Privacy Policy
Last updated: 20 October 2026
This policy describes information handled when you create an account, save a profile, use Carsiq Match, or contact us. Essential session cookies are described below.
Information used by Carsiq
- Account and profile: your verified account email and, if you provide them, your name, mobile number, and selected city.
- Match profile: your selected city; household and passenger needs; driving and road-use patterns; budget and finance preferences; driver and parking context; safety, comfort, feature, powertrain and body-type preferences; ownership horizon; and the priorities you select.
- Recommendation session: the submitted Match profile snapshot, the recommendations calculated from it, and session details needed to return to or unlock that Match.
- Lead unlock: if you submit the unlock form, your name, mobile number, email, recommendation city and budget context, and your required privacy acknowledgement and separate optional WhatsApp and marketing choices. The consent record includes its capture time and may include one-way hashes of request IP and browser user-agent values for audit purposes.
- Support: information you choose to include when you email contactus@yourcarsiq.com.
How information is used
Carsiq uses this information to authenticate accounts, maintain profiles and Match sessions, calculate and display vehicle recommendations, unlock results after the required form is submitted, remember consent choices, protect the service, and respond to support requests. The current Match flow stores a submitted lead in Carsiq's application database; it does not automatically send your Match profile or lead details to a dealer or a vehicle pricing publisher.
Vehicle information and outside sources
Carsiq uses manufacturer information and other identified vehicle-data sources. City on-road figures may come from third-party estimates. Those figures can change and are not a dealer quotation or guaranteed purchase offer. Ex-showroom and city on-road figures are treated as separate values. If you follow an outside source link, that destination handles your visit under its own privacy information.
Service providers and storage
The current production service uses Supabase for authentication, database and company-media storage, Railway for the API service, and Vercel for the website. These providers process information as part of delivering the service. The current website has no customer file upload flow. Supabase Storage is used for public company assets such as site imagery; it is not a private document locker.
Cookies and sessions
Carsiq and Supabase Auth use session cookies to keep sign-in working. Carsiq also uses an essential guest-session cookie when you use Match without signing in. In production that cookie is HttpOnly, Secure, and SameSite=Lax and expires after 30 days. It lets the API associate a guest's Match requests with that browser. Blocking required session cookies may prevent account or Match features from working.
Retention and requests
Expired guest sessions that have no linked recommendation, lead, or consent record are automatically cleaned up. The current app does not set a general automatic deletion period for recommendation records or submitted leads. To ask about access, correction, or deletion of information, email contactus@yourcarsiq.com. We may need enough information to locate and verify the request and will assess it against applicable operational and legal requirements.
Security and updates
Carsiq uses access controls and the security features of its service providers to protect information. No internet service can promise that every transmission or stored record is risk-free. We may update this page when the product or its data handling changes; the date above identifies the latest posted version.
Questions? Contact Carsiq or email contactus@yourcarsiq.com.