Launch draft — attorney/privacy review required. This file is a product/engineering placeholder and is not legal advice.
Effective version: 2026-09-08
CARSARU may process account email, VINs, listing details, ZIP code, mileage, uploaded images/video/audio/documents, saved reports, Garage data, notification preferences, purchase entitlements and limited error telemetry.
Data is used to provide vehicle analysis, account access, saved Garage features, notifications, billing entitlements, service security and reliability.
Uploaded evidence may be sent to configured AI and vehicle-data providers solely to provide requested analysis. Payment-card details should be handled by the configured payment provider rather than stored by CARSARU.
Before launch, define explicit retention periods for uploads, reports, sessions, telemetry and deleted accounts. The production service should minimize retained raw media where practical.
Users should be able to manage notification preferences and request account/data deletion. A production deletion workflow must be implemented before broad public launch.
Secrets belong server-side. Sessions are stored as hashes in the current architecture. No system can guarantee absolute security.
Replace this section with the privacy contact and business identity before release.