Privacy Policy

Last updated: April 14, 2026

CarLlama ("we," "us") operates carllama.ai (the "Site") to give private-party sellers fast, market-accurate cash offers for their vehicles. This policy explains what information we collect, how we use it, and the choices you have.

1. Information we collect

Vehicle details you submit

• Year, make, model, mileage, VIN
• Photos of the vehicle you upload
• Optional condition notes or comments

Contact information you provide

• Email address and/or phone number
• ZIP code if you supply it for regional pricing

Technical information collected automatically

• IP address, browser type, device type, operating system
• Pages visited on the Site and referring URLs
• Standard server logs retained for security and diagnostics

2. How we use your information

We use what you submit to:

• Generate a cash offer for your vehicle
• Contact you about that offer by email, phone, or SMS
• Verify the vehicle's market value against third-party valuation data (KBB, MMR, auction indices, comparable public listings)
• Comply with legal obligations including odometer disclosure and title transfer
• Improve our valuation models and product experience (in aggregate, not individually identifying)

3. Third parties we share data with

We share the minimum information necessary with:

• Vehicle valuation APIs (Kelley Blue Book, Manheim Market Report, vAuto) — VIN, mileage, trim, and ZIP code to return a market value
• Vehicle history providers (e.g., Carfax, AutoCheck) — VIN only, to pull accident and title records
• Service providers (email delivery via SendGrid, SMS via Twilio, image hosting via Cloudinary, infrastructure via Railway) — for the specific purpose of delivering our service
• Title / DMV intermediaries — when a sale is completed, to process the title transfer legally

We do not sell your personal information to advertisers or list brokers.

4. How we protect your data

• All data in transit uses TLS 1.2+ encryption
• Access to stored data is restricted to authorized personnel
• API credentials for third-party providers are stored as environment variables, not in source code
• Photos are hosted on Cloudinary with signed URLs; we do not make them publicly browsable

5. Your rights

You can:

• Request a copy of the personal information we have about you
• Request deletion of your submission and related records at any time
• Opt out of marketing communications (we will still send transactional messages related to an active offer)
• Correct inaccurate information you submitted

Contact privacy@carllama.ai to exercise any of these rights. We respond within 10 business days.

6. Retention

We retain submission data for 24 months to calibrate our valuation models against actual market outcomes. After 24 months, personal identifiers are removed; the anonymized vehicle + offer data is kept indefinitely for model training. You can request earlier deletion at any time.

7. California residents (CCPA / CPRA)

California residents have additional rights under the California Consumer Privacy Act and California Privacy Rights Act, including the right to know, delete, correct, and opt out of any "sale" or "share" of personal information. CarLlama does not sell or share personal information as defined by the CPRA. To exercise California-specific rights, email privacy@carllama.ai with the subject line "California Request."

8. Children's privacy

The Site is not intended for anyone under 18. We do not knowingly collect personal information from minors.

9. Changes to this policy

We may update this policy. Material changes will be posted here with a revised "last updated" date. Continued use of the Site after changes constitutes acceptance.

10. Contact

CarLlama
3860 Hilltop Road, Richmond, CA 94803
(510) 367-6129
privacy@carllama.ai