Privacy Policy

SupercarIQ is designed with a minimal data footprint. Here is exactly what we collect:

• Account credentials — your name, email address, and a hashed password. Required to authenticate you. Stored in our database.
• Session data — an IP address and user agent string, stored temporarily by our authentication layer (Better Auth) to detect session hijacking. This is a security measure, not a tracking mechanism.
• Vehicle search queries — the VIN or text you search, along with decoded vehicle data (make, model, year, trim, paint). Stored to power your Garage history. These are vehicle records, not personal information about you.
• Buy/inquiry clicks — when you click "Talk to GTM" or a partner link, we record which vehicle and destination. No personal information beyond your user ID.

We do not collect: browsing history outside this app, location, device identifiers, social profiles, demographics, or any data for advertising purposes. We do not run third-party ad scripts.

Your search queries are vehicle identification data — VINs, make/model combinations, and text searches. This information is used to decode vehicles and build your saved Garage. It is never used to profile you as an individual, sold to data brokers, or shared with advertisers. Aggregate, non-identifiable query patterns may be used to improve decode accuracy and model coverage. All query data stored in our database is encrypted at rest using AES-256.

Vehicle search queries are encrypted using AES-256-GCM before any storage or caching. This means that even in the event of unauthorized database access, stored query values are unreadable without the encryption key. Your account password is hashed using bcrypt and is never stored in plaintext. All data in transit is protected by TLS 1.3, which also uses AES-256 under the hood.

We use Better Auth for session management. Sessions are token-based and stored server-side. The IP address and user agent associated with each session are retained only for the life of that session and are used exclusively to detect session hijacking — not for tracking or analytics. Sessions expire automatically and can be revoked by signing out.

Subscription payments are processed by Stripe on behalf of GoTime Motorsports. We never see or store your full card number, CVV, or billing address. Stripe handles all payment data under their own PCI DSS compliance program. You will see "GoTime Motorsports" on your card statement.

We share data with two categories of recipients: service providers required to operate SupercarIQ, and affiliated companies within the GoTime family of brands.

Service providers (data processor relationships):

• Vercel — hosting and edge infrastructure
• Neon — PostgreSQL database (AES-256 encrypted at rest)
• Stripe — payment processing (billed as GoTime Motorsports)
• Resend — transactional email (report delivery only)
• Specialist Builder Partners — see "Affiliate Partner Program" section below

None of these providers may use your data for their own marketing beyond the scope described in this policy.

Affiliated companies (constructive sharing — opt-out available):

• GoTime Motorsports (gotimemotorsports.com) — SupercarIQ is a GoTime Motorsports company. Your name, email, and vehicle interest data may be shared with GoTime Motorsports for motorsport experiences, events, inventory, and product outreach relevant to your interests. GoTime Motorsports will never resell your data and must comply with this privacy policy.
• Paddock20 (paddock20.com) — a GoTime Motorsports software studio. Data shared with Paddock20 is used solely for product development insights, aggregate usage analysis, and outreach about SupercarIQ-adjacent software products. No advertising profiles are built.

Affiliate sharing is constructive by design — it is used to deliver relevant motorsport experiences and technology, not to enable advertising targeting or data brokering. You may opt out at any time in Settings → Privacy.

We do not sell, rent, or trade personal information to data brokers, advertising networks, or any party outside the GoTime family of brands.

SupercarIQ maintains relationships with Specialist Builder partners — including but not limited to aftermarket tuning houses, custom fabrication shops, and performance specialists featured in the Builders section of our platform.

When you interact with a Specialist Builder through SupercarIQ — including clicking a social media link, visiting a builder's website, requesting an appointment, or using an affiliate referral code via our platform — we record that interaction. The data recorded includes:

• Your name and email address (if you are signed in)
• The date and time of the interaction
• Which builder profile you interacted with
• The type of link clicked (social, website, appointment, affiliate code)

This information may be shared with the relevant Specialist Builder partner for the following purposes:

• Verifying referral volume and establishing affiliate partnership agreements
• Enabling the builder to follow up with you regarding a build inquiry or appointment you initiated
• Demonstrating SupercarIQ's reach to potential and existing partner builders

By using the Connect with Builder features on any Specialist Builder profile, you consent to this data being shared with that builder partner. If you do not wish your information to be shared, do not use the Connect features while signed in — anonymous interactions (signed-out users) are recorded without personally identifiable information.

Builder partners who receive this data are required to use it only to respond to your inquiry or to confirm referral relationships with SupercarIQ. They may not use it for unrelated marketing without your separate consent.

Account data is retained as long as your account exists. Vehicle search history is retained to power your Garage. You may request complete deletion of your account and all associated data at any time by contacting us at support@supercariq.com. We will process deletion requests within 30 days. Stripe billing records may be retained as required by financial regulations.

You have the right to:

• Know exactly what data we hold about you (request a copy)
• Correct inaccurate account information
• Delete your account and all associated data
• Export your Garage search history in a portable format
• Opt out of transactional emails (except billing)

Contact us at support@supercariq.com to exercise any of these rights.

SupercarIQ is not directed at users under 13. We do not knowingly collect data from children. If you believe a child has created an account, contact us immediately and we will delete it.

If you are a California resident, the California Consumer Privacy Act (CCPA) gives you the right to opt out of the “sale” or “sharing” of your personal information.

SupercarIQ does not sell your personal information to data brokers or advertising networks, and does not share it for cross-context behavioral advertising.

We do, however, share your name, email, and vehicle interest data with our affiliated companies — GoTime Motorsports and Paddock20— for constructive, relevant outreach as described in the “Data Sharing” section above. Under CCPA's broad definition of “sharing,” this qualifies as sharing personal information with a third party. California residents may opt out of this at any time.

California residents also have these rights under the CCPA:

• Right to Know — request the categories and specific pieces of personal information we hold about you.
• Right to Delete — request deletion of your personal information, subject to certain exceptions.
• Right to Correct — request correction of inaccurate personal information.
• Right to Non-Discrimination — exercising any of these rights will never affect your access to SupercarIQ features.
• Right to Opt Out of Sharing — use the Settings toggle above, or email us and we will process it manually.

To submit any CCPA request, contact privacy@supercariq.com. We will respond within 45 days as required by law.

We will post any material changes to this policy on this page with an updated effective date. If changes are significant, we will notify you by email. Continued use of the service after the effective date constitutes acceptance of the updated policy.