Privacy Policy | CarsData

In short

We never see or store your card number - Stripe handles payment.
We collect your name, email and order details so we can deliver the dataset and send receipts.
We use two small cookies - one to keep you signed in, one to remember how you first found us.
You can turn off release emails at any time in your account.
We do not sell your personal information or share it for advertising.

This policy explains how XTO Pty Ltd (ACN 702 801 410), trading as CarsData ("we", "us"), handles personal information. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. What we collect

Your account

Your name and email address.
Your company or organisation name, if you give it.
Your password, stored only as a one-way cryptographic hash. We cannot see your password.
Your email preferences, such as whether you want release emails.

Your orders

Payments are processed by Stripe through Stripe Checkout. You enter your card details directly with Stripe - we never see, receive or store your full card number or security code. From Stripe we receive:

your name and email address;
your billing address;
your ABN or other tax ID, if you give one;
order details - what you bought, the amount, the date, and the payment status;
limited payment details Stripe shares with merchants, such as the card brand and last four digits.

Downloads and website use

A log of your downloads - which file, when, and the IP address it was downloaded from.
Standard server logs, including IP addresses, browser type, pages requested and the date and time.

Support

If you email us, we keep your message, your email address and anything you include, along with our reply.

Cookies and browser storage

Name	Type	Purpose
`User`	Cookie	Keeps you signed in to your account. Needed for the site to work.
`src`	Cookie	Records how you first arrived at the site (for example the referring website or campaign link) so we can tell which channels people find us through. It is set on your first visit and not overwritten afterwards.
`vid`	Cookie	A random identifier that counts how many vehicle model pages you have opened in the free preview (10 models), so the preview limit works. Together with your IP address it is stored against the models you viewed for up to 13 months. Owners of the dataset are never limited.
Theme	localStorage	Remembers whether you chose the light or dark theme. Stays in your browser and is not sent to us.

Analytics. If we enable Google Analytics, it sets its own cookies and collects information about how you use the site, such as pages viewed, device type and approximate location. Google processes that information under its own terms. You can block analytics cookies in your browser or use Google's opt-out browser add-on, and the site will still work.

2. How we collect it

We collect personal information directly from you when you create an account, buy, download, change your settings or contact us; from Stripe when you pay; and automatically from your browser when you use the site. If you do not give us your name and email address, we cannot sell you the dataset or deliver it.

3. How we use it

To deliver the product - creating your account, confirming your purchase and giving you access to downloads.
Receipts and account emails - order receipts, password resets and important notices about your licence or account.
Release emails - telling you when a new release is available. You can switch these off at any time in your account or with the link in each email.
Support - answering your questions and fixing problems.
Fraud prevention and security - detecting fraudulent payments, account sharing and abuse of downloads, and protecting the site.
Legal and tax records - keeping the records we must keep by law, and enforcing our terms and data licence.
Improving the site - understanding, in aggregate, how people find and use the site.

We do not sell personal information, and we do not use it for third-party advertising.

4. Who we share it with

We share personal information only with service providers that help us run CarsData, and only what they need:

Stripe - our payment processor, which handles card payments, receipts and fraud checks.
Our email provider - to send receipts, account emails and release emails.
Our hosting provider - which stores the website, database and download files.
Google - only if Google Analytics is enabled, as described above.

We may also disclose personal information where required or authorised by law, for example to a court or regulator, or to our professional advisers (such as our accountant) where needed.

5. Overseas disclosure

Some of our service providers store or process information outside Australia. Stripe processes payment information in the United States and other countries where it operates. Our email provider, hosting provider and Google (if analytics is enabled) may also store or process information in the United States or other countries. We choose established providers and take reasonable steps to make sure they handle personal information consistently with the APPs.

6. How long we keep it

Account information - while your account is open. If you ask us to close your account, we delete or de-identify it, except what we must keep for the reasons below.
Order and tax records - for as long as Australian tax and corporations law requires, generally between five and seven years.
Download logs and server logs - generally up to two years, or longer if needed to investigate misuse of the dataset.
Support emails - for as long as they are useful to help you, and generally no longer than your account is open.

7. Security

We take reasonable steps to protect personal information from misuse, loss and unauthorised access. These include encrypted (HTTPS) connections, hashed passwords, restricted access to our systems, and leaving card handling entirely to Stripe. No system is perfectly secure. If we have an eligible data breach that is likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as the law requires.

Please keep your password private and choose one you don't use elsewhere.

8. Access and correction

You can see and update most of your details in your account. You can also ask us for a copy of the personal information we hold about you, or ask us to correct it, by emailing [email protected]. We will respond within 30 days. We may need to confirm your identity first. If we refuse a request, we will tell you why and how to complain.

9. Complaints

If you think we have mishandled your personal information, please email [email protected] with details. We will acknowledge your complaint and aim to resolve it within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or on 1300 363 992.

10. Changes to this policy

We may update this policy from time to time. The current version is always on this page, with the date it was last updated. If we make a significant change, we will let account holders know by email.

11. Contact

XTO Pty Ltd, L1 457 Elizabeth Street, Surry Hills, NSW 2010, Australia.
Email [email protected]