Privacy Policy

Carvest helps people decide whether to keep the car they own or buy a different one. This policy explains what information Carvest processes, why, and who it is shared with. Carvest is currently offered in the United States.

Carvest does not require an account. You are not asked for your name, address, or payment details to run a comparison.

Vehicle information

To run a comparison you may enter details such as year, make, model, trim, mileage, expected miles driven, a VIN, and a ZIP code or city. This information is used to identify the vehicles, look up specifications, efficiency ratings, market values, local energy prices, and applicable state taxes and fees.

Comparison inputs live in your browser for the session. Carvest does not maintain a user profile of your vehicles.

Financial comparison information

You may enter figures such as loan payoff, monthly payment, payments remaining, purchase price, APR, term, and insurance cost. These are used only to produce your comparison and the explanations shown alongside it. They are not sold, and they are not sent to advertising networks.

Analytics

Carvest measures product usage so it can be improved. Analytics events are behavioural: which page or step was reached, which tab or control was used, and a coarse outcome label such as the recommendation type. Before an event is sent, its properties are filtered by a deny-list.

The following are excluded from analytics events:

• VIN, license plate, ZIP or postal code, address, or city
• Exact vehicle price, loan payoff, payment, trade value, APR, or insurance cost
• Exact financial results or the full comparison snapshot
• Ask Carvest questions or answers
• Email addresses, phone numbers, and names

Google Tag Manager and Google Analytics

Carvest loads Google Tag Manager in the browser, and Google Analytics 4 is configured inside that container. Google Analytics measures website traffic and usage — for example page views, referring source, approximate location derived from IP address, device and browser type, and the coarse product events described above. Google Analytics does not receive your Carvest financial snapshot, VIN, or Ask Carvest text.

Google acts as Carvest's analytics provider and processes this data under its own terms. Google Analytics uses cookies or similar browser storage. You can block or delete these through your browser, or by using Google's opt-out browser add-on.

PostHog and session replay

Carvest uses PostHog to understand product usage. PostHog receives the same coarse product events described above, plus standard web context such as page URL, referrer, device and browser information, and an IP-derived approximate location. PostHog may also record a replay of the page — the layout and the interactions — so usability problems can be diagnosed.

Session replay is configured so that sensitive content is not readable. All form inputs are masked, which covers VIN, ZIP, mileage, price, payoff, payment, APR, and insurance fields. The Ask Carvest transcript and message composer are also masked. Carvest does not record the contents of these fields in replays.

Ask Carvest and OpenAI

Ask Carvest answers questions about your comparison. When you send a question, Carvest transmits your question, the recent conversation, and a structured summary of the comparison needed to answer it to the OpenAI API from Carvest's server.

Carvest sends these requests with store: false. OpenAI states that data submitted through its API is not used to train its models by default unless the customer opts in; Carvest has not opted in. OpenAI may still retain data for a limited period for abuse monitoring and legal compliance under its applicable API policies. Carvest does not control OpenAI's retention practices.

Please do not include personal details you would not want transmitted in an Ask Carvest message.

Third-party vehicle and data providers

To produce a comparison, Carvest queries the following providers. Requests contain vehicle attributes (and, where relevant, a ZIP code, city, or state) — never your financial inputs, and never a name or contact detail.

• NHTSA vPIC — VIN decoding. Called from the browser with the VIN you enter.
• FuelEconomy.gov (EPA/DOE) — official fuel economy and EV efficiency ratings, and the vehicle catalog used for autocomplete. Called with year, make, model, and trim.
• U.S. Energy Information Administration (EIA) — regional fuel and electricity prices. Called from Carvest's server with a region, not a precise location.
• MarketCheck — vehicle market values and nearby listings. Called from Carvest's server with vehicle attributes and a search area derived from the ZIP or city you provide.
• Vehicle Finder — maintenance schedules, service costs, and reliability data. Called from Carvest's server with vehicle attributes and a coarse region.
• OpenAI — Ask Carvest, as described above.

These providers process the data they receive under their own privacy terms.

Why information is processed

• To produce the comparison and explanations you asked for
• To answer Ask Carvest questions
• To measure product usage and improve the product
• To protect the service against abuse, including rate limiting
• To meet legal obligations

Carvest does not sell your information, and does not use it for personalized advertising or remarketing.

Retention

Comparison inputs are held in your browser for the session and are not stored in a Carvest user database. Analytics data is retained by Google Analytics and PostHog according to their configured retention settings. Abuse-protection records for Ask Carvest hold a short-lived, hashed request fingerprint rather than a raw IP address, and expire automatically. Retention by third-party providers is governed by their own policies.

Your choices

• You can use Carvest without entering a VIN or an exact ZIP code.
• You can skip Ask Carvest entirely; nothing is sent to OpenAI unless you ask.
• You can block or clear analytics cookies and browser storage, use your browser's tracking protection or a “Do Not Track” / Global Privacy Control signal, or install Google's Analytics opt-out add-on.

Depending on where you live, you may have rights to access, correct, or delete personal information about you. Because Carvest does not maintain accounts, it usually cannot identify your data from a request alone; where a request can be honored, Carvest will do so.

Security

Carvest is served over HTTPS. Provider API keys are held server-side and are never sent to the browser. Ask Carvest requests are size-limited, validated, and rate limited. No method of transmission or storage is completely secure, and Carvest cannot guarantee absolute security.

Children's privacy

Carvest is not directed to children under 13 and is not intended for their use. Carvest does not knowingly collect personal information from children under 13.

Changes to this policy

This policy may be updated as Carvest changes. Material changes will be reflected here with a new “last updated” date. If Carvest later introduces advertising, remarketing, insurance lead routing, or service outside the United States, this policy and the available privacy choices will be revised before those changes take effect.

Contact

Privacy questions can be sent to support@carvest.co.