Privacy Policy

1. Scope and Who We Are

This Privacy Policy ("Policy") applies to CarSmarti ("CarSmarti," "we," "us," or "our") and covers information we collect through carsmarti.com, our plan activation and decal registration forms, our customer support and 24/7 recovery concierge channels, and our related products and services (collectively, the "Services").

CarSmarti is a registered business with a mailing address at 2901 Clint Moore Rd. STE 2 #1049, Boca Raton, FL 33496. Our Services are offered to residents of the United States and are not directed to individuals outside the United States.

By using the Services, you agree to the practices described in this Policy. If you do not agree, please do not use the Services. This Policy does not apply to third-party websites, products, or services that we do not control, even when we link to them.

2. Information We Collect

Information you provide to us

• Identifiers and contact details — name, email address, mailing address, and telephone number.
• Vehicle information — year, make, model, color, license plate number, and Vehicle Identification Number (VIN).
• Plan and decal registration details — plan selected, decal or device serial numbers, activation date, and photographs you upload during decal registration.
• Payment information — billing name, billing address, and payment card details submitted to our PCI-compliant payment processor. CarSmarti does not store full payment card numbers on its systems.
• Recovery and support information — police report numbers, law enforcement agency and officer contact details, incident descriptions, and the contents of your communications with our support and recovery teams.

Information collected automatically

• Device and usage data — IP address, browser type and version, operating system, device identifiers, referring URLs, pages viewed, and time spent on the Services.
• Cookies and similar technologies — see Section 6.

Location and telematics information

If your plan includes a GPS recovery device, that device generates vehicle location data. CarSmarti accesses vehicle location data in connection with an active, verified theft-recovery event supported by a valid police report, or where you affirmatively request it, or where we are legally required to do so. We do not use vehicle location data for advertising or marketing.

Information from third parties

• Recovery network and operational partners — including PSCC and license plate recognition (LPR) network partners, which may return sighting or match information relating to a vehicle enrolled under your account.
• Law enforcement — case status and report information in connection with an active recovery.
• Payment processors — transaction authorization results, chargeback and dispute notices.

Sensitive personal information

Certain information we handle — such as precise geolocation from a GPS recovery device and account log-in credentials — may be treated as "sensitive personal information" under California law. We use and disclose this information only to perform the Services you requested, to secure accounts and detect fraud, and for other purposes permitted without a right to limit under Cal. Civ. Code § 1798.121. We do not use sensitive personal information to infer characteristics about you.

3. How We Use Your Information

We use the information described above for the following business purposes:

• Activating, maintaining, servicing, and renewing your protection plan and decal registration.
• Enrolling your vehicle in the National Recovery Network and associated LPR databases.
• Providing 24/7 concierge and theft-recovery support, and coordinating with law enforcement on an active recovery supported by a valid police report.
• Processing payments, issuing receipts, managing renewals, and handling billing disputes and refunds.
• Sending transactional and service communications about your account, plan status, recovery events, and changes to our terms or this Policy.
• Responding to your questions, support tickets, and privacy requests.
• Verifying identity, preventing and investigating fraud, and protecting the security and integrity of the Services.
• Measuring and improving the performance, content, and reliability of the Services, including through aggregated and de-identified analytics.
• Complying with legal obligations, responding to lawful requests, and establishing, exercising, or defending legal claims.

We do not use your personal information for automated decision-making that produces legal or similarly significant effects about you, and we do not profile you for targeted advertising.

4. How We Share Information

We disclose personal information only in the following circumstances:

• Recovery and operational partners. With PSCC, LPR network operators, and fulfillment partners, strictly to enroll your vehicle, produce and ship decals or devices, and deliver recovery services.
• Law enforcement, on an active recovery. When you report your vehicle stolen and provide a valid, active police report, we share the vehicle and contact information necessary to assist the investigating agency.
• Service providers and processors. Vendors that host our infrastructure, process payments, deliver email and transactional SMS, provide customer support tooling, and perform analytics. These vendors are contractually restricted from using your information for their own purposes.
• Legal and safety. Where required by law, subpoena, court order, or regulatory request, or where we believe disclosure is necessary to protect the rights, property, or safety of CarSmarti, our customers, or the public.
• Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to this Policy continuing to govern the transferred information.
• With your direction or consent. Whenever you ask us to share information with a specific party, such as an insurer or a family member on your account.

5. Calls, Text Messages, and Email

This section describes our practices under the federal Telephone Consumer Protection Act (TCPA), 47 U.S.C. § 227 and its implementing rules, the Florida Telephone Solicitation Act (Fla. Stat. § 501.059), and comparable state telemarketing and messaging laws.

Consent

When you provide a telephone number on a CarSmarti form or to a CarSmarti representative, you consent to receive account-related and service-related calls and text messages at that number from CarSmarti and from parties acting on our behalf, including calls and messages delivered using an automatic telephone dialing system or an artificial or prerecorded voice where applicable. Consent to receive calls or text messages is not a condition of purchasing any CarSmarti product or service.

Message frequency, rates, and keywords

• Message frequency varies and depends on your account activity. Recovery-related messaging may be frequent during an active incident.
• Message and data rates may apply. Carriers are not liable for delayed or undelivered messages.
• To stop text messages, reply STOP to any message from CarSmarti. You will receive a single confirmation message and no further texts to that number. Replying HELP returns support contact information.
• To resume messages after opting out, reply START or contact us at support@carsmarti.com.
• Opting out of texts does not cancel your plan and does not stop essential written notices we are required to send.
• Mobile information collected for the purpose of delivering text messages — including your phone number and messaging opt-in status — is not sold, rented, or shared with third parties for their own marketing purposes.

Recovery-critical communications

If you opt out of text messaging, you may not receive time-sensitive alerts during an active theft-recovery event. We strongly recommend keeping transactional messaging enabled while your plan is active.

Email

You may opt out of any non-essential CarSmarti email using the unsubscribe link in the message, or by emailing support@carsmarti.com. We will continue to send transactional email relating to your account, billing, and active recovery matters.

Do Not Call

CarSmarti maintains an internal do-not-call list and honors the National Do Not Call Registry and applicable state do-not-call lists. To be added to our internal do-not-call list, email support@carsmarti.com or call 1-888-992-6659.

Call monitoring and recording

Calls to and from our support and recovery lines may be monitored or recorded for quality assurance, training, and account verification. Where a recording notice is required — including in two-party consent states such as Florida — you will be notified at the start of the call and may ask that the call not be recorded.

6. Cookies and Analytics

We use cookies and similar technologies to keep the Services functioning, remember your preferences, understand how visitors use our pages, and measure the performance of our content. Categories in use include strictly necessary cookies, preference cookies, and analytics cookies.

You can control or delete cookies through your browser settings, and most browsers allow you to refuse cookies entirely. Disabling cookies may affect certain features of the Services.

Global Privacy Control and opt-out preference signals

Because CarSmarti does not sell personal information or share it for cross-context behavioral advertising, there is no advertising opt-out for us to process. We nonetheless recognize and honor opt-out preference signals, including the Global Privacy Control (GPC), where they are transmitted by your browser or device.

Do Not Track

Browser "Do Not Track" signals are not yet supported by a uniform standard. We do not track our visitors across third-party websites over time, and we do not respond differently to Do Not Track signals.

7. Data Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These include TLS/SSL encryption of data in transit, encryption of sensitive data at rest, access controls limiting employee and vendor access to a need-to-know basis, and use of PCI-DSS compliant processors for payment card handling.

No method of transmission over the internet or method of electronic storage is completely secure. While we work to protect your information, we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and any applicable regulators as required by law.

8. Data Retention

We retain personal information for as long as your account is active and for as long as reasonably necessary to provide the Services. After cancellation, we retain information only as needed to satisfy the purposes below, then delete or de-identify it.

9. Your Privacy Rights

Regardless of where you live, you may ask us to:

• Access the personal information we hold about you and obtain a copy of it.
• Correct inaccurate personal information.
• Delete personal information, subject to legal, billing, and active-recovery exceptions.
• Opt out of non-essential email and of text messaging (see Section 5).
• Obtain a portable copy of information you provided to us, in a readily usable format.

How to submit a request

Email support@carsmarti.com with the subject line "Privacy Request," or call 1-888-992-6659, or write to CarSmarti, Attn: Privacy, 2901 Clint Moore Rd. STE 2 #1049, Boca Raton, FL 33496.

Verification

To protect your account, we verify requests before acting on them. We will ask you to confirm information already associated with your account — typically the email address or phone number on file, plus vehicle or plan details. We will not use verification information for any other purpose. If we cannot verify your identity, we will tell you why.

Authorized agents

You may designate an authorized agent to submit a request on your behalf. We will ask the agent for written, signed permission from you (or a valid power of attorney) and may separately ask you to verify your identity and confirm the agent's authority.

Timing and fees

We acknowledge requests within 10 business days and respond substantively within 45 calendar days. Where reasonably necessary, we may extend by an additional 45 days and will tell you before we do. Requests are free unless they are manifestly unfounded or excessive, in which case we will explain the reason and any fee before proceeding.

Appeals

If we decline your request, you may appeal by replying to our decision or emailing support@carsmarti.com with the subject line "Privacy Appeal." We will respond within 45 days (60 days in states that allow the longer period) with our decision and, if the appeal is denied, instructions for contacting your state attorney general.

No discrimination or retaliation

We will not deny you goods or services, charge you a different price, provide a different level of quality, or retaliate against you because you exercised a privacy right.

10. California Privacy Rights (CCPA/CPRA)

This section applies to California residents and is provided under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (Cal. Civ. Code § 1798.100 et seq.). Terms used in this section have the meanings given in that statute.

Categories of personal information collected

In the preceding twelve (12) months, we have collected the following categories of personal information. We collect it from you, from your device, and from the third-party sources listed in Section 2, and we use it for the business purposes listed in Section 3.

Your California rights

• Right to know / access. Request the categories and specific pieces of personal information we collected, the sources, our business purposes, and the categories of third parties to whom we disclosed it.
• Right to delete. Request deletion of personal information we collected from you, subject to the statutory exceptions (for example, completing a transaction, security and fraud prevention, and legal compliance).
• Right to correct. Request correction of inaccurate personal information.
• Right to opt out of sale or sharing. CarSmarti does not sell personal information and does not share it for cross-context behavioral advertising, so there is nothing to opt out of. If that ever changes, we will update this Policy and post a "Do Not Sell or Share My Personal Information" link before the change takes effect.
• Right to limit use of sensitive personal information. We use sensitive personal information only for purposes permitted under Cal. Civ. Code § 1798.121(d) — performing the Services, security, and fraud prevention — so the right to limit does not apply to our use.
• Right to non-discrimination. We will not discriminate against you for exercising any of these rights.
• Right to appeal. See Section 9.

How to exercise your California rights

Email support@carsmarti.com with the subject line "California Privacy Request," or call 1-888-992-6659. You may make a request to know twice in a 12-month period at no charge. We will verify and respond as described in Section 9.

Notice of financial incentive

CarSmarti does not offer financial incentives or price or service differences in exchange for the retention or sale of personal information.

California "Shine the Light"

California Civil Code § 1798.83 permits California residents to request information about disclosure of personal information to third parties for those parties' own direct marketing purposes. CarSmarti does not disclose personal information to third parties for their direct marketing purposes.

Minors under 16

We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age.

11. Other State Privacy Rights

Residents of states with comprehensive consumer privacy laws have rights similar to those described above. As of the date of this Policy, these states include California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. Subject to each state's thresholds and exceptions, you may have the right to confirm whether we process your personal data, access and obtain a portable copy, correct inaccuracies, delete your data, opt out of targeted advertising, the sale of personal data, and certain profiling, and appeal a denial of your request.

How to exercise these rights

Submit requests to support@carsmarti.com with the subject line "State Privacy Request," or call 1-888-992-6659. Verification, timing, and appeal procedures are described in Section 9.

State-specific notes

• Colorado, Connecticut, Delaware, Montana, New Hampshire, New Jersey, Oregon, and Texas — we recognize universal opt-out mechanisms, including the Global Privacy Control, where transmitted by your browser or device.
• Colorado, Connecticut, Maryland, Minnesota, New Jersey, Oregon, and Virginia — you may appeal a denied request as described in Section 9, and you may contact your state attorney general if you are dissatisfied with the outcome.
• Minnesota — you additionally have the right to obtain a list of the specific third parties to which we have disclosed your personal data, and to question the result of any profiling. Contact us to request either.
• Oregon — you may request a list of the specific third parties to which we have disclosed personal data.
• Nevada — Nevada residents may submit a verified request directing us not to sell covered information (NRS 603A.340). We do not sell covered information. Requests may be sent to support@carsmarti.com.
• Texas — as required by the Texas Data Privacy and Security Act: we do not sell sensitive personal data, and we do not sell biometric personal data.
• Florida — Florida residents may exercise the rights described above, and may also refer to Section 5 regarding calls and text messages under the Florida Telephone Solicitation Act.
• Washington and Nevada health data laws — CarSmarti does not collect consumer health data as defined by the Washington My Health My Data Act or Nevada SB 370.

12. Children's Privacy

The Services are intended for adults and are not directed to individuals under the age of 18. We do not knowingly collect personal information from anyone under 18, and we do not knowingly collect personal information from children under 13 as defined by the Children's Online Privacy Protection Act (COPPA).

If you believe a minor has provided us with personal information, contact us at support@carsmarti.com and we will delete it promptly.

13. Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page. If we make material changes — for example, a change in the categories of personal information we collect or how we disclose them — we will provide additional notice by email to the address on your account or by posting a prominent notice on the Services before the change takes effect.

Your continued use of the Services after an update takes effect constitutes acceptance of the revised Policy.

14. Contact Us

Questions about this Policy, our privacy practices, or your rights? Reach our privacy team directly:

For accessibility assistance with this Policy, including an alternative format, contact us at support@carsmarti.com and we will provide it at no charge.