laws. Section 8 explains how to submit an applicable rights request.

5. Data Infrastructure and Security

CarScout is built on Cloudflare's infrastructure. Your data is processed and stored using:

  • Cloudflare Workers: Application hosting and request processing
  • Cloudflare D1: Primary database for account and application data
  • Cloudflare R2: Storage for vehicle images and media assets
  • Cloudflare KV: Fast-access storage for application configuration

We use administrative, technical, and organizational safeguards designed to protect personal information. These safeguards include encrypted network connections and restricted access to production credentials. No system is completely secure, so we cannot guarantee that personal information will never be accessed, used, or disclosed without authorization.

We and our service providers may process information in the United States and other countries where they operate, subject to applicable legal safeguards.

6. Data Retention

We retain your data as follows:

  • Active accounts: Your account data, scouts, and match history are retained for the duration of your account.
  • Account deletion: When you delete your account through account settings, we delete your user record, scouts, and alerts from our primary database. We also request deletion of your Clerk account and immediate cancellation of an active Stripe subscription.
  • Provider and legal records: Stripe, analytics and advertising providers, and other service providers may retain records under their own policies or legal obligations. We may also retain limited records when required for fraud prevention, security, tax, accounting, or legal compliance.
  • Logs and backups: Limited information may remain temporarily in security logs or backups until it is deleted through normal retention cycles.
  • Lead capture data: Email addresses collected through market intelligence pages are retained until you unsubscribe or request deletion.

For scout creation requests with retry protection, we store a record with your account, request, and scout identifiers, a hash of the original request details, and an expiry time. This record prevents a repeated request from creating another scout, including after you delete the scout. The request ID expires 24 hours after it is issued. Expiry does not immediately delete the record: later scout creation requests remove expired records in limited batches. Deleting your account removes these records from our primary database. Deleting CarScout data does not delete copies already received by a connected AI service.

7. Your Rights and Choices

You have the following choices regarding your data:

  • Email preferences: You can use the unsubscribe link in marketing emails and daily match digests. We may still send messages needed to operate your account or process billing.
  • Account deletion: You can delete your account at any time through account settings. Section 6 explains what happens when you delete the account.
  • Analytics opt-out: You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.
  • Cookie management: You can control cookies through your browser settings. Disabling essential cookies may affect account features.
  • Data access and deletion requests: You can request a copy of your data or request deletion by emailing us at privacy@usecarscout.com.

8. U.S. State Privacy Rights

Some U.S. state privacy laws may apply based on where you live, how CarScout operates, and legal thresholds. If an applicable law covers your request, your rights may include the right to:

  • Confirm whether we process your personal information and access that information
  • Correct inaccurate personal information
  • Delete personal information, subject to legal exceptions
  • Receive a portable copy of personal information you provided
  • Opt out of targeted advertising, a sale or sharing of personal information, or certain profiling when the applicable law provides that right
  • Appeal our decision on a request when the applicable law provides an appeal right
  • Receive equal service and pricing when you exercise a privacy right

To submit a request, email us at privacy@usecarscout.com. We may need to verify your identity before we process the request. Rights, exceptions, and response periods vary by state, and we will respond as required by applicable law.

9. Vehicle Data Sources

CarScout aggregates vehicle listing data from third-party sources to provide our search and market intelligence features:

  • MarketCheck: Aggregates listings from dealer websites, manufacturer certified pre-owned programs, and major marketplaces.
  • AutoTrader: Used as a supplementary source for market pricing and inventory data.
  • NHTSA: Provides vehicle safety ratings, recall information, and VIN decoding through public APIs.
  • EPA: Provides fuel economy ratings and vehicle specifications through public APIs.

No personal information is collected from or shared with these vehicle data sources. The data we obtain is limited to publicly available vehicle listing and specification information.

10. Children's Privacy

CarScout is not intended for anyone under 18, and you must be at least 18 to create an account. We do not knowingly collect personal information from anyone under 18. If we learn that we collected personal information from a person under 18, we will take appropriate steps to delete it. If you believe a person under 18 provided personal information to us, contact us at privacy@usecarscout.com.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. When we make changes, we will update the "Effective Date" at the top of this page and provide additional notice when required by law.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: