Privacy Policy

1. Who we are

CAuto ("CAuto", "we", "us") runs cautoauction.com, an online car auction and marketplace based in Halifax, Nova Scotia. This policy explains how we collect, use, share and protect personal information, in line with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where they apply, provincial privacy laws such as those of Quebec, Alberta and British Columbia.

CAuto is responsible for the personal information we control. Our Privacy Officer is Zain Khan, Founder and CEO, who you can reach at support@cautoauction.com.

2. What we collect

What	Details
Waitlist	Your name, email and province, if you join the waitlist.
Account	Your name, email, password (stored encrypted by our login provider), and, if you sign in with Google, your name, email and profile picture from Google.
Profile	Your profile photo, display name, any short bio you add, and your language (English or French).
Listings	Car details, VIN, city and province, photos, video, and any car documents you upload, such as ownership or service records.
Bids and activity	Your bids, watchlist, comments, reservations and the time of each action.
Messages	Private messages with other members and with CAuto, and support requests.
Deal details	The phone number, pickup or shipping preference, location, address and best times you choose to share with the other person in a deal.
Payments	Stripe collects your card details. We receive only limited information from Stripe, such as the card brand, last four digits, and whether a payment or hold succeeded.
Technical	Basic information your browser sends, such as IP address, device and browser type, and error logs, kept by our hosting and database providers to run and secure the site.

3. How we use it

• To create and secure your account, and to let you sign in.
• To review listings, run auctions, place and release bid holds, and charge CAuto's fees.
• To connect buyers and sellers after a sale, so they can complete the deal.
• To send you emails about your account, bids, sales and messages, in the language you chose.
• To answer your questions and support requests.
• To prevent fraud, enforce our Terms of Service, and keep the site safe.
• To meet our legal, tax and accounting obligations.
• To understand how the site is used so we can improve it.

We use your information only for the purposes we describe here, or for purposes a reasonable person would expect. If we want to use it for something new, we'll ask first.

4. What other people can see

• Public: your display name and profile photo next to your listings, bids and public comments, and the details and photos of cars you list. The VIN you enter is shown on the car page.
• The other person in your deal: the contact and handover details you choose to share in the Deals tab, and the private messages you send them.
• CAuto staff only: your email, car documents you upload, payment status, and messages when needed to review a report, prevent fraud or resolve a dispute.

Please don't put phone numbers, addresses or ID numbers in public comments.

5. Who we share it with

We do not sell or rent your personal information. We share it only with:

• Service providers that help us run CAuto, under contracts that require them to protect it and use it only for us:
  • Supabase, for our database, logins and file storage (hosted in Canada)
  • Stripe, for card payments and bid holds
  • Resend, for sending emails
  • Vercel, for hosting the website
  • Google, if you choose to sign in with Google
• Other members, as described in section 4.
• Authorities, when the law requires it, or when needed to prevent fraud or protect someone's safety.
• A future owner of CAuto, if the business is sold or merged, who must keep protecting your information under this policy.

6. Where your data is stored

Our main database, logins and uploaded files are stored with Supabase in Canada (Canada Central region). Stripe, Resend and Vercel may process and store information in the United States or other countries. When information is outside Canada, it is protected by our contracts with those providers but may be accessed by the courts, law enforcement or national security authorities of that country.

7. Emails we send

We send emails that are part of the service, such as sign-in links, new message alerts, and updates about your bids, listings and deals. Message alerts don't include the text of the message. They link you back to CAuto to read it.

If you join the waitlist, we email you when CAuto opens. We only send marketing emails, such as news and featured cars, with your consent, as required by Canada's Anti-Spam Legislation (CASL). Every marketing email has an unsubscribe link.

8. Cookies and browser storage

We use your browser's storage to keep you signed in and to remember small settings. Stripe uses cookies on payment forms to prevent fraud. We do not use advertising cookies or third-party tracking. If you block storage, you may not be able to sign in.

9. How long we keep it

• Account and profile information: while your account is open.
• Listings, bids, sales and payment records: up to 7 years after the sale or payment, for tax, accounting and dispute purposes.
• Messages: while your account is open, and up to 2 years after a deal ends, in case of a dispute.
• Waitlist details: until CAuto opens and we've told you, or until you ask us to remove them.

When we no longer need information, we delete it or make it anonymous.

10. How we protect it

We use encrypted connections (HTTPS), encrypted password storage, database rules that limit each person to their own private data, and limited staff access. No system is perfectly secure, so please use a strong password that you don't use anywhere else. If a breach creates a real risk of significant harm to you, we will tell you and the Privacy Commissioner of Canada as the law requires.

11. Your choices and rights

You can:

• See and update your name and photo in the Account tab of your dashboard.
• Ask for a copy of the personal information we hold about you.
• Ask us to correct information that is wrong.
• Withdraw your consent or ask us to delete your account. We may need to keep some records, such as completed sales and payments, where the law requires.
• Unsubscribe from marketing emails at any time.

Email support@cautoauction.com with the subject "Privacy". We will reply within 30 days. If you are not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada, or your provincial privacy commissioner, such as the Commission d'accès à l'information in Quebec.

12. Young people

CAuto is for adults who have reached the age of majority in their province. We don't knowingly collect information from anyone younger. If you think a minor has given us information, tell us and we'll delete it.

13. Changes to this policy

We may update this policy as CAuto grows. We'll post the new version here with a new date, and tell you by email or on the site if a change is important.