Privacy Policy

Carvix, Inc. ("Carvix," "we," "us," or "our"), a Delaware corporation headquartered in Miami-Dade County, respects the privacy of every person who interacts with our website, mobile experiences, dealership locations, and vehicle-service operations. This Privacy Policy explains how we collect, use, share, and protect the personal information we obtain from and about you when you visit floridafinecars.com, use our mobile applications, contact our sales or support teams, or interact with our vehicles, dealership locations, and delivery services (collectively, the "Services").

A. Introduction & scope

This Privacy Policy applies to personal information we collect through the Services. It describes our practices under the Federal Trade Commission Act, the Florida Information Protection Act (FIPA), and the state consumer privacy laws in effect where you live — including the California Consumer Privacy Act (CCPA) as amended by the CPRA, the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), the Utah Consumer Privacy Act (UCPA), the Texas Data Privacy and Security Act (TDPSA), the Florida Digital Bill of Rights (FDBR), and the newer statutes in Minnesota, Montana, and Oregon.

This Privacy Policy does not apply to:

• Financial information collected in connection with a credit application, financing, or subscription payment plan. That information is subject to the federal Gramm-Leach-Bliley Act (GLBA), the Fair Credit Reporting Act (FCRA), and the California Financial Information Privacy Act. Please see our Financial Privacy Policy.
• Information from job applicants and candidates. That information is handled under our Candidate Privacy Notice, provided at the time of application.
• Information from our employees, contractors, and agents. Handled under a separate internal employee privacy notice.
• Business-to-business information from our vendors, dealer partners, auction houses, and lender counterparties, handled under our vendor and B2B agreements.

B. Sources of personal information

We collect personal information from several sources:

1. Directly from you

When you create an account, save a vehicle, request an appraisal, complete a trade-in questionnaire, apply for a purchase or subscription, schedule a delivery, take a test drive, or contact our support team — including by web form, phone, email, SMS, or in-person at a dealership.

2. Automatically, when you use the Services

Technical information about how you interact with our website and applications, including IP address, browser type, device identifiers, pages viewed, referring URL, session duration, and the actions you take (searches, filters applied, vehicles saved, comparison lists, payment estimator inputs).

3. From third parties

We receive information about you and the vehicles you interact with from:

• Vehicle-history and specification providers (Auto.dev, NHTSA, EPA, MarketCheck) — VIN decodes, safety ratings, fuel economy, recall records.
• Identity-verification and KYC partners (Persona) — driver's license verification and photo-ID checks when required for purchase or delivery.
• Consumer credit reporting agencies (Equifax, Experian, TransUnion) — only when you affirmatively initiate a credit check as part of a financing application.
• Insurance verification partners (Canopy Connect) — proof of insurance for delivery, at your election.
• Payment processors (Moov) — funds-transfer confirmations tied to your down payment or subscription.
• Transportation and delivery vendors (Central Dispatch, SuperDispatch) — pickup and delivery status.
• Government sources — DMV registration, title, and lien records; law-enforcement flags on vehicles.

4. From public sources

Publicly available records, including government filings, professional directories, and information you post in public forums or reviews.

5. Combined sources

We may combine information from the sources above to give you a coherent experience — for example, joining a saved vehicle with a live safety-ratings feed and a payment estimate personalized to your budget preferences.

C. Categories of personal information we collect

Depending on how you interact with us, we may collect the following categories of personal information:

• Identifiers — name, postal address, email address, phone number, unique device identifier, IP address, account username, driver's license number (for KYC and DMV title work), and Carvix customer ID.
• Customer records — signatures on purchase and delivery documents, bank routing information you provide for down-payment ACH, tax residence county for Florida DR-15N motor-vehicle surtax calculations.
• Protected class and demographic information — date of birth (age verification for purchase and financing), marital status (only when required for co-buyer financing), veteran/military status (only when you elect a military discount program).
• Commercial information — saved vehicles list, comparison list, vehicles you've viewed, applications you've started or completed, purchase and subscription history, trade-in appraisals you've requested.
• Internet or other electronic network activity — browsing history within our Services, search queries, filters applied, timestamps of interactions with the payment estimator, saved language preference (English or Spanish), theme preference (light or dark).
• Geolocation information — approximate location based on IP address; delivery ZIP code you enter for shipping estimates and Florida sales-tax jurisdiction. We do not collect precise GPS location from your device unless you affirmatively enable it for a specific feature.
• Audio, electronic, visual, or similar information — call recordings of conversations with our sales, delivery, and support teams (with prominent notice at the start of each call, per Section G below); chat transcripts between you and our support representatives; security-camera footage at our physical dealership locations; photographs and videos of vehicles you submit during a trade-in inspection.
• Professional or employment information — employer name and income (only when you provide this as part of a credit or subscription application).
• Inferences — payment-affordability estimates, vehicle-preference profiles (body style, price range, features you've filtered on), estimated delivery-lane preferences.
• Sensitive personal information — Social Security Number (only when required for a credit application, then transmitted encrypted to the credit bureau and never stored in plaintext); driver's license number and state (KMS-encrypted at rest); date of birth (KMS-encrypted); precise geolocation (only when you explicitly enable it for a specific feature and never stored beyond the session that requested it).

D. How we use your personal information

We use the categories of personal information above for the following purposes:

• To provide the Services you request — processing purchases, subscriptions, trade-ins, financing applications, deliveries, service appointments, and warranty claims; keeping your account and saved-vehicles list accurate; communicating with you about the status of your transactions.
• To personalize your experience — surfacing vehicles that match your saved filters and payment preferences, remembering your language and theme choices across sessions, and prefilling forms you've partially completed.
• To improve the Services — analyzing anonymized usage patterns to understand which features shoppers use and where they get stuck. When we ship third-party analytics in the future, we will gate them behind your cookie-consent choice on /cookie-preferences.
• For safety, security, and fraud prevention — detecting suspicious login activity, protecting against identity-theft attempts on financing applications, verifying the identity of purchasers to comply with the federal Anti-Money-Laundering and Bank Secrecy Act rules, investigating claims of vehicle misuse.
• For legal and compliance reasons — responding to lawful subpoenas and court orders, reporting to state DMVs, transmitting sales-tax filings to the Florida Department of Revenue, complying with recall notices and federal safety obligations.
• For marketing communications — only where you have opted in. Email marketing requires an explicit opt-in on the account or subscription form; SMS marketing requires prior express written consent captured at the point of phone-number collection (per Section G and our SMS Terms).
• For any other purpose disclosed to you at the point of collection or with your consent.

E. With whom we share your personal information

We may share personal information with the following categories of recipients:

• Service providers under contract — hosting infrastructure (Vercel, AWS), payment processing (Moov), identity verification (Persona), transportation dispatchers (Central Dispatch), insurance verification (Canopy Connect), signature and contract execution (Documenso), transactional email (Postmark), transactional SMS (Twilio). Each provider is under a written contract that limits their use of your information to the services we've engaged them for.
• Government agencies — Florida Department of Highway Safety and Motor Vehicles (title and registration), Florida Department of Revenue (sales-tax remittance), U.S. Department of Transportation (recall coordination), and other authorities as required by law.
• Third parties at your direction — for example, if you elect to share your credit-application results with your bank or a third-party financing partner, or authorize an accessory dealer to contact you about products for your vehicle.
• Corporate transactions — if Carvix is acquired, merged, reorganized, or if all or substantially all of its assets are transferred, we may transfer your personal information to the successor entity subject to this Privacy Policy or a superseding notice with your consent where required by law.
• Legal recipients — courts, law-enforcement agencies, and regulators when we are required to disclose by subpoena, court order, or applicable law; or when we determine, in good faith, that disclosure is necessary to protect our rights, the rights of others, or public safety.

F. Cookies and tracking technologies

We use cookies and similar technologies (browser-storage keys, session identifiers) to make the Services work, remember your preferences, and understand how they're used. The full list of cookies we set — grouped by category and updated whenever we ship a new integration — lives on our Cookie Preferences page. You can review, change, or withdraw your consent to non-essential cookies there at any time.

Global Privacy Control (GPC)

If your browser sends the Global Privacy Control signal, we treat it as a legally valid opt-out of the sale or sharing of your personal information for advertising purposes, per California Attorney General guidance (Op. Cal. AG 2022) and the Colorado / Connecticut universal opt-out mechanisms. You will see a notice on our Cookie Preferences page confirming that we detected the signal.

Do Not Track (DNT)

Because there is no common industry standard for how a website should interpret a browser's DNT signal, we do not respond to DNT at this time. We do honor Global Privacy Control (see above), which is the recognized replacement.

G. Florida two-party consent: chat, calls, and session recording

1. Phone calls with Carvix

When you call Carvix — including sales, delivery coordination, F&I, or support — you will hear an audible notice at the beginning of the call stating "this call may be recorded for quality-assurance and training purposes." By continuing the call after this notice, you consent to the recording. If you do not consent, you may end the call and contact us instead by email, web form, or at a dealership location, none of which are audio-recorded except as necessary to document the transaction.

2. Chat with Carvix support

When you initiate a chat with a Carvix support representative through our website or mobile applications, a notice appears at the top of the chat window stating "this conversation is being recorded and may be reviewed for quality and training purposes." By sending your first message in that chat, you consent to Carvix recording, storing, and reviewing the transcript. You may end the chat at any time; unsent messages are not stored. Chat transcripts are retained for 13 months and then deleted, except where longer retention is required for a specific transaction, dispute, or legal obligation.

3. Third-party chat providers

If Carvix engages a third-party live-chat vendor (for example, to route overflow support), the vendor's role is disclosed in the chat notice above and is limited to processing chat traffic on our behalf under a written service agreement. The vendor may not use your chat content for its own purposes. If you initiate a chat with Carvix's operator-assist AI (a large-language-model assistant), that is a Carvix-operated system and the interaction is subject to the same recording notice and retention window described above.

4. Session-replay tools

We do not currently run any session-replay or user-behavior recording tools (such as FullStory, Hotjar, or Microsoft Clarity) on the Services. If we add one in the future, it will be listed in our Cookie Catalog, gated behind an explicit opt-in on /cookie-preferences before any recording begins, and will exclude keystrokes in form fields containing sensitive information.

5. Security cameras at dealership locations

Our physical dealership locations use video-only (not audio) security cameras in public-facing areas. Signage at each entrance notifies visitors of the recording. Footage is retained for 30 days and deleted unless preserved for a specific investigation.

6. Withdrawing your consent

You may withdraw consent to future recordings by ending the call or chat immediately; by declining to interact with a recorded channel and choosing an unrecorded one (email, web form, in-person visit); or by submitting a privacy-rights request asking us to delete existing recordings tied to your identifiers. Withdrawal does not affect the lawfulness of recording that occurred with your prior consent.

H. Security

We use administrative, technical, and physical safeguards designed to protect your personal information. In transit, all traffic to our Services is encrypted with TLS 1.2 or newer. At rest, sensitive fields — Social Security Number, date of birth, driver's license number, full mailing address, and bank routing details — are encrypted with AWS KMS-managed keys and never stored in plaintext. Access to production systems is restricted to a limited number of personnel via multi-factor authentication and role-based access control. We routinely audit our security posture and require the same standards from our service providers.

Despite these safeguards, no system is impenetrable. If a security incident affects your personal information, we will notify you within the timeframes required by the Florida Information Protection Act (Fla. Stat. § 501.171) and applicable state breach-notification laws.

I. Children's privacy

Our Services are intended for individuals 18 years of age or older who are legally able to enter into a vehicle purchase, financing, or subscription contract. We do not knowingly collect personal information from children under 16. If you believe we have inadvertently collected personal information from a child under 16, please contact us at privacy@carvix.com and we will delete it promptly.

J. Data retention

We retain personal information only for as long as necessary to fulfill the purposes for which we collected it, plus a reasonable period to comply with our legal obligations, resolve disputes, and enforce our agreements. Representative windows:

K. Third-party links

Our Services may link to third-party websites, applications, or services that we do not operate — including vehicle-history reports, insurance carriers, warranty administrators, or credit bureaus. We are not responsible for the privacy practices of those third parties. When you click a third-party link, that party's own privacy policy will apply. We encourage you to read it.

L. Your state privacy rights

Depending on where you live, you may have specific rights under your state's consumer privacy law. The categories of rights are broadly consistent across CCPA/CPRA (California), VCDPA (Virginia), CPA (Colorado), CTDPA (Connecticut), UCPA (Utah), TDPSA (Texas), FDBR (Florida), and the newer laws in Minnesota, Montana, and Oregon:

• Right to know / access — request confirmation of whether we process your personal information, and a copy of what we hold.
• Right to correct — request that we correct inaccurate personal information.
• Right to delete — request deletion of personal information we hold about you, subject to legal retention exceptions (e.g., closed vehicle-title records we are required to keep).
• Right to opt out of sale or sharing — instruct us not to sell or share your personal information for cross-context behavioral advertising.
• Right to limit use of sensitive personal information — restrict how we use categories such as Social Security Number, driver's license, or precise geolocation.
• Right to opt out of profiling — instruct us not to use your personal information for automated decisions that produce legal or similarly significant effects.
• Right to non-discrimination — exercise these rights without being denied services, charged a different price, or offered a lesser quality of service.
• Right to appeal — if we deny a request, you may appeal (Colorado, Connecticut, Virginia, Montana, and Oregon residents have a statutory right of appeal). To appeal, email privacy@carvix.com with the subject line "Privacy Request Appeal" and your original request reference ID.

Authorized agents

You may designate an authorized agent (including a legal representative) to submit a rights request on your behalf. We may verify the authorization by requesting a signed permission from you, or by verifying the agent's power of attorney.

Financial information

Personal information collected in connection with credit applications or financing is governed by our Financial Privacy Policy under GLBA and, for California residents, the California Financial Information Privacy Act. Rights and opt-outs under those laws are described in that separate notice.

M. Category disclosure table

The table below summarizes, in the format required by CCPA § 1798.130, the categories of personal information we have collected in the preceding 12 months and the categories of third parties with whom we have disclosed each category for a business purpose. We do not sell personal information for money.

N. Contact us & managing your choices

• Cookie preferences — change your cookie choices anytime on our Cookie Preferences page.
• Do Not Sell or Share My Personal Information — file a formal opt-out via the Do Not Sell request form.
• Unsubscribe from marketing email — click the "Unsubscribe" link at the bottom of any marketing email, or update your preferences in your account settings.
• Stop marketing SMS — reply STOP to any marketing SMS you receive from us. Reply HELP for help. See our SMS Terms.
• Delete your account — request account deletion via the Privacy Rights Request form.

O. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our vendors, or the law. When we do, we will bump the "Last updated" date at the top of this page. For material changes — for example, a new category of personal information collected or a new category of recipient — we will provide additional notice, which may include a banner on the site or an email to signed-in customers, and (where required by law) will seek your affirmative consent before applying the change to previously-collected information.