Privacy Policy
A draft tied to the account, marketplace and support data flows.
Review draft. This document has not been adopted as binding terms and is not legal advice.
Data collected
Account email and profile details support authentication and ownership. Garage records, serial identifiers, claims and uploaded media support equipment identity. Listings contain seller-supplied or externally observed descriptions, prices and locations. Favorites, saved searches, offers, messages and transaction records support requested marketplace functions. Valuation and identification workflows process inputs and analytical outputs. Trust requests contain contact details and the evidence you choose to provide.
Use and disclosure
Public listings expose the designated listing information; private account and case information is restricted. Supabase supports authentication and data storage. Vercel supports hosting and optional analytics. AI or payment processing depends on the configured provider and activated feature. Do not submit government identifiers, bank details or confidential documents in general request fields. Provider contracts, countries and subprocessors require operator confirmation.
Retention
Retention is purpose-specific. Public removal and internal evidence retention are different decisions. The proposed schedule and legal-hold process are subject to approval; no fixed statutory period is asserted here. Rights requests can seek deletion, correction or minimization. Necessary transaction or dispute records may require limited retention, with the basis documented. Backups and provider copies require coordinated handling.
Your choices
Use /privacy to request access, correction, deletion, portability, opt-out, consent withdrawal or appeal. We assess identity proportionately and explain any applicable refusal or extension. Optional analytics starts only after an affirmative choice and remains disabled when Global Privacy Control is signaled. Withdrawing browser consent does not itself erase previously collected records.
International and children’s data
Publicly visible source data may still be personal data. No GDPR, UK GDPR, Canadian or state-law applicability determination is implied. Lawful bases, transfer safeguards, representative obligations and local rights must be assessed before expansion. Proposed accounts are for adults; do not provide children’s personal data.
Affiliate and Marketplace Tracking
Where KartExchange has activated an approved affiliate or referral program, a labeled marketplace link may carry tracking IDs or referral parameters and may involve cookies, browser or device information and similar technologies. KartExchange and the relevant affiliate network may use this information for referral attribution, analytics, accounting, fraud prevention and marketplace operation. KartExchange may receive reports about qualifying referral activity or transactions. An affiliate click does not itself give KartExchange your payment card details or complete marketplace account information. Purchases and activity on the destination marketplace are governed by that service’s privacy policy and terms. Review those policies and applicable cookie choices before continuing. Program participation and tracking must be configured and disclosed before activation; this draft does not assert that every marketplace link is monetized.
Items for counsel and operator review
Confirm controller identity/contact/address, processing inventory, retention periods, vendors/transfers, lawful bases, sale/sharing classification, notices at collection and jurisdiction thresholds. Confirm actual EPN/API program approval, tracking and retention scope, AI permissions and partner distribution rights before activation.
Version history
2026-09-05 — Initial engineering draft for counsel review; not adopted. Permanent version
2026-09-11 — Expanded unadopted engineering draft for marketplace, affiliate and source-specific AI restrictions; requires review before adoption. Permanent version