Privacy Policy

1. Who this covers

This policy is written by Fully Sorted ("Fully Sorted", "we", "us"), based in San Diego, California. It covers fullysorted.com, our emails and text messages, and any other place we link to it. It applies to everyone who uses the site: people browsing, owners listing or researching a car, buyers, and the specialists, shops and other businesses ("providers") who appear in the services directory.

It does not cover the practices of providers, sellers or buyers you deal with through the site. Once you contact a specialist or agree a sale, what they do with your details is between you and them. It also does not cover third-party sites we link to.

2. What we collect

Information you give us

• Account details. Name, email address and, if you add it, a phone number and profile photo. Sign-in is handled by Clerk, our authentication provider; if you sign in with Google or another identity provider, we receive the name, email and profile picture that provider shares. We never see your password.
• Vehicle listings. Year, make, model, VIN or chassis number, mileage, condition, price, location, description, photos and video, and the tier you choose. Sale submissions to our research registry work the same way.
• Provider applications and profiles. Business name, contact name, business email and phone, website, address or service area, trades, marques and specialties, where the work happens (workshop, mobile, remote), team size, photos, and anything you write in your profile.
• Inquiries and messages. When you contact a provider or a seller through the site we collect your name, email, phone if you give it, your message, and any optional details about the car you choose to add (year, make, model, chassis, condition, location, timing and budget range). Nothing in that optional panel is required.
• Reviews and comments. The text and rating you submit, the name you choose to show, and the fact that a review was tied to a completed inquiry where that applies. Providers may post a reply, which is also public.
• Saved listings and alerts. Cars you save and the searches or price alerts you ask us to email you about.
• Registry submissions. Chassis numbers, ownership history, documents, photos and owner stories you submit to the research registry.
• Payments. Listing fees are processed by Stripe. Stripe collects your card details directly; we receive a confirmation, the last four digits of the card, the card brand, and your billing name and email. Full card numbers never touch our servers. If provider payouts are switched on in future, Stripe will collect the identity and bank details it needs from providers under its own privacy policy.
• Correspondence. Emails, contact-form messages, support requests and phone or text conversations with us, including notes we make about them.

Information collected automatically

• Device and log data. IP address, browser type, operating system, referring page, the pages you view and when, and the rough location an IP address implies (city level). Our hosting provider, Vercel, keeps standard server logs.
• Cookies and similar technologies. Essential cookies for sign-in, security and your preferences; and, only with your consent, analytics and advertising cookies. Section 8 has the detail and the off switch.
• Abuse prevention. We rate-limit public forms by IP address and keep short-lived records of attempts to stop floods and spam.

Information from other sources

• Vehicle data.When you enter a VIN we send it to the US National Highway Traffic Safety Administration's public vPIC decoder to fill in year, make, model and specifications. The VIN alone is sent, never your name.
• Market data. Published auction results and asking prices from public sources, which relate to cars rather than to you.
• Business information about providers. See section 3.

3. Business information from public sources

The directory is seeded by hand. Before a shop has signed up, we may create a draft profile for it using information the business has already made public: its name, trade, address, phone number, website, and a short description of what it does, taken from its own website, club and event listings, and similar public sources. We do this so that owners searching for help see real businesses, and so that the shop can claim a ready-made profile in one click rather than starting from nothing.

If we hold a draft profile for your business you can claim it, correct it, or have it removed at any time by emailing chris@fullysorted.com. Removal is permanent: we keep only your business email on a suppression list so we do not contact you or re-create the profile. We do not create draft profiles from non-public sources, and we do not collect personal information about individuals beyond a business contact name where the business itself publishes one.

4. How we use it

• To run the site: create accounts, publish listings and profiles, deliver inquiries to the provider or seller you chose, process listing fees, and send the emails the service depends on (confirmations, replies, alerts you asked for).
• To build a trustworthy directory: verify that a review comes from a real inquiry, let providers reply, and keep out fraud, spam and duplicate accounts.
• To improve the site: understand which pages, research articles and trades people actually use, fix errors, and test changes. Where this uses analytics cookies it happens only with your consent.
• To communicate with you: answer your questions, tell you about changes to the service or this policy, and, if you have not opted out, tell you about new features and research. Every marketing email has an unsubscribe link.
• To measure our own advertising, only with your consent (section 8).
• To meet legal obligations, enforce our Terms of Service, and protect the rights and safety of users, providers and the public.

We do not use your personal information to make decisions with legal or similarly significant effects on you, and we do not build profiles of individuals for advertising.

5. AI features

Some features use large language models supplied by Anthropic: for example, drafting a listing description from the details you enter, drafting the copy on a provider profile, and producing the model histories in our research hub. When you use one of these features, the text and vehicle details you provide are sent to Anthropic's API to generate the result. Under Anthropic's commercial terms that data is not used to train its models. We do not send your account credentials, payment details or private messages to any AI provider. Anything generated for you is a draft you can edit or discard before it is published.

6. Who we share it with

We do not sell personal information, and we do not rent lists. We share it in these cases:

• With the person you chose to contact. An inquiry goes to the provider or seller you selected, with your name, contact details and message, and only to them. We do not forward one inquiry to several shops.
• With service providers who work for us, under contracts that limit them to our instructions: Vercel (hosting, file storage for photos, and privacy-preserving aggregate analytics), Neon (database), Clerk (sign-in), Stripe (payments), Resend (transactional email), Anthropic (AI features, section 5), and Google and Meta (analytics and advertising measurement, only with your consent, section 8).
• Publicly, when you publish. Listings, provider profiles, reviews, comments and registry stories are public by design. Section 7 lists exactly what shows.
• When the law requires it, for example a subpoena or court order, or when we believe in good faith that disclosure is needed to prevent fraud, protect someone's safety, or enforce our terms.
• If the business changes hands. If Fully Sorted is acquired or merges, your information may transfer with it; this policy would continue to apply until you are told otherwise.
• Aggregated or de-identified data that cannot reasonably identify you, such as how many inquiries a trade receives in a month. We commit not to try to re-identify it.

7. What is public on the site

• Car listings show everything you enter except your email and phone number, which are only released to a buyer when you reply to them. Think before including a full VIN, license plate or house number in photos or text; we recommend cropping plates and stating a city rather than a street.
• Provider profiles show the business name, trades, service area, photos, description, reviews and replies, and the business contact details the provider chooses to display.
• Reviews and comments show the display name you chose and the date. Reviews cannot be deleted by the provider they are about, which is what makes them worth reading.
• Registry entries show the vehicle history and owner stories submitted, with owner names only where the submitter asked for them to appear.

Public pages can be indexed by search engines and copied by others. If you remove a listing or profile we remove it from the site promptly, but we cannot recall copies made while it was live.

8. Cookies, analytics and advertising

A cookie is a small file your browser stores. We use two kinds, and you choose whether the second kind is on.

Essential (always on)

• Clerk session cookies that keep you signed in and protect against forged requests.
• Our own preference storage, such as your cookie choice and a dismissed banner.
• Stripe cookies on checkout pages, used for fraud prevention.
• Vercel Analytics, which counts page views without cookies or cross-site identifiers and does not identify you.

Analytics and advertising (off until you accept)

• Google Analytics 4tells us which pages are read and how people move through the site. Google may set cookies and receives your IP address and device information. Google Analytics 4 does not store IP addresses, and we keep Google's data-sharing settings at the minimum it allows.
• Meta Pixellets us see whether our own ads on Instagram and Facebook led to a visit or a signup. Meta receives your IP address, device information and the pages you viewed, and can link that to your Meta account if you have one. Under California law this counts as "sharing" for cross-context behavioral advertising, which is why it is off by default and why you can switch it off below.

We do not use advertising networks that follow you across unrelated sites, we do not sell browsing data, and we honor the Global Privacy Control browser signal: if your browser sends it, analytics and advertising cookies stay off and we record you as opted out. Your choice is stored in this browser only, so make it again on other devices. You can also block or clear cookies in your browser settings; the site works without the optional ones.

9. Email and text messages

Service emails (inquiry deliveries, receipts, listing status, reply notifications, review requests tied to a real inquiry, and security notices) are part of using the site and are sent to the address on your account.

Marketing emails, including research and feature news, go only to people who signed up or asked for them. Every one carries an unsubscribe link and our postal address, and unsubscribes are processed within ten business days as the CAN-SPAM Act requires; in practice it is immediate. Provider outreach emails include a one-line opt-out, and we keep a suppression list so a business that says no is not contacted again.

Text messages. We only text people who gave us a mobile number and agreed to be texted. Reply STOP to any message to end them. Carrier rates may apply.

10. How long we keep it

• Account data: for as long as the account exists, then deleted or de-identified within 30 days of a verified deletion request.
• Listings and photos: while the listing is live, plus 90 days so a sale can be completed and disputes resolved, then deleted from storage. Sold-price data may be kept in de-identified form for market research.
• Provider profiles: while the provider is in the directory. Removed profiles are deleted, except the suppression entry described in section 3.
• Inquiries and messages: three years from the last message, so both sides have a record of what was agreed and so reviews can be verified against a real inquiry.
• Reviews: for the life of the provider profile they are attached to, because a review record that can be quietly erased is worth nothing.
• Payment records: seven years, as tax and accounting rules require.
• Server logs and rate-limit records: 30 days or less.
• Analytics data: Google Analytics is set to its shortest retention period (two months for user-level data).

We may keep information longer where the law requires it, to resolve a dispute, or to enforce our terms, and we may keep de-identified data indefinitely.

11. Security

Everything travels over HTTPS. Data is stored with providers that hold independent security certifications, in encrypted form at rest. Access to production data is limited to the people who need it to run the site, behind two-factor authentication. Payment details are handled entirely by Stripe, a PCI DSS Level 1 processor. Public forms are rate-limited and screened for abuse.

No system is perfectly secure. If we learn of a breach that affects your personal information we will tell you without unreasonable delay, and in any case within the time California law requires, and we will tell you what happened and what we are doing about it. Please report suspected security problems to chris@fullysorted.com.

12. Your choices and your rights

Whoever you are and wherever you live, you can:

• See and correct your account, listing and profile details from your dashboard at any time.
• Delete your account and data by emailing us. We verify the request against the email on the account and complete it within 30 days, subject to the retention rules in section 10.
• Opt out of analytics and advertising cookies using the control in section 8, or by turning on Global Privacy Control in your browser.
• Unsubscribe from marketing email with the link in any message, and from texts by replying STOP.
• Have a draft business profile removed (section 3).
• Ask us what we hold about you and receive a copy in a portable format.

To exercise any of these, email chris@fullysorted.com or use the contact form. We will not treat you differently for exercising a privacy right. You may also appoint someone to make a request for you; we will ask for proof that you authorized them.

13. California privacy notice

This section is our notice at collection under the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the "CCPA"). It applies to California residents and supplements the rest of this policy.

Categories of personal information collected in the last 12 months

• Identifiers: name, email, phone, postal address or city, account ID, IP address. Source: you, your device. Purpose: run the service, communicate, prevent fraud.
• Customer records: billing name, last four card digits, card brand. Source: you via Stripe. Purpose: payments and receipts.
• Commercial information: listings created, tiers purchased, inquiries sent, saved cars, reviews. Source: you. Purpose: run the service, verify reviews, improve the site.
• Internet activity: pages viewed, referrers, device and browser data. Source: your device, analytics cookies with consent. Purpose: run and improve the site, measure our own ads.
• Geolocation (coarse): city-level location inferred from IP, and any location you enter. Source: your device, you. Purpose: show relevant providers and listings.
• Audio and visual: photos and video you upload. Source: you. Purpose: display your listing or profile.
• Professional information: business name, trade, role, for providers. Source: you, public sources (section 3). Purpose: the directory.
• Inferences: we do not build inferential profiles about individuals.

Sensitive personal information. We do not intentionally collect sensitive personal information as the CCPA defines it (government ID numbers, precise geolocation, account log-in with credentials we hold, racial or ethnic origin, religious beliefs, health, sexual orientation, or the contents of mail, email or texts where we are not the intended recipient). Please do not put such information in listings, profiles or messages. Sign-in credentials are held by Clerk, not by us.

Sale and sharing.We have not sold personal information in the last 12 months and we do not sell it. With your consent we "share" internet activity information with Meta for cross-context behavioral advertising, as described in section 8. You can opt out at any time with the Do Not Sell or Share My Personal Information control in section 8, or by using a browser that sends the Global Privacy Control signal, which we honor as a valid opt-out. We have no actual knowledge of selling or sharing the personal information of anyone under 16.

Your CCPA rights

• To know what personal information we have collected about you, the categories of sources, our purposes, and the categories of third parties we disclosed it to, and to receive a copy.
• To delete personal information we collected from you, with the exceptions the law allows (for example, completing a transaction, security, or legal obligations).
• To correct inaccurate personal information.
• To opt out of sale or sharing (section 8).
• To limit use of sensitive personal information; we do not use it for anything beyond what the law permits without limitation, so no separate control is needed.
• To not be discriminated against for exercising any of these rights.

How to make a request. Email chris@fullysorted.comwith "California privacy request" in the subject, or use the contact form. We will confirm receipt within 10 business days and respond within 45 days, extendable once by another 45 days with notice. To verify you, we match the request to the email on your account and may ask you to confirm details only the account holder would know; we never ask for government ID unless the law requires it. An authorized agent may submit a request with your signed permission. Requests are free up to twice in 12 months.

Financial incentives. Founding-provider free listings and free-listing promotions for the first cars on the marketplace are offered to everyone on the same terms and are not conditioned on the collection or retention of personal information, so they are not financial incentive programs under the CCPA.

Shine the Light. California Civil Code section 1798.83 lets residents ask which personal information we disclosed to third parties for their own direct marketing. The answer is none; we do not do that.

Metrics. The CCPA asks businesses of a certain size to publish request statistics. We are below that threshold today; if that changes we will publish them here.

14. Visitors outside California and the US

Fully Sorted is a US service and your information is stored and processed in the United States. Residents of other US states with privacy laws (including Colorado, Connecticut, Oregon, Texas, Utah and Virginia) have rights similar to those in section 13; use the same contact and we will honor them. If you visit from the EU, UK or elsewhere, we process your information on the basis of performing the service you asked for, our legitimate interest in running and securing the site, your consent for optional cookies, and legal obligations; you may exercise the rights in section 12 and lodge a complaint with your local authority. By using the site from outside the US you understand your information will be transferred to the US, which may not offer the same protections as your home jurisdiction.

15. Children

Fully Sorted is for adults. You must be 18 or older to create an account, list a car, apply as a provider or contact anyone through the site. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us information, email chris@fullysorted.com and we will delete it.

16. Changes to this policy

When we change this policy we update the date at the top. For material changes, such as a new category of data or a new purpose, we will tell account holders by email or a notice on the site before the change takes effect. Earlier versions are available on request.

17. Contact

Privacy questions and requests go to Chris Peterson, founder, at chris@fullysorted.com, or through the contact form. Our postal address appears in the footer of every email we send. A person reads every message; there is no ticket queue to fall into.