Privacy Policy

SupercarIQ is designed with a minimal data footprint. Here is exactly what we collect:

• Account credentials — your name, email address, and a hashed password. Required to authenticate you. Stored in our database.
• Session data — an IP address and user agent string, stored temporarily by our authentication layer (Better Auth) to detect session hijacking. This is a security measure, not a tracking mechanism.
• Vehicle search queries — the VIN or text you search, along with decoded vehicle data (make, model, year, trim, paint). Stored to power your Garage history. These are vehicle records, not personal information about you.
• Buy/inquiry clicks — when you click "Talk to GTM" or a partner link, we record which vehicle and destination. No personal information beyond your user ID.
• Site analytics — Google Analytics records which pages are viewed, the device and browser, the approximate region, and how you arrived, using cookies that hold a random identifier. It is not sent your name, your email, or what you type into a search. SupercarIQ reports to the same Google Analytics property as Paddock20's related sites (paddock20.com, paddockgavin.com, pistonpoweredranch.com and gavinbrookshq.com), so a visit that follows a link between them is counted as one visit.

We do not collect: browsing history outside this app and those related sites, precise location, social profiles, demographics, or any data for advertising purposes. We do not run third-party ad scripts.

Your search queries are vehicle identification data — VINs, make/model combinations, and text searches. This information is used to decode vehicles and build your saved Garage. It is never used to profile you as an individual, sold to data brokers, or shared with advertisers. Aggregate, non-identifiable query patterns may be used to improve decode accuracy and model coverage. Searches you save are stored against your account so they appear in your Garage and recent searches. Our database provider encrypts stored data at rest using AES-256.

Data sent between your device and SupercarIQ is encrypted in transit with TLS (HTTPS). Our database provider, Neon, encrypts stored data at rest using AES-256. Your account password is never stored in plaintext — only as a salted, one-way hash.

We use Better Auth for session management. Sessions are token-based and stored server-side. The IP address and user agent associated with each session are retained only for the life of that session and are used exclusively to detect session hijacking — not for tracking or analytics. Sessions expire automatically and can be revoked by signing out.

Subscription payments are processed by Stripe on behalf of Paddock20. We never see or store your full card number, CVV, or billing address. Stripe handles all payment data under their own PCI DSS compliance program. You will see "Paddock20" on your card statement.

We share data with two categories of recipients: service providers required to operate SupercarIQ, and affiliated companies.

Service providers (data processor relationships):

• Vercel — hosting and edge infrastructure
• Neon — PostgreSQL database (AES-256 encrypted at rest)
• Stripe — payment processing (billed as Paddock20)
• Resend — transactional email (report delivery only)
• Specialist Builder Partners — see "Affiliate Partner Program" section below

None of these providers may use your data for their own marketing beyond the scope described in this policy.

Google Analytics measures how the site is used, as described under What We Collect. Google's own privacy policy covers that data.

Affiliated companies (constructive sharing — opt-out available):

• GoTime Motorsports (gotimemotorsports.com) — an affiliated company. Your name, email, and vehicle interest data may be shared with GoTime Motorsports for motorsport experiences, events, inventory, and product outreach relevant to your interests. GoTime Motorsports will never resell your data and must comply with this privacy policy.
• Paddock20 (paddock20.com) — the company that operates SupercarIQ. Data shared with Paddock20 is used solely for product development insights, aggregate usage analysis, and outreach about SupercarIQ-adjacent software products. No advertising profiles are built.

Affiliate sharing is constructive by design — it is used to deliver relevant motorsport experiences and technology, not to enable advertising targeting or data brokering. You may opt out at any time in Settings → Privacy.

We do not sell, rent, or trade personal information to data brokers, advertising networks, or any party outside our affiliated companies.

SupercarIQ maintains relationships with Specialist Builder partners — including but not limited to aftermarket tuning houses, custom fabrication shops, and performance specialists featured in the Builders section of our platform.

When you interact with a Specialist Builder through SupercarIQ — including clicking a social media link, visiting a builder's website, requesting an appointment, or using an affiliate referral code via our platform — we record that interaction. The data recorded includes:

• Your name and email address (if you are signed in)
• The date and time of the interaction
• Which builder profile you interacted with
• The type of link clicked (social, website, appointment, affiliate code)

This information may be shared with the relevant Specialist Builder partner for the following purposes:

• Verifying referral volume and establishing affiliate partnership agreements
• Enabling the builder to follow up with you regarding a build inquiry or appointment you initiated
• Demonstrating SupercarIQ's reach to potential and existing partner builders

By using the Connect with Builder features on any Specialist Builder profile, you consent to this data being shared with that builder partner. If you do not wish your information to be shared, do not use the Connect features while signed in — anonymous interactions (signed-out users) are recorded without personally identifiable information.

Builder partners who receive this data are required to use it only to respond to your inquiry or to confirm referral relationships with SupercarIQ. They may not use it for unrelated marketing without your separate consent.

Account data is retained as long as your account exists. Vehicle search history is retained to power your Garage. You may request complete deletion of your account and all associated data at any time by contacting us at support@supercariq.com. We will process deletion requests within 30 days. Stripe billing records may be retained as required by financial regulations.

You have the right to:

• Know exactly what data we hold about you (request a copy)
• Correct inaccurate account information
• Delete your account and all associated data
• Export your Garage search history in a portable format
• Opt out of transactional emails (except billing)

Contact us at support@supercariq.com to exercise any of these rights.

SupercarIQ is not directed at users under 13. We do not knowingly collect data from children. If you believe a child has created an account, contact us immediately and we will delete it.

If you are a California resident, the California Consumer Privacy Act (CCPA) gives you the right to opt out of the “sale” or “sharing” of your personal information.

SupercarIQ does not sell your personal information to data brokers or advertising networks, and does not share it for cross-context behavioral advertising.

We do, however, share your name, email, and vehicle interest data with our affiliated companies — GoTime Motorsports and Paddock20— for constructive, relevant outreach as described in the “Data Sharing” section above. Under CCPA's broad definition of “sharing,” this qualifies as sharing personal information with a third party. California residents may opt out of this at any time.

California residents also have these rights under the CCPA:

• Right to Know — request the categories and specific pieces of personal information we hold about you.
• Right to Delete — request deletion of your personal information, subject to certain exceptions.
• Right to Correct — request correction of inaccurate personal information.
• Right to Non-Discrimination — exercising any of these rights will never affect your access to SupercarIQ features.
• Right to Opt Out of Sharing — use the Settings toggle above, or email us and we will process it manually.

To submit any CCPA request, contact privacy@supercariq.com. We will respond within 45 days as required by law.

We will post any material changes to this policy on this page with an updated effective date. If changes are significant, we will notify you by email. Continued use of the service after the effective date constitutes acceptance of the updated policy.