Privacy Policy.

What we collect

We collect only what the product needs to work:

• Account information — your email address and name when you sign in with Google or Apple. We never see or store your password for those providers.
• Content you provide — listings you check, VINs you enter, cars you watch, and saved valuation history tied to your account.
• Payment information — handled by Stripe, our payment processor. We store your membership status and order history, never your card number.
• Usage data — pages visited, features used, and approximate location derived from your IP address, collected through product analytics to improve the service.
• Cookies and similar technologies — used to keep you signed in and to understand how the product is used. We do not use third-party advertising cookies.

How we use it

We use your information to run valuations and produce reports, persist your watchlist and history across devices, process payments and manage memberships, send transactional email such as receipts and report deliveries, monitor for abuse, and improve the product. We do not sell your personal information, and we do not share it with dealers, brokers, or advertisers.

Who we share it with

We share personal information only with the service providers that operate the product on our behalf: authentication and database hosting (Supabase), payment processing (Stripe), product analytics (PostHog), transactional email (Resend), and web hosting (Vercel). Each provider processes data under its own contractual safeguards and only as needed to provide its service. We may also disclose information when required by law or to protect our rights, users, or the public.

Retention and deletion

We keep account data while your account is active. You can delete your account at any time from the account page or by contacting us; we then delete or de-identify your personal information within 30 days, except records we must retain for tax, accounting, or legal purposes. Valuation observations retained for market research are de-identified and no longer tied to you.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise any of these rights, email us at the address below. We will respond within the timeframe your local law requires, and we do not discriminate against you for exercising your rights.

Security

All traffic is encrypted in transit. Access to production data is limited and logged, database access is enforced with row-level security, and payment credentials never touch our servers. No system is perfectly secure; if a breach affects your personal information, we will notify you as required by law.

Children

Exotic Index is intended for adults and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

Changes to this policy

If we make material changes to this policy, we will update the date above and notify signed-in users by email or an in-product notice before the changes take effect.

Contact

Questions or requests about privacy: privacy@exoticindex.com.