Privacy Policy
1. Who is responsible
Carnovus is operated by Why SOO SERIOUS LLC, a Wyoming limited liability company, 1309 Coffeen Avenue STE 1200, Sheridan, Wyoming 82801 ("Carnovus," "we," "us"). This policy covers carnovus.com and our related services (the "Service"). It should be read with our Terms of Service. We are a nationwide service and our first local launch market is the Greater Los Angeles area, so we include California privacy rights below; we extend similar rights to everyone where we can.
2. Information we collect
Information you give us
| When | What |
|---|---|
| Create an account | Name, email, phone number, password (stored only as a one-way hash), account type and plan. |
| Sell Your Car form | Vehicle details (VIN, year, make, model, trim, mileage, condition, options, history, title status), asking price, location/ZIP, up to 20 photos, your name, phone and email, and your text/email consent record. |
| Post or manage a listing | Listing details, photos, price, description, and (for sellers) the VIN, license plate and other data you enter. |
| Chat with an AI assistant | Everything you type, plus anything you tell it about budget, timing, trade-in, financing and credit situation in general terms, and your name, phone and email if you share them. A summary is created for the seller or dealer. |
| Dealer and team accounts | Business name, license and contact details, team members' names, emails, phone numbers, roles, and inventory data. |
| Contact us / support / staff calls | What you send us, and notes and outcomes recorded by our staff. If we later record or monitor calls, we will tell you at the start of the call. |
Information collected automatically
- Visitor and session identifiers that let us tell visits apart and join up your activity on one device (see "Cookies and similar tools").
- Activity: pages viewed, listings viewed, every search (including make, model and each filter you set), which results you click and in what position, chat starts, form steps, and similar events, with timestamps.
- Device and source: browser, device type, referring site, and campaign tags (UTM) on links that brought you here.
- Approximate location: your IP address is used to work out your state and city when you visit, and we do not store the IP address with that record. For security and abuse prevention, our hosting and rate-limiting systems may briefly process IP addresses. We do not collect precise GPS location.
- Consent and audit records: when and how you agreed to be contacted, the wording you saw, and security/audit logs of actions in accounts.
Information from others
- Vehicle data from VIN-decoding and similar data providers.
- Information dealers and sellers add about their inventory, offers and conversations with you.
3. How we use information
- Run the Service: create and secure accounts, show listings, process sell requests, and show you offers and dashboards.
- Match and deliver leads: choose dealers for your vehicle and location, and pass qualified buyer or seller details to the right seller or dealer.
- AI assistants: generate chat replies, qualify buyers, and write the lead summary. Chat text is processed by a third-party AI provider (see Section 5). We do not use your chat to make decisions that have legal or similarly significant effects, such as approving credit; that is for the dealer and lender.
- Contact you: send offers, alerts, account and security messages, and, where you agreed, text and email about your inquiry or vehicle.
- Improve Carnovus: analyze what people search for, which sources bring people, where they drop off, and which vehicles or regions are underserved, so we can improve search, recruit dealers with the right inventory, and plan marketing. We aim to use aggregated or de-identified results for this.
- Advertising and measurement: measure our own ads and campaigns. If we create audiences on advertising platforms (see Section 5), we will do so only as described there.
- Safety and legal: detect fraud, spam, bots and abuse, enforce our Terms, keep audit logs, and comply with law.
4. Staff access
Carnovus staff can see only what their role allows. Phone numbers and emails are hidden from staff roles that do not need them, and staff actions on accounts are logged.
5. Who we share information with
| Who | What and why |
|---|---|
| Dealers and sellers you are dealing with | For buyer inquiries: your chat summary and contact details you provided, so they can follow up. For sell requests: vehicle details and photos go to matched dealers; your name, phone and email are revealed to a dealer only after you accept or counter that dealer's offer. Once shared, the dealer or seller handles that information under its own policies. |
| Service providers (processors) | Cloud database and file storage (Supabase); application hosting (Railway); AI model provider (Anthropic) for chat and summaries; email delivery (Resend); text messaging (Twilio, when connected); payment processing (Stripe, when connected); fonts (Google Fonts, which can receive your IP address when your browser loads them). They may use the data only to provide services to us. |
| Advertising platforms (planned) | We may in future upload hashed (scrambled) email or phone identifiers to Google or Meta to build audiences or measure ads. We will do this only for people who agreed, and we will honor opt-outs (including Global Privacy Control signals). This may count as "sharing" under California law; see Section 8. |
| Legal and safety | Authorities, courts and others when we believe disclosure is required by law, or needed to protect rights, safety, or prevent fraud. |
| Business changes | A buyer or successor if Carnovus is involved in a merger, financing, or sale of assets, with the same protection for your information. |
We do not sell your personal information for money. We do not share your mobile number or text-messaging consent with third parties for their own marketing; the only sharing of your phone number is with the dealers or sellers described above, for the inquiry or offer you started.
6. Cookies and similar tools
We use your browser's local storage and session storage (similar to cookies) for:
| Name / type | Purpose | How long |
|---|---|---|
cv_vid (visitor id) | A random id so we can count unique visitors and join up your searches and clicks on this device. Contains no name or contact details. | Until you clear your browser data |
cv_sid, cv_utm, cv_ref, cv_last_search (session) | Group activity into a visit; remember the campaign that brought you; connect a search to the clicks that follow. | Until you close the tab |
Sign-in details (carnovus_user, carnovus_dealer, staff session) | Keep you signed in and secure your account. | Until you sign out or the session expires (customers up to 14 days, dealer teams 24 hours, staff 12 hours) |
| Chat history | Keep your chat with a listing's assistant on your device. | Until you clear your browser data |
We do not currently use third-party advertising cookies or sell data to ad networks. If that changes, we will update this policy and ask for your choice first where the law requires. You can clear or block browser storage in your browser settings; some parts of the Service (sign-in, chat history) will not work without it. When you first visit, a banner tells you about this and lets you Accept or Decline analytics. If you decline, we stop recording your page views, searches and clicks, delete your visitor id, and stop attaching it to requests. You can change your choice any time with the "Privacy Choices" link in the footer. Features you ask for (signing in, chat, sending a form) still work either way. We treat a Global Privacy Control (GPC) browser signal as a request to opt out of sale/sharing. Browsers' "Do Not Track" signals are not a recognized standard, so we do not respond to them separately.
7. How long we keep information
| Data | Kept for |
|---|---|
| Account and profile | While your account is open, then deleted or de-identified within 90 days of a deletion request, except records we must keep. |
| Listings and photos | While the listing is live; removed within 90 days after you delete it or the listing expires. |
| Sell requests, offers and leads | Up to 3 years after the last activity, so both sides can resolve disputes and we can improve matching. |
| Chat conversations and summaries | Up to 3 years after the last message. |
| Website activity and search data | Up to 24 months, then deleted or aggregated. |
| Consent records and message logs | At least 5 years, because the law may require us to prove consent. |
| Security and audit logs | Up to 24 months. |
We may keep information longer where needed for legal obligations, disputes, fraud prevention or to enforce our agreements.
8. Your privacy choices and rights
You can review and edit your profile in your account settings, and delete your account there. You can also contact us (Section 12) to use the rights below. Depending on where you live, including California, you may have the right to:
- Know and access the personal information we hold about you, the categories of sources and purposes, and who we share it with, and receive a portable copy;
- Correct inaccurate information;
- Delete your information (subject to exceptions such as legal requirements and the dealers' or sellers' own records of conversations already shared);
- Opt out of "sale" or "sharing" of personal information and of targeted advertising;
- Limit use of sensitive personal information. We do not use sensitive information to infer characteristics about you. Account credentials and information you volunteer in chat (for example, general comments about credit) are used only to provide the Service you asked for;
- Not be discriminated against for using these rights.
Do Not Sell or Share My Personal Information. We do not sell personal information for money. If we begin sharing hashed identifiers with advertising platforms, we will add a "Do Not Sell or Share My Personal Information" link in the footer and honor your choice and GPC signals. Until then, there is nothing to opt out of, but you may still send us the request.
How to ask. Email us at the address in Section 12 from the email on your account, or write to our mailing address. We will confirm your identity (by matching information we already have), and respond within 45 days (we may extend once by another 45 days and will tell you). You may use an authorized agent with your written permission. If we deny a request, you can appeal by replying to our response, and you may contact your state attorney general.
California "Shine the Light." California residents may ask once a year which categories of personal information we shared with third parties for their direct marketing. We do not share it for that purpose.
Text and email. Reply STOP to any text to stop texts, HELP for help. Use the unsubscribe link in any marketing email or write to us. We may still send account, security and transaction messages.
9. Security
We use measures such as encrypted connections (HTTPS), hashed passwords, signed sign-in tokens, role-based access limits, rate limits, and audit logs. No system is perfectly secure, and we cannot guarantee absolute security. Please use a strong, unique password. If a breach affects you, we will notify you as the law requires.
10. Children
The Service is for adults 18 and older. We do not knowingly collect information from children under 18. If you believe a child gave us information, contact us and we will delete it.
11. Where data is processed; changes to this policy
We and our providers process data in the United States. If we change this policy, we will post the new version with a new date, and for material changes notify you on the site or by email. Using the Service after the effective date means you accept the update.
12. Contact us
Why SOO SERIOUS LLC (Carnovus)
1309 Coffeen Avenue STE 1200, Sheridan, Wyoming 82801
Privacy requests: info@carnovus.com