Privacy Policy

• We do not sell customers’ personal information.
• We do not share customers’ personal information with other companies for their advertising or marketing.
• We do not currently send marketing emails or text messages.

If our practice on marketing messages changes, we will update this policy first and give you any choices the law requires.

Website visits. Our servers record technical information such as your IP address, browser type, the pages you request and the time of each request. You can browse auctions without an account.

Account and sign-in. Your email address and your password, which we store only as a one-way hash, along with sign-in sessions and security events such as failed sign-in attempts. A security check runs on our registration form.

Identity verification. You must verify your identity before you can bid. We collect your legal name, date of birth, address and phone number, images of your government-issued ID, and a photo of you holding that ID. Members of our team review them. This is not a credit check, and we do not use automated face matching or document reading to make the decision.

Bids and watchlist. Your bid amounts and times, your acknowledgment that each bid is binding, and the vehicles you save. Other visitors see bid activity under an anonymous label such as “Bidder 3,” not your name.

Purchases. Your pickup or delivery choice and address, invoice and tax details, payment records and references, signed documents, title and registration information, odometer and handover records, shipment progress, and warranty requests.

Card payments. When card payment is available, Stripe collects and handles your card details, including your full card number and security code. We do not receive or store them. We keep the card brand, last four digits and expiry date, along with Stripe’s identifiers and the status of each payment.

Bank transfers. The amount, date and reference of each transfer, and any details needed to match it to your purchase or to return it.

Selling or trading a vehicle. The VIN, mileage, ZIP code and condition of the vehicle, photos and video, title details, and loan details including your lender and payoff information.

Financing. If you apply, your employment status, income source, gross monthly income, monthly housing and other debt payments, and the income documents you upload, plus your agreement, payment history and balances. We currently do not obtain consumer credit reports for these applications.

Customer communications. The subject and content of your messages and our replies.

We use personal information to:

• create and secure your account, and prevent fraud and abuse
• confirm your email address and verify your identity
• determine bidding eligibility, run auctions and determine their results
• prepare invoices and documents, confirm taxes and government charges, and process and record payments
• arrange pickup or delivery, and handle title, registration and warranty matters
• evaluate vehicles offered to us and make offers
• review financing applications and service financing accounts
• answer your questions and send messages about your account, bids and purchases
• record which of our employees referred you, if you arrived through an employee’s link
• meet our legal, tax, licensing and record-keeping obligations, and protect our rights and those of others

Our team reviews identity verification and decides financing applications. The software performs calculations and checks, such as whether a bid meets the stated minimum and how a monthly payment compares with your stated income, and our team makes the financing decision.

We share information only as needed, with these recipients:

We use the National Highway Traffic Safety Administration’s public service to decode VINs, and it receives the VIN only. We finance vehicles ourselves, so applications are not sent to an outside lender.

We may also disclose information when the law requires it, to respond to legal process or regulators, to protect rights and safety, or as part of a sale or reorganization of our business.

These options apply only if and when they appear on our sign-in pages. If you choose one:

• The provider confirms your identity to WorkOS, our authentication provider, and may share your email address and basic profile details with it.
• We store your email address, the provider’s name and its account identifier for you.
• We use this information only to create your account and sign you in.
• We do not request access to your contacts, files, calendar or email content.
• We do not sell information received from these providers or use it for advertising.
• We do not connect a provider account to an existing account just because the email addresses match.
• Signing in this way does not replace identity verification, and it gives no staff access.

You can stop using a provider at any time through that provider’s account settings, and you can contact us about your account with us.

We use cookies needed to run the website:

Cloudflare’s security check on the registration form may also process browser and device signals. Our website does not currently use third-party analytics or advertising pixels.

The email our website sends relates to your account, bids, purchases, warranty and requests.

Shinjiru Technology Sdn Bhd, a hosting company registered in Malaysia, operates the server that holds our website, database and uploaded documents, including identity documents. Acronis stores backups of that server. Because of this, and because our other service providers also operate internationally, your information may be stored in or accessed from countries outside the United States, whose laws may differ from those where you live.

We encrypt identity details and identity documents, and we keep those documents in a private store separate from public website files. Connections to our website are encrypted, staff access is limited by role, and access to sensitive records is logged. No system is perfectly secure, so we can’t guarantee absolute security.

We keep personal information for as long as we need it for the purposes in this policy and as the law requires, which can differ by type of record and transaction.

Sale, payment, title, warranty and financing records are kept as business records and are not edited or erased in the ordinary course. Identity documents are not currently deleted automatically after review. Security logs are kept for up to 180 days. Backups keep copies for a period after the original is changed or removed.

To ask to see or correct your information, to ask us to delete it, or to close your account, contact support@carsofl.com. Accounts can’t currently be closed from your account page, so our team handles these requests directly. We may need to confirm your identity first.

We may be unable to delete information we are required or entitled to keep, such as bids, sale documents and financial records. Depending on where you live, you may have additional rights under the law.

If you finance a vehicle with us, you also receive a separate privacy notice with your financing agreement. It applies to that financing.

Our website is intended for people who can enter into a binding contract. We do not knowingly collect information from children.

We will post any change on this page and update the effective date. Our Terms of Service also apply to your use of our website: Terms of Service.