Privacy Policy

Carified is run by Carified (“Carified”, “we”, “us”, or “our”), a sole trader. We are committed to protecting your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and we follow this policy in full.

This policy applies to all personal information collected through our website and related services (collectively, the “Platform”).

We collect information you provide directly, information generated through your use of the Platform, and in some cases, information from third parties.

Information you provide

• Name, email address, and password when you create an account (or your Google account details if you sign in with Google).
• Profile information such as your username, avatar, and bio.
• Your area (postcode and suburb) and default search radius, if you set them, which we use to show distances and search near you.
• Vehicle listing details including photos, videos, descriptions, documents, declared defects and modifications, service history, registration details, and the vehicle's location (suburb, state, and postcode).
• Records you keep about a car in your Garage, such as odometer readings (and any dash photos), service work, repair estimates, costs and notes, parts and fluids, photos and documents, and reminder dates (including registration and insurance renewal dates). These stay private to you until you list the car. Once it's listed, Carified Plus members can see them on the listing, except your notes, costs, insurance renewal date, defects you've marked fixed, and photos and documents you haven't put on the listing, which are never shown.
• Offers you make or receive, viewings you arrange (including the meeting spot a seller sets), and the details of a sale when you mark a car as sold (the sale date, the buyer, an optional sale price that only you see, handover checklist ticks, and the sale receipt).
• Billing details when you pay for a listing, Carified Plus, or a dealer subscription, including your billing address, and whether you have Plus, a Plus trial, or Founding Member months. Card details are handled by our payment provider, Stripe; we only ever see your card's brand and last four digits.
• Identity verification documents (a photo of a government-issued ID such as a driver's licence or passport, and a selfie) when completing seller verification.
• For dealers, your ABN, dealer licence number, and a copy of your dealer licence when applying for dealer verification.
• Messages you send to other users through our in-platform messaging system.
• Reviews you submit about a seller after confirming a purchase, and replies sellers post.
• Reports you make about another user, and the reason you give.
• Communications you send to us via Support, email, feedback submissions, or in-app surveys.

Information about prospective customers

If you are not yet a registered user, our sales and support team may record your name, phone number, and email address after speaking with you directly — for example, if you contact us, or we reach out to you as a potential seller on the Platform. This information is recorded internally to follow up on the enquiry; it is not collected through a public form.

If our staff list a car on your behalf, we record the contact details you give us (your name, phone number, and email address) so buyers can reach you and so we can send you a link to claim the listing.

If you sign up through a referral link shared by a member of our team, we record that referral against your new account so it can be credited to them.

Information we collect automatically

• Log data including your IP address, browser type, pages visited, and timestamps.
• Your approximate location (city, region, and country), looked up from your IP address and shown in your list of active sessions.
• If you choose “Use My Location”, your browser's position, which we use once to look up your postcode. We keep the postcode and drop the coordinates.
• Device information such as operating system and screen resolution.
• Usage data such as search queries, listing views, saved listings, and saved searches. Listing views are counted once per visitor per day; for signed-out visitors we use an identifier that changes every week.
• Product analytics: the actions you take in your dashboard, Garage and listings (such as publishing a listing, logging a service or making an offer), whether something you tried didn't work, summary details about your account (your plan, and counts such as how many cars and listings you have), and which emails we've sent you and whether you unsubscribed. We record that an action happened, not what you wrote: never your messages, notes, sale prices or card details.
• Cookies and similar tracking technologies (see the Cookies section below).

We use your personal information to:

• Create and manage your account and authenticate your identity.
• Run your Garage, including its reminders, and publish and display vehicle listings.
• Conduct seller identity verification and dealer verification to maintain marketplace trust.
• Process payments for listing fees, Carified Plus, and dealer subscriptions.
• Facilitate communication, offers, viewings, and sales between buyers and sellers.
• Send notifications and transactional emails such as email verification, password resets, and updates about your listings, messages and Garage (each of which you can turn off in Settings → Notifications, except essential account and security emails).
• Send marketing communications about new features, promotions, and platform updates, via our email marketing platform, Brevo. The marketing email option is ticked by default when you sign up — untick it before creating your account if you don't want these emails.
• Follow up with prospective sellers and customers using the contact details our sales and support team has recorded.
• Improve the Platform through analytics, surveys, and user feedback.
• Detect, investigate, and prevent fraudulent or prohibited activity, including reviewing reports and keeping records of the action we take.
• Comply with our legal obligations.

Every marketing and notification email we send includes an unsubscribe link that works without signing in. You can also change which emails you get at any time in Settings → Notifications.

We will not use your personal information for purposes unrelated to those listed above without your consent, unless required by law.

We do not sell your personal information. We may share it with third parties only in the following circumstances:

• Service providers: Trusted vendors who help us operate the Platform, listed with their locations under Overseas Disclosure below, plus the Australian Business Register (ABN checks). These providers process your data only to provide their services to us.
• Other users: Your public profile and listing information (display name, listing content, and your listing's suburb, state, and postcode, shown on a map) is visible to other users of the Platform as intended. A dealer's ABN is shown on its public profile.
• People you message: They see your display name, your messages, offers, and viewing requests, when you're typing, and whether you've read their messages. A viewing's meeting spot is shown to the buyer once the viewing is confirmed.
• Reviews: If you leave a review of a seller, your display name and the review content are shown publicly on that seller's profile to anyone who views it, not only the seller.
• A buyer of your car: When a buyer confirms they bought your car, the records and documents buyers could see on its listing (such as service history, open defects, modifications, parts & fluids, and odometer readings, but never your notes, costs, or registration papers) are copied into their Garage.
• Sellers listed on their behalf: If our staff list your car for you, your phone number and email address are shown, with your agreement, to signed-in buyers who ask for them.
• Reports: If you report another user, our staff review the report. Staff can read the conversation you reported only if you chose to share it, and only up to the time you reported it. The person you report is never told who reported them.
• Legal requirements: We may disclose information where required by law, court order, or to protect the safety of users or the public.
• Business transfers: If the business is sold or transferred, your information may be transferred to the new owner, subject to the same privacy protections.

Some of the service providers we use store or process personal information outside Australia. These are the providers that receive personal information, what they do for us, and where they are:

• Supabase — Database and file storage (your account, listings, Garage, messages, photos and documents). Sydney, Australia.
• Vercel — Website hosting, which handles every request you make to Carified. United States, with a global network of edge servers.
• Stripe — Payments and saved cards. United States.
• PostHog — Analytics, error monitoring, in-app surveys, and Support conversations. United States.
• Brevo — Account, notification, and marketing email. France (European Union).
• Google — Optional Sign in with Google, and Google Fonts, which our emails and the card payment form load (Google receives your IP address when they do). United States.
• ipapi.co — Looking up an approximate location from your IP address for your active sessions list. United States.
• OpenFreeMap (Hyperknot Software) — Map tiles on listing pages. Hungary, served through Cloudflare's global network.
• Photon (komoot) — Street address search. Germany.
• Nominatim (OpenStreetMap Foundation) — Turning postcodes, suburbs, and listing locations into map positions, and positions back into postcodes. United Kingdom.

Before we disclose personal information to an overseas provider, we take reasonable steps to make sure it handles that information consistently with the Australian Privacy Principles. We use established providers, only send them what they need to do their job, and rely on their contracts and data processing terms, which require them to protect the information and use it only to provide their services to us.

Sellers on Carified may voluntarily complete identity verification to receive a verified badge. This process involves submitting a photo of a government-issued ID document and a selfie directly to us.

Verification is reviewed manually by our team. Submitted documents are only ever accessible to authorised staff, via time-limited links, and are deleted from our storage once the review is decided. Copies in our hosting provider's backups expire on their normal cycle, normally within 30 days. We retain only the verification outcome (approved/rejected, the date, and — if rejected — the reason given) — not the documents themselves.

Dealer licence documents submitted for dealer verification are handled the same way. Your ABN and licence number are kept on your dealer profile.

We retain your personal information for as long as your account is active or as needed to provide our services.

When you close your account

Straight away:

• Your name, email address, photo, bio, username, and billing details are removed, and your customer record with Stripe and your contact with Brevo are deleted.
• You are signed out everywhere, and your sign-in methods, two-factor authentication, saved listings, saved searches, notifications, your area and location preferences, your profile photo, and your analytics profile are deleted.
• Your live listings end.
• Pending offers you made or received are withdrawn, and upcoming viewings are cancelled.
• Draft dealership applications and their licence documents are deleted.

Your Garage:

• Cars that were never listed are deleted, with their records, photos, and documents.
• For a car that has a listing, the car is hidden and its private details (insurance renewal date, reminders, and photos and documents that were never put on the listing) are deleted. Notes, costs, and parts & fluids are deleted too, unless a live or sold listing still shows them to buyers as part of the car's records. What the listing shows, including its odometer readings, stays with that listing record.

Kept, without your name:

• Past listings and the sale records tied to them, since the other party to a sale may rely on them.
• Messages you sent, shown to the other person as from a deleted user.
• Reviews you wrote, shown as from a deleted user.
• Payment records, including Plus purchases, which tax law requires us to keep for up to 7 years.
• Moderation, report, and verification-decision records, for safety and to deal with disputes and legal claims.

Copies of deleted information in our hosting provider's backups expire on their normal cycle. We may also keep information for longer where the law requires it, where it's needed to resolve a dispute or enforce our agreements, or where it has been anonymised so it no longer identifies you.

Even while your account is open, we keep records of moderation actions and reports, and the outcome of identity and dealer verification reviews, for the same reasons.

We implement industry-standard security measures to protect your information, including encryption in transit (TLS), encryption at rest provided by our hosting and database providers, hashed passwords, optional two-factor authentication, and access controls limiting who can view personal data internally.

Our support and sales staff can access your account email address and, if you have contacted us or been recorded as a prospective customer, your phone number, in order to respond to enquiries, manage your account, and follow up on leads.

No method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. If you become aware of any security vulnerability on the Platform, please report it via the Support page.

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate, outdated, or incomplete.
• Delete your account and associated personal information, subject to the retention described above.
• Opt out of marketing emails at any time, from Settings → Notifications or using the unsubscribe link included in every marketing email we send.
• Complain to us, and then to the Office of the Australian Information Commissioner (OAIC) if you're not happy with our response.

To exercise any of these rights, contact us via the Support page. We will respond within 30 days.

We use cookies and similar technologies to maintain your session, remember your preferences, and understand how users interact with the Platform. We use:

• Essential cookies: Required for the Platform to function, including your sign-in session (which lasts up to 7 days between visits) and security tokens.
• Preference storage: Cookies and browser storage that remember choices such as your theme, sidebar state, listing view, and browser notification settings.
• Payment cookies: When you enter payment details, Stripe sets its own cookies to process the payment securely and prevent fraud.
• Analytics cookies: We use PostHog to understand traffic patterns and improve the Platform, such as page views, searches, filters used, and the product analytics described above. If you are signed in, this activity is linked to your account (e.g. your name and email) rather than being anonymous; if you are signed out, it is associated with an anonymous device identifier only. Some of it, such as payments and the emails we send, is recorded by our servers rather than through a cookie, and is linked to your account in the same way.
• Referral cookies: If you arrive via a referral link, we set a first-party cookie for up to 30 days to remember and credit that referral if you sign up.

You can control cookies through your browser settings, though disabling essential cookies will affect Platform functionality.

We may change this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. For a material change, we will also post a notice on your Carified dashboard on the day it takes effect.

For privacy-related enquiries, access or correction requests, or complaints, contact our Privacy Officer via the Support page. If you are not satisfied with our response, you may complain to the OAIC at oaic.gov.au.