Privacy Policy

This policy is issued by Carified (ABN 57 876 988 566) (“Carified”, “we”, “us”, or “our”), a sole trader. We are committed to protecting your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and we follow this policy in full.

This policy applies to all personal information collected through our website and related services (collectively, the “Platform”).

We collect information you provide directly, information generated through your use of the Platform, and in some cases, information from third parties.

Information you provide

• Name, email address, and password when you create an account (or your Google account details if you sign in with Google).
• Profile information such as your username, avatar, and bio.
• Your area (postcode and suburb) and default search radius, if you set them, which we use to show distances and search near you.
• Vehicle listing details including photos, videos, descriptions, documents, declared defects and modifications, service history, registration details, and the vehicle’s location (suburb, state, and postcode).
• Records you keep about a car in your Garage, such as odometer readings (and any dash photos), service work, repair estimates, costs and notes, parts and fluids, photos and documents, and reminder dates (including registration and insurance renewal dates). These stay private to you until you list the car. Once it’s listed, Carified Plus members can see them on the listing, including your notes and costs, except your insurance renewal date, defects you’ve marked fixed, and photos and documents you haven’t put on the listing, which are never shown.
• For each odometer reading, who entered it and how (in the app, from a dealership’s stock feed or Stock API, or a CSV import). On a dealership’s car, this is shown to the dealership’s team and to our staff, never to buyers.
• Offers you make or receive, viewings you arrange (including the meeting spot a seller sets), and the details of a sale when you mark a car as sold (the sale date, the buyer, an optional sale price that only you see, handover checklist ticks, and the sale receipt).
• Billing details when you pay for a listing, Carified Plus, or a dealership’s plan, including your billing address, and whether you have Plus, a Plus trial, or Founding Member months. Card details are handled by our payment provider, Stripe; we only ever see your card’s brand and last four digits.
• Identity verification documents (a photo of a government-issued ID such as a driver’s licence or passport, and a selfie) when completing seller verification.
• For dealers, your ABN, dealer licence number, the name on the licence and its expiry date, and a copy of your dealer licence when applying for dealer verification, the dealership’s enquiries email address if you add one, and the sales phone number it shows on its listings (which may be someone’s personal mobile).
• If you work in a dealership on Carified: your role, the cars and enquiries assigned to you, notes you write about enquiries, and what you do there, which the dealership’s figures for each person come from (cars sold, open enquiries, how quickly you reply, and when you were last active). If you invite someone to a dealership’s team, we record their email address and role with the invitation. If a dealership is handed to a new owner, we record who offered it, who accepted it and when.
• Messages you send to other users through our in-platform messaging system.
• Reviews you submit about a seller after confirming a purchase, and replies sellers post.
• Reports you make about another user, and the reason you give.
• That you ticked the buyer safety checklist before contacting a seller, and which version of it, which we keep as a record if a sale is later disputed.
• Communications you send to us via Support, email, feedback submissions, or in-app surveys.

Information about prospective customers

If you are not yet a registered user, our sales and support team may record your name, phone numbers, email address, business website and social media profiles, and links to cars you have listed on other websites — for example, if you contact us, or we reach out to you as a potential seller or dealership. We find some of this in what you have published yourself, such as a public ad on another marketplace or your business’s website. Our team also keeps notes of what you told us, the next step, a record of each call, email or meeting, and our own rating of how likely you are to join (for a dealership, roughly how much stock you hold and whether you rely on other marketplaces). This is recorded internally to follow up with you, and we may email you a link to our Sell My Car form. Each of those emails has a link to stop us contacting you.

If you send us a car through the Sell My Car form, we collect your name, email address, phone number (if you give one) and which of them buyers may see, the car’s details, its known faults, modifications and service history, the asking price, its suburb, state and postcode, and the photos and documents you upload. We also keep your declaration and consent, the name you type to sign them, and when you sent each version. We use this to review the car with you and, if you agree, to list it on your behalf. Photos we keep are re-saved without their location data.

If our staff list a car on your behalf, we record the contact details you give us (your name, phone number, and email address), how and when you agreed to the listing, and any note our staff make about that agreement, so buyers can reach you, so we can show we had your consent, and so we can send you a link to claim or take down the listing.

If you sign up through a referral link shared by a member of our team, we record that referral against your new account so it can be credited to them.

Information we collect automatically

• Log data including your IP address, browser type, pages visited, timestamps, and how quickly each page loaded and responded to you.
• Your approximate location (city, region, and country), looked up from your IP address and shown in your list of active sessions.
• If you choose “Use My Location”, your browser’s position, which we use once to look up your postcode. We keep the postcode and drop the coordinates.
• Device information such as operating system and screen resolution.
• Usage data such as search queries, listing views, saved listings, and saved searches. Listing views are counted once per visitor per day; for signed-out visitors we use an identifier that changes every week.
• If you tap Show Number on a dealership’s listing, we record that it happened. Like a listing view, each one is kept with a pseudonymous visitor code: a one-way keyed hash of your account id if you’re signed in, or of your IP address and browser details, salted weekly, if you’re not. We never store the IP address or browser details themselves. The dealership sees only how many times its number was shown, never who asked, and taps by its own team aren’t counted.
• Product analytics: the actions you take in your dashboard, Garage and listings (such as publishing a listing, logging a service or making an offer), whether something you tried didn’t work, summary details about your account (your plan, and counts such as how many cars and listings you have), and which emails we’ve sent you and whether you unsubscribed. We record that an action happened, not what you wrote: never your messages, notes, sale prices or card details.
• Session recordings: a replay of how you moved through some visits (pages, clicks and scrolling), with all text and everything you type hidden, which we use to find and fix problems and to help you when you contact Support.
• Whether an email we send to your account’s address bounces permanently or is marked as spam. If it bounces, we stop emailing that address; if you mark one as spam, we stop everything but essential account and security emails. Ask our Support team to turn email back on.
• Cookies and similar tracking technologies (see the Cookies section below).

We use your personal information to:

• Create and manage your account and authenticate your identity.
• Run your Garage, including its reminders, and publish and display vehicle listings.
• Conduct seller identity verification and dealer verification to maintain marketplace trust.
• Process payments for listing fees, Carified Plus, and dealership plans.
• Run a dealership’s team tools, including showing its owner and managers how each person is doing, and work out how quickly a dealership usually replies, which buyers see as a range.
• Facilitate communication, offers, viewings, and sales between buyers and sellers.
• Send notifications and transactional emails such as email verification, password resets, and updates about your listings, messages and Garage (each of which you can turn off in Settings → Notifications, except essential account and security emails).
• Send marketing communications about new features, promotions, and platform updates, via our email marketing platform, Brevo. The marketing email option is ticked by default when you sign up — untick it before creating your account if you don’t want these emails.
• Follow up with prospective sellers and customers using the contact details our sales and support team has recorded, and list a car on a seller’s behalf when they ask us to.
• Contact you directly about your account, your listings, your dealership, a Support case, or feedback you’ve given us, such as when a survey answer suggests something went wrong.
• Improve the Platform through analytics, surveys, and user feedback. Staff in our admin, support, sales and content roles can see your activity and session recordings, and we log each time one of them opens a recording.
• Detect, investigate, and prevent fraudulent or prohibited activity, including reviewing reports and keeping records of the action we take.
• Comply with our legal obligations.

Every marketing and notification email we send includes an unsubscribe link that works without signing in. Essential emails (about your account’s security, a decision on something you applied for, or action we took on your account or listings) don’t, since you need them. You can also change which emails you get at any time in Settings → Notifications.

We will not use your personal information for purposes unrelated to those listed above without your consent, unless required by law.

We do not sell your personal information. We may share it with third parties only in the following circumstances:

• Service providers: Trusted vendors who help us operate the Platform, listed with their locations under Overseas Disclosure below, plus the Australian Business Register (ABN checks). These providers process your data only to provide their services to us.
• Other users: Your public profile and listing information (display name, listing content, and your listing’s suburb, state, and postcode, shown on a map) is visible to other users of the Platform as intended. A dealership’s ABN and licence are shown on its storefront, and its listings’ sales phone number is shown to buyers who tap Show Number on one of its listings.
• People you message: They see your display name, your messages, offers, and viewing requests, when you’re typing, and whether you’ve read their messages. A viewing’s meeting spot is shown to the buyer once the viewing is confirmed.
• Reviews: If you leave a review of a seller, your display name and the review content are shown publicly on that seller’s profile to anyone who views it, not only the seller.
• A buyer of your car: When a buyer confirms they bought your car, the records and documents buyers could see on its listing (such as service history, open defects, modifications, parts & fluids, and odometer readings, but never your notes, costs, or registration papers) are copied into their Garage.
• A dealership you contact: When you message a dealership, make an offer or book a viewing, the people on its team who can see the enquiry (its owner and managers, and the person it’s assigned to) see your display name, your messages, offers and viewings, and how many cars you keep in your Garage (a count only). They can also write notes about the enquiry that you don’t see. Dealerships agree to use your details only to deal with your enquiry and complete a sale, and not to send you marketing unless you agree to it.
• If you work in a dealership: Buyers see your first name on the messages you send for the dealership, and when you’re looking after their enquiry. Your teammates see your name, its owner and managers see the enquiries you handle and your figures, and its owner also sees your email address.
• A dealership you offer a trade-in to: If you share one of your Garage cars with a dealership as a trade-in, its team sees that car’s details (including its VIN and plate), odometer readings, service history, open defects, modifications and parts & fluids, but never your notes, costs, photos, documents or insurance, until you stop sharing it or the enquiry ends without a sale.
• Sellers listed on their behalf: If our staff list your car for you, your first name and last initial are shown on the listing, and your phone number and email address (or just the one you chose on the Sell My Car form) are shown, with your agreement, to signed-in buyers who ask for them.
• Reports: If you report another user, our staff review the report. Staff can read the conversation you reported only if you chose to share it, and only up to the time you reported it. The person you report is never told who reported them.
• Payment disputes: If you dispute a payment with your bank, we send Stripe (who passes it to your card issuer) evidence of what you paid for and that you received it, such as when your listing was published and how many people viewed it, when Plus was turned on, or that a dealership’s plan was running.
• Legal requirements: We may disclose information where required by law, court order, or to protect the safety of users or the public.
• Business transfers: If the business is sold or transferred, your information may be transferred to the new owner, subject to the same privacy protections.

Some of the service providers we use store or process personal information outside Australia. These are the providers that receive personal information, what they do for us, and where they are:

• Supabase — Database and file storage (your account, listings, Garage, messages, photos and documents). Sydney, Australia.
• Vercel — Website hosting, which handles every request you make to Carified. United States, with a global network of edge servers.
• Stripe — Payments and saved cards. United States.
• PostHog — Analytics, error monitoring, in-app surveys, and Support conversations. United States.
• Brevo — Account, notification, and marketing email. France (European Union).
• Google — Optional Sign in with Google, and Google Fonts, which our emails and the card payment form load (Google receives your IP address when they do). United States.
• ipapi.co — Looking up an approximate location from your IP address for your active sessions list. United States.
• OpenFreeMap (Hyperknot Software) — Map tiles on listing pages. Hungary, served through Cloudflare’s global network.
• Photon (komoot) — Street address search. Germany.
• Nominatim (OpenStreetMap Foundation) — Turning postcodes, suburbs, and listing locations into map positions, and positions back into postcodes. United Kingdom.
• Australian Suburbs (australiansuburbs.au) — Suggesting suburbs as you type one (only the text you type is sent). Australia.

Before we disclose personal information to an overseas provider, we take reasonable steps to make sure it handles that information consistently with the Australian Privacy Principles. We use established providers, only send them what they need to do their job, and rely on their contracts and data processing terms, which require them to protect the information and use it only to provide their services to us.

Sellers on Carified may voluntarily complete identity verification to receive a verified badge. This process involves submitting a photo of a government-issued ID document and a selfie directly to us.

Verification is reviewed manually by our team. Submitted documents are only ever accessible to authorised staff, via time-limited links, and are deleted from our storage once the review is decided. Copies in our hosting provider’s backups expire on their normal cycle, normally within 30 days. We keep only the review’s record — the outcome (approved or rejected), the date, who reviewed it, which checks passed, the reason if it was rejected, and whether it was later revoked — not the documents themselves.

Dealer licence documents submitted for dealer verification are handled the same way. The ABN and licence number are kept on the dealership’s record and shown on its storefront. The name on the licence and its expiry date are kept on the record too, but aren’t shown.

Some things on Carified happen automatically, based on information we hold about you or your car:

• A listing is flagged for our team to check if its VIN belongs to a car we took down before, if it says the car was never written off when an earlier listing of that VIN said it was, or if 3 people report it.
• A car recorded as a statutory write-off can’t be listed.
• If you list 4 or more different cars in 12 months as a private seller, you’re asked to confirm they’re your own cars before you can publish.
• An offer below the minimum a seller has set is declined automatically, and offers expire after 48 hours.
• A dealership enquiry with no activity for 14 days is closed automatically.
• Emails stop going to an account’s address where one bounced permanently, and all but essential ones stop where one was marked as spam.

A flag never suspends an account or takes a listing down on its own: a member of our team reviews it and decides. Suspensions, take-downs, review removals, and identity and dealer verification are always decided by a person. If you think an automated result is wrong, contact us via the Support page or at support@carified.com.au and someone will look at it.

We retain your personal information for as long as your account is active or as needed to provide our services.

When you close your account

Straight away:

• Your name, email address, photo, bio, username, and billing details are removed, and your customer record with Stripe and your contact with Brevo are deleted.
• You are signed out everywhere, and your sign-in methods, two-factor authentication, saved listings, saved searches, notifications, your area and location preferences, your profile photo, your analytics profile with its session recordings, and your Support conversations are deleted.
• Your live listings end.
• Pending offers you made or received are withdrawn, and upcoming viewings are cancelled.
• Draft dealership applications and their licence documents are deleted.
• If you work in a dealership, you leave its team. The cars, enquiries and conversations you handled stay with the dealership.
• If you own a verified dealership, you can close your account once its plan has ended. The dealership’s business record, cars, listings and reviews stay with the business, and the invitations you sent are cancelled.

Your Garage:

• Cars that were never listed are deleted, with their records, photos, and documents.
• For a car that has a listing, the car is hidden and its private details (insurance renewal date, reminders, and photos and documents that were never put on the listing) are deleted. Notes, costs, and parts & fluids are deleted too, unless a live or sold listing still shows them to buyers as part of the car’s records. What the listing shows, including its odometer readings, stays with that listing record.

Kept, without your name:

• Past listings and the sale records tied to them, since the other party to a sale may rely on them. A sale receipt that was already sent keeps the names and address on it, as the other person’s record of the sale; one still being drafted loses yours.
• Messages you sent, shown to the other person as from a deleted user.
• Reviews you wrote, shown as from a deleted user.
• Payment records, including Plus purchases, refunds and disputes, for at least the 5 years tax law requires and for as long as we need them for our accounts.
• Moderation, report, and verification-decision records, notes our staff made about your account, and the buyer safety checklists you ticked, for safety and to deal with disputes and legal claims.
• Records of your Support cases and survey answers (their status and score, not their wording or the conversation itself), and, if our sales team recorded you as a prospective customer before you signed up, that record.

Copies of deleted information in our hosting provider’s backups expire on their normal cycle. We may also keep information for longer where the law requires it, where it’s needed to resolve a dispute or enforce our agreements, or where it has been anonymised so it no longer identifies you.

Even while your account is open, we keep records of moderation actions and reports, the outcome of identity and dealer verification reviews, and dealership ownership hand-overs, for the same reasons.

The pseudonymous visitor codes kept with listing views and Show Number taps are removed after 90 days, whether or not you close your account sooner, and each record then stays only as an anonymous count.

Cars sent through Sell My Car

A form you never confirm by email is removed after 7 days, and an unfinished one after 30 days. The photos and documents of a car we don’t list, or that you withdraw, are deleted 30 days after it closes. We keep the record of what you sent us, including your declaration and consent, as proof of what you agreed to. Sending us a car doesn’t create an account, so to have that record removed, contact us via the Support page or at support@carified.com.au.

We implement industry-standard security measures to protect your information, including encryption in transit (TLS), encryption at rest provided by our hosting and database providers, hashed passwords, optional two-factor authentication, and access controls limiting who can view personal data internally.

Our support and sales staff can access your account email address and, if you have contacted us or been recorded as a prospective customer, your phone number, in order to respond to enquiries, manage your account, and follow up on leads.

No method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. If you become aware of any security vulnerability on the Platform, please report it via the Support page or at support@carified.com.au.

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate, outdated, or incomplete.
• Delete your account and associated personal information, subject to the retention described above.
• Opt out of marketing emails at any time, from Settings → Notifications or using the unsubscribe link included in every marketing email we send.
• Complain to us, and then to the Office of the Australian Information Commissioner (OAIC) if you’re not happy with our response.

To exercise any of these rights, contact us via the Support page or at support@carified.com.au. We will respond within 30 days.

We use cookies and similar technologies to maintain your session, remember your preferences, and understand how users interact with the Platform. We use:

• Essential cookies: Required for the Platform to function, including your sign-in session (which lasts up to 7 days between visits, and never more than 90 days in total), security tokens, and, if you use the Sell My Car form, a cookie that keeps your form on that device for up to 60 days.
• Preference storage: Cookies and browser storage that remember choices such as your theme, sidebar state, listing view, cards you’ve hidden on your dashboard, and browser notification settings.
• Payment cookies: When you enter payment details, Stripe sets its own cookies to process the payment securely and prevent fraud.
• Analytics cookies: We use PostHog to understand traffic patterns and improve the Platform, such as page views, searches, filters used, and the product analytics described above. If you are signed in, this activity is linked to your account (e.g. your name and email) rather than being anonymous; if you are signed out, it is associated with an anonymous device identifier only. Some of it, such as payments and the emails we send, is recorded by our servers rather than through a cookie, and is linked to your account in the same way.
• Referral cookies: If you arrive via a referral link, we set a first-party cookie for up to 30 days to remember and credit that referral if you sign up.

You can control cookies through your browser settings, though disabling essential cookies will affect Platform functionality.

We may change this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. For a material change, we will also post a notice on your Carified dashboard on the day it takes effect.

For privacy-related enquiries, access or correction requests, or complaints, contact our Privacy Officer via the Support page or at support@carified.com.au. If you are not satisfied with our response, you may complain to the OAIC at oaic.gov.au.