Privacy Policy

Effective Date: August 22, 2026

This Privacy Policy explains how the operator of CarHistoryReport.ca (the “Company,” “we,” “us,” or “our”), collects, uses, discloses, and protects personal information in connection with the website at https://carhistoryreport.caand the services offered through it (the “Service”). It should be read together with our Terms of Service.

We handle personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (“PIPEDA”), the Act respecting the protection of personal information in the private sector(Quebec), as amended by Law 25 (“Law 25”), and other applicable Canadian privacy legislation. By using the Service, you consent to the collection, use, and disclosure of your personal information as described in this Policy. Where the law requires it, we will obtain your express consent.

1. Personal Information We Collect

We collect only the information necessary to provide the Service:

• (a) Contact information. Your email address, which you provide when you purchase a Smart Buyer Report or contact support.
• (b) Payment information. Processed directly by Stripe, Inc. We do not receive or store your full card number, security code, or expiry date; we receive only a transaction confirmation and the final four digits of the card.
• (c) Vehicle identification numbers (VINs). VINs identify vehicles rather than individuals and do not, on their own, constitute personal information about you.
• (d) Technical information. Your IP address, browser type, device characteristics, approximate location (country and city), and the pages you view, collected automatically for security, fraud prevention, and aggregate analytics.
• (e) Public vehicle data. Recall, complaint, and safety information sourced from NHTSA, Transport Canada, and the EPA, which relates to vehicles rather than to individuals.

We do not knowingly collect sensitive personal information — such as health information, biometric identifiers, or government identifiers like a Social Insurance Number — and you should not provide any such information to us.

2. How We Use Personal Information

We use personal information for the following purposes:

• (a) to provide the free VIN check, including decoding and recall data;
• (b) to process Smart Buyer Report purchases and deliver Reports by email;
• (c) to generate AI-assisted analysis through Anthropic, to which we transmit only vehicle data (year, make, model, and recall history) and never your email address or any other personal information;
• (d) to respond to support enquiries and administer refunds;
• (e) to detect, prevent, and investigate fraud and misuse;
• (f) to maintain and improve the Service through aggregated analytics; and
• (g) to comply with our legal obligations, including the retention of transaction records under the Income Tax Act.

We do not sell, rent, or trade your personal information. We do not send marketing or promotional messages (see the Electronic Communications section of our Terms of Service), and we do not use advertising trackers, behavioural profiling, or retargeting technology.

3. Cookies and Analytics

We use strictly necessary cookies to operate the Service, such as maintaining your session at checkout, and Google Analytics with IP anonymization enabled to understand aggregate usage patterns. You may disable cookies through your browser settings or opt out of Google Analytics at https://tools.google.com/dlpage/gaoptout. We do not use advertising cookies, social-media pixels, or session-replay technology.

4. Service Providers and Disclosure

We disclose personal information only in the following circumstances:

• (a) Service providers. To the providers listed below, which process information on our behalf and are contractually restricted to the purposes we authorize.
• (b) Legal requirements. Where required by applicable law, court order, subpoena, or a lawful request from a governmental authority.
• (c) Fraud and safety. Where we reasonably believe disclosure is necessary to investigate fraud or to protect the rights, property, or safety of any person.
• (d) Business transaction. If the Company is involved in a merger, acquisition, reorganization, or sale of assets, personal information may be transferred to the successor, which will remain bound by this Policy or a materially equivalent one. We will notify you of any such transfer.

The service providers we rely on are:

5. Retention

We retain personal information only as long as necessary for the purposes described in this Policy or as required by law:

• (a) Smart Buyer Reports remain accessible to you for ninety (90) days and are retained internally for up to twelve (12) months to support refunds and disputes.
• (b) Transaction records are retained for seven (7) years to meet obligations under the Income Tax Act.
• (c) Support correspondence is retained for twenty-four (24) months.
• (d) IP-address logs are retained for up to twelve (12) months for security and fraud prevention.
• (e) Anonymized analytics are retained indefinitely and cannot be linked back to you.

When personal information is no longer required, we delete or irreversibly anonymize it.

6. Storage and Security

Personal information is stored on infrastructure operated by Vercel and Supabase in North American data centres. We apply Transport Layer Security (TLS) encryption in transit and at rest and restrict access to personnel who require it. No system is completely secure; however, in the event of a confidentiality incident or breach that presents a real risk of significant harm to you, we will notify you and the appropriate regulator — the Office of the Privacy Commissioner of Canada and, for affected Quebec residents, the Commission d'accès à l'information du Québec — as required by law, and will keep a record of the incident.

Your Smart Buyer Report is accessed through a unique link sent to your email address, and you are responsible for keeping that link confidential.

7. Transfers Outside Canada

Several of our service providers are located in the United States, and your personal information may be stored or processed there. Information processed outside Canada may be accessible to courts, law-enforcement agencies, and regulatory authorities of those jurisdictions under their laws. Before transferring personal information outside Quebec or Canada, we take reasonable steps — including entering into written agreements that require appropriate safeguards — to ensure it receives a comparable level of protection. By using the Service, you consent to these transfers.

8. Your Rights

Under PIPEDA, you have the right to access the personal information we hold about you, to request correction of inaccuracies, to withdraw your consent (subject to legal or contractual limitations), and to request deletion, subject to retention obligations such as those under tax law.

If you are a Quebec resident, Law 25 additionally provides you with the right to receive the personal information you have provided in a structured, commonly used technological format (data portability), to request that certain information be de-indexed or cease to be disseminated in defined circumstances, and to be informed of, and to submit observations regarding, any decision based exclusively on the automated processing of your personal information.

To exercise any of these rights, contact us at support@carhistoryreport.ca. We will respond within thirty (30) days. If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca) or, if you are a Quebec resident, the Commission d'accès à l'information du Québec (https://www.cai.gouv.qc.ca).

9. Automated Decision-Making

The Smart Buyer Report presents AI-generated analysis of vehicle data. It does not make any decision about you as an individual, and we do not use your personal information to render decisions based exclusively on automated processing. Should this change, we will update this Policy and provide the disclosures required by Law 25.

10. Children

The Service is intended for adults and is not directed at anyone under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

11. Changes to This Policy

We may update this Policy from time to time. The “Effective Date” above indicates the most recent revision. Where a change is material, we will provide notice through the Service or by email where reasonably practicable.

12. Privacy Officer and Contact

The person responsible for the protection of personal information for CarHistoryReport.ca may be contacted regarding this Policy, a privacy request, or any related concern at:
CarHistoryReport.ca
Email: support@carhistoryreport.ca

This Privacy Policy was last revised on August 22, 2026.