Privacy Policy

Last updated: 22 August 2026

Carseekers Pty Ltd ("Carseekers", "we", "us", "our") operates the website carseekers.com.au and the Carseekers platform. We are committed to protecting your personal information and handling it in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy explains what personal information we collect, why we collect it, who we share it with, where it is stored, and what your rights are.

1. Who This Policy Covers

This policy applies to:

Buyers — individuals who submit vehicle requests through our platform
Dealers — automotive dealerships and their staff who subscribe to access buyer leads
Website visitors — anyone who browses carseekers.com.au
Platform users — dealers, consultants, and administrators who use our authenticated platform

2. What Personal Information We Collect

2.1 Buyers

When you submit a vehicle request, we collect:

Identity: First and last name
Contact details: Email address, phone number
Location: State and postcode (we geocode this to a latitude/longitude coordinate to enable geographic dealer matching)
Vehicle preferences: Brand, model, preferred colour, additional options or comments, purchase timeline
Intent signals: Whether you need finance, whether you have a trade-in, whether you have test-driven the vehicle
Trade-in details (if applicable): Vehicle make, model, year, registration number, state of registration, colour, odometer reading, number of keys, service history, accident history, condition assessment (excellent/good/poor), windscreen condition, warning lights, tyre roadworthiness, under-finance status, comments, and photos of the vehicle (up to 9 mandatory angles plus optional damage, tyre, and service-book photos)

2.2 Dealers

When you register as a dealer or staff member, we collect:

Identity: Name, role/title (e.g., Director, Sales Representative)
Contact details: Email address, phone number
Business details: Business name, dealer licence number, business address (street, suburb, state, postcode), geographic location (geocoded from address)
Subscription and payment: Stripe customer ID, Stripe subscription ID, subscription tier, payment dates — actual card details are processed directly by Stripe and are not stored by us
Operational preferences: States covered, vehicle brands handled

2.3 All Users

When you create an account, we also collect:

Password (stored as a one-way BCrypt hash — we never store or have access to your actual password)
Account role and status

2.4 Contact Enquiries

When you use the contact form on our website, we collect:

Name, email address, phone number (optional), and your enquiry message

This information is transmitted to our team via Brevo (our email service provider) and is not stored in our database. It is retained by Brevo in email logs per their retention policies. We use this information solely to respond to your enquiry.

2.5 Automatically Collected Information

When you use our website or platform, we automatically collect:

Usage data: Pages visited, features used, time spent, actions taken
Device and browser information: IP address, browser type and version, operating system, device identifiers
Cookies and tracking data: See Section 9 (Cookies and Tracking) for full details, including which tools are active on public pages and which are active on the authenticated platform
Location: Derived from your postcode; we do not collect GPS location data directly

We do not collect sensitive information such as health, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, or criminal record.

3. How We Use Your Personal Information

| Purpose | Legal basis under APPs | |---|---| | Match your vehicle request with nearby dealers | Necessary to provide the service you requested | | Enable dealers to submit competitive bids | Necessary to provide the service you requested | | Send you confirmations, bid notifications, and platform updates | Necessary to provide the service you requested | | Respond to contact enquiries | Necessary to respond to your request | | Manage dealer subscriptions and process payments via Stripe | Contractual — dealer subscription agreement | | Generate invoices for completed transactions via Xero | Legal obligation (financial record-keeping) | | Detect and prevent fraud, abuse, and security threats | Legitimate interest | | Improve our platform using aggregated analytics | Legitimate interest | | Deliver and measure advertising campaigns | Legitimate interest (where advertising cookies are active — see Section 9) | | Send marketing communications | Consent (you may withdraw at any time) | | Comply with legal obligations | Legal obligation |

4. How We Share Your Personal Information

4.1 Sharing with Dealers — Two-Stage Model

We share buyer information with dealers in a deliberate two-stage approach designed to minimise exposure of personal contact details:

Stage 1 — Request distribution (before a bid is accepted): When your vehicle request is verified, it is automatically distributed to eligible dealers. At this stage, dealers receive:

State and postcode only (not your name, email address, or phone number)
Vehicle preferences (brand, model, colour, options, comments)
Purchase timeline, trade-in status, finance requirement, test-drive status
A bidding deadline

Your name, email address, and phone number are not shared at this stage.

Stage 2 — After you accept a dealer's bid: Once you accept a bid, the winning dealer receives your full contact details (name, email, phone) so they can contact you to finalise the purchase.

Lead pathway: In some cases we may operate a direct lead model where your contact details are shared with a dealer you are connected with for a procurement fee. Where this applies, it is disclosed at the time of your request submission.

By submitting a vehicle request, you consent to your information being shared with dealers in accordance with the two-stage model above.

To opt out of dealer sharing: Contact us at contact@carseekers.com.au before your request is distributed. Once a request has been distributed and a bid accepted, sharing with the winning dealer cannot be reversed.

4.2 Service Providers

We share personal information with the following third-party service providers to operate our platform:

| Provider | Location | Purpose | Information shared | |---|---|---|---| | Brevo (Sendinblue) | France (EU) | Transactional email delivery | Buyer: name, email, phone (confirmation and admin notification emails). Dealer: name, email (distribution and notification emails). Client location (state + postcode) shared in dealer distribution emails. Contact form: name, email, phone, enquiry message. | | Stripe | United States | Dealer subscription payments | Dealer name, email, Stripe customer/subscription IDs, payment amounts and dates | | Xero | New Zealand / United States | Accounting and invoice generation | Dealer contact details and transaction amounts for completed deals | | Google Cloud Storage | Australia (GCP project: carseekers-68498) | Storage of trade-in photos and vehicle images | Trade-in photos uploaded by buyers and consultants | | Sanity CMS | United States | Content management (blog, FAQs, vehicle deal pages) | No personal information is stored in Sanity — only editorial/marketing content | | Google reCAPTCHA | United States | Bot detection on forms | IP address, browser fingerprint, interaction data |

These providers are bound by data processing agreements and are only authorised to use your information to provide services to us.

4.3 Analytics and Advertising Partners

Our platform uses the following third-party analytics and advertising tools. These tools may use cookies and similar technologies to collect information about browsing activity. See Section 9 for details of exactly which tools are active where.

| Tool | Provider | Location | Purpose | Active on | |---|---|---|---|---| | Google Analytics 4 (ID: G-KS4PB2YPQW) | Google LLC | United States | Website and platform analytics — pages visited, session duration, device/browser info | Public website AND authenticated platform | | Google Ads Conversion Tracking (ID: AW-17125513316) | Google LLC | United States | Measuring advertising campaign effectiveness | Public website only | | Google AdSense (ID: ca-pub-9016156464734950) | Google LLC | United States | Displaying relevant advertising | Public website only | | Facebook/Meta Pixel (ID: 607630838375665) | Meta Platforms Inc. | United States | Measuring ad effectiveness; building advertising audiences | Public website only |

4.4 Legal and Business Disclosures

We may also disclose personal information:

To law enforcement, regulators, or courts when required by law or legal process
To our legal or professional advisers when seeking advice
To a prospective buyer of our business, under appropriate confidentiality arrangements

5. Automated Decision-Making

Disclosure required under the Privacy and Other Legislation Amendment Act 2024 (Cth), effective 10 December 2026.

Carseekers uses an automated algorithm to determine which dealers receive your vehicle request. This process works as follows:

What the algorithm decides: When your request is verified, the system automatically identifies which dealers in our network are eligible to see it.

Logic used:

Geographic proximity: The system identifies dealers located within 30 kilometres of your postcode. This uses a geo-coordinate query against the dealer's registered business address. Your postcode is converted to a coordinate using an offline Australian postcode dataset — no GPS data is collected.
Brand matching: Only dealers who have registered to handle your requested vehicle brand are included.
State matching: Only dealers operating in your state are included.
Wide-reach override: In some cases (e.g., rare vehicles or low dealer density), Carseekers staff may manually enable a "wide reach" flag that bypasses the 30 km radius restriction. Brand and state filters still apply.

Significance to you: The algorithm determines which dealers can bid on your request. If no dealers match within the criteria, you may receive fewer or no bids.

No AI or machine learning is used. The matching is entirely rule-based and deterministic. No scoring, ranking, or weighting of your personal characteristics is performed.

Your rights regarding this decision: If you believe the matching criteria have produced an inappropriate outcome (e.g., no bids received), contact us at contact@carseekers.com.au and we can manually review your request and adjust the distribution criteria.

6. Cross-Border Disclosure of Personal Information

Carseekers' own infrastructure — including our database and file storage — is hosted in Australia. However, some third-party service providers we use to operate the platform are located overseas and receive personal information as part of delivering their services. These disclosures are governed by APP 8.

| Country/Region | Services | What is disclosed | Safeguard | |---|---|---|---| | United States | Google Analytics 4, Google Ads, Google AdSense, Google reCAPTCHA | Browsing behaviour, IP address, device/browser information. Note: Google Analytics is active on both the public website and the authenticated platform. Google AdSense is active on the public website only. | Google LLC participates in recognised international data frameworks and is bound by Google's Data Processing Terms | | United States | Meta (Facebook Pixel) | Browsing behaviour, IP address, conversion events (public website only) | Meta Platforms Inc. is bound by Meta's Data Processing Terms | | United States | Stripe | Dealer payment and subscription information | Stripe Inc. maintains Standard Contractual Clauses and binding corporate rules | | United States | Sanity CMS | No personal information — editorial content only | N/A | | France / European Union | Brevo | Buyer name, email, phone (transactional emails); dealer email (distribution notifications); contact enquiry details | Operates under GDPR, which provides comparable protections to Australian law; data processing agreement in place | | New Zealand | Xero | Dealer contact details and transaction amounts | New Zealand has been assessed as having comparable privacy protections to Australia under APP 8.2(a) |

By using our platform, you acknowledge that your personal information may be disclosed to these overseas recipients in accordance with this policy.

7. Data Storage and Security

Where data is stored:

Platform and user data is stored in a MongoDB database hosted in Sydney, Australia
Trade-in photos and vehicle images are stored in Google Cloud Storage (project: carseekers-68498), hosted in Australia
Email records are held by Brevo (France/EU)
Payment records are held by Stripe (United States)

Security measures we apply:

All passwords are stored using BCrypt hashing — we cannot recover your password
Authentication uses short-lived JSON Web Tokens (2-hour expiry) together with HTTP-only, Secure, SameSite=Strict refresh tokens
All data in transit is encrypted via HTTPS/TLS
Access to personal data is restricted to authorised Carseekers staff based on role (admin, consultant, dealer)
A full audit trail of all significant actions (request creation, dealer notification, bid placement, bid acceptance, cancellation) is maintained for internal review
Client name, email, and phone are masked from dealers until a bid is accepted

Reporting a security issue: If you discover a security vulnerability, contact contact@carseekers.com.au immediately.

8. Data Retention

We retain personal information for as long as necessary for the purposes described in this policy, subject to the following minimums:

| Data type | Retention period | |---|---| | Account information (buyers and dealers) | Until account deletion, or 7 years after last activity | | Vehicle request records | 7 years from request creation (for financial and dispute resolution purposes) | | Completed transaction records | 7 years (ATO record-keeping requirements) | | Bid records | 7 years from bid creation | | Audit trail / request events | 7 years | | Trade-in photos | Retained for the life of the associated request; deleted upon account deletion request | | Contact enquiry emails | Retained by Brevo per their email log retention policies; not stored in our database | | Magic link tokens | Automatically deleted after 24 hours | | Password reset tokens | Automatically deleted upon use or after 1 hour, whichever is earlier | | Authentication refresh tokens | Deleted on logout or password reset | | Analytics data | Governed by Google's and Meta's own retention policies |

When we no longer need personal information, we will delete or de-identify it.

9. Cookies and Tracking

9.1 What cookies and tracking tools we use, and where

We use different tracking tools depending on whether you are visiting the public website or using the authenticated platform.

On the public website (carseekers.com.au — pages accessible without logging in):

The following cookies and tracking scripts are active for all visitors to public pages:

| Cookie / Script | Purpose | Type | |---|---|---| | Google Analytics 4 (_ga, _gid, _ga_*) | Website analytics — page views, session data, device/browser info | Analytics | | Google AdSense | Serves advertising based on browsing behaviour | Advertising | | Google Ads Conversion (AW-17125513316) | Tracks whether a visitor came from a Google Ad and takes a conversion action | Advertising | | Facebook Pixel (_fbp) | Tracks page views and conversion events for Meta advertising campaigns | Advertising | | Google reCAPTCHA | Security — detects bot activity on forms | Functional/Security |

On form submission: When you submit a vehicle request, a Facebook Pixel "Lead" event and a Google Analytics conversion event are sent to Meta and Google respectively. These include a reference ID but not your name, email, or phone number.

On the authenticated platform (logged-in dealers, consultants, and administrators only):

The following analytics tools are also active when you are logged in to the platform. No advertising scripts run on the authenticated platform:

| Tool | Purpose | Type | |---|---|---| | Google Analytics 4 (_ga, _gid, _ga_*) | Platform usage analytics — pages visited, feature usage, session data | Analytics |

Authentication-related storage (platform only):

| Storage | Purpose | Type | |---|---|---| | jwt (localStorage) | Stores your authentication token so you remain logged in during your browser session | Strictly necessary | | refreshToken (HTTP-only cookie) | Allows your session to be renewed without re-entering your password (expires after 7–30 days) | Strictly necessary | | layout (localStorage via Redux) | Remembers your dashboard layout preferences | Functional |

9.2 Managing cookies

You can control cookies through your browser settings. Note that disabling certain cookies may affect website or platform functionality.

For analytics and advertising opt-outs:

Google Analytics: Use Google's opt-out browser add-on
Google Ads / AdSense: Visit adssettings.google.com
Meta/Facebook: Visit facebook.com/privacy/policy

A cookie consent banner is shown on the public website. Google Analytics, Google Ads conversion tracking, and the Meta Pixel are only loaded after you accept; declining leaves them switched off.

Google AdSense loads independently of this banner. Consent for AdSense is handled by a Google-certified consent management platform, which presents its own prompt to visitors in regions where prior consent is required (including the EEA and UK). Australian visitors are not required to give prior consent for advertising cookies under the Privacy Act.

You can also manage tracking preferences through your browser or the opt-out links above.

10. Your Rights

Under the Privacy Act 1988 and APPs, you have the following rights:

10.1 Access

You have the right to request access to the personal information we hold about you. To make a request, contact us at contact@carseekers.com.au. We will respond within 30 days. In some circumstances we may charge a reasonable fee for providing access.

10.2 Correction

If your personal information is inaccurate, out of date, incomplete, or misleading, you have the right to ask us to correct it. Buyers and dealers can update their name, email, and phone number via their account profile settings. For other corrections, contact us directly.

10.3 Deletion

You have the right to request deletion of your personal information. We will delete or de-identify your data unless we are required to retain it by law (e.g., for financial record-keeping under the Corporations Act 2001 or Income Tax Assessment Act). To request deletion, email contact@carseekers.com.au with the subject line "Privacy Request — Deletion". We will respond within 30 days.

10.4 Opt-out of marketing

You can unsubscribe from marketing emails at any time using the unsubscribe link in any marketing email, or by contacting us. Opting out of marketing does not affect transactional communications (e.g., bid notifications, request confirmations).

10.5 Opt-out of dealer data sharing

You can request that your vehicle request information not be distributed to dealers by contacting us before your request is verified. Once a request has been distributed and a bid accepted, sharing with the winning dealer cannot be reversed.

10.6 Automated decision-making

You have the right to request a human review of any automated decision that significantly affects you. See Section 5 for details of our dealer-matching algorithm and how to request a review.

10.7 Complaints

If you believe we have breached the APPs, you can:

Contact us at contact@carseekers.com.au — we will respond within 30 days
If you are not satisfied with our response, lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992

11. Children's Privacy

Our platform is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a person under 18, contact us immediately and we will delete it.

12. Notifiable Data Breaches

We are subject to the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act. If we experience a data breach that is likely to result in serious harm to any affected individuals, we will:

Notify the OAIC as soon as practicable
Notify affected individuals directly where required
Take immediate steps to contain the breach and prevent further harm

13. Changes to This Policy

We review this policy regularly. If we make material changes, we will update the "Last updated" date and notify registered users by email. The current version of this policy is always available at carseekers.com.au/legal/privacy.

14. Contact Us

Carseekers Privacy Officer Email: contact@carseekers.com.au Website: carseekers.com.au

For complaints or to exercise any of your rights, contact us in writing at the email above with the subject line "Privacy Request".

This policy is effective from the date listed above and applies to all personal information collected by Carseekers Pty Ltd.