Privacy Policy

How CarPay handles your personal information

Effective as of July 30, 2026

Introduction

This Privacy Policy describes how CarPay, Inc. (“CarPay,” “we,” “us,” or “our”) collects, uses, discloses, and otherwise processes information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with a particular person or household (“Personal Information”). It applies to our software services for automobile dealers (“Dealers”); individuals who are borrowers, payers, or account holders of Dealers (“Consumers”); individuals who browse vehicle listings, search inventory, or contact Dealers through shop.carpay.com (“Carpay Shop”) (“Shoppers”); and our websites and applications, including www.carpay.com, pay.carpay.com, dealers.carpay.com, signups.carpay.com, shop.carpay.com, and shop-dealers.carpay.com (collectively, the “Services”).

CarPay processes Personal Information in different roles depending on the context:

Controller Data. Personal Information CarPay determines how and why to process for its own purposes, including website, business-contact, support, marketing, analytics, security, and Carpay Shop data (“Controller Data”). Shopper information CarPay collects through Carpay Shop is Controller Data until it is disclosed to a Dealer; the Dealer independently determines how it uses the information it receives.

Processor Data. Personal Information CarPay processes for a Dealer under the Dealer’s instructions (“Processor Data”). For Processor Data, the Dealer generally acts as the business or controller and CarPay generally acts as its service provider or processor. Direct questions or rights requests about Processor Data to the applicable Dealer; CarPay will assist the Dealer as required by law and contract.

1. Personal Information We Collect

Information you provide to us

Controller Data

Controller Data may include:

  • Account, business, and contact information, such as name, business affiliation, email address, mailing or billing address, phone number, login details, and communication preferences.
  • Support, feedback, and business-interaction information, including the content of requests, correspondence, survey responses, and records of our relationship with you or your organization.
  • Transaction and subscription records relating to a Dealer’s purchase or use of CarPay’s business services. Payment credentials are submitted to independent payment processors or vaulting providers; CarPay does not store raw payment card numbers or bank-account credentials.

Information Shoppers provide through Carpay Shop

When you browse Carpay Shop or contact a Dealer about a vehicle, we may collect:

  • Inquiry information, including first and last name, phone number, email address, ZIP code, stated monthly take-home income, cash-down amount or range, monthly-payment budget, preferred visit time, vehicle of interest, and any optional message you submit.
  • Search and browsing preferences, such as budget inputs, filters, referral information, and vehicles viewed, saved, or inquired about.
  • Communications about an inquiry, including messages exchanged with CarPay or a Dealer by chat, phone, email, or text message and related consent and opt-out records.

Carpay Shop does not ask Shoppers to submit a Social Security number or payment credential and CarPay does not conduct a credit check when a Shopper browses or submits an inquiry. Do not include Social Security numbers, payment credentials, medical information, or other unnecessary sensitive information in a free-text message.

Automatic data collection

We and our service providers may automatically collect information about devices and interactions with the Services, including:

  • Device information, such as IP address, browser type, operating system, device identifiers, language settings, and approximate location information (such as city or state) derived from IP address.
  • Usage and activity information, such as pages viewed, features used, timestamps, navigation paths, and interactions with messages or notifications.
  • Mobile application data, where applicable, including device settings and permissions. Precise geolocation information is collected only where a user has affirmatively enabled location services through a mobile device, and such permissions may be disabled at any time through device settings.
  • Marketing and attribution information, such as referring websites, search engines, advertisements, campaign parameters, advertising click identifiers, and conversion events. We use cookies and similar technologies, including analytics tools, to collect this information. The specific tools in use may change and should be reflected in CarPay’s cookie or privacy-choice interface.

Processor Data

CarPay collects and processes personal information on behalf of Dealers in connection with the services it provides.

  • Contact information, such as first and last name, email address, mailing address, billing address, and phone number.
  • Identification information, such as date of birth, Social Security number, driver’s license number, or other government-issued identification, which may be used for account identification, authentication, and servicing purposes, but not for credit evaluation or creditworthiness determinations.
  • Payment and account information, such as payment history, transaction details, account balances, payment schedules, and related account servicing information. Payment credentials (such as card or bank account numbers) are provided directly by Consumers or Dealers and are tokenized and securely stored by independent third-party payment processors or vaulting providers. CarPay does not store raw payment card numbers or bank account credentials.
  • Vehicle-related information, such as vehicle identification number (VIN), make, model, mileage, vehicle value, and related account information associated with a Dealer’s customer account.
  • Communications data, including emails, text messages, in-application messages, IVR interactions, and customer-service communications sent or received through the Services. Audio from calls using certain IVR features may be processed to create a transcript for operational, quality-assurance, and compliance purposes. CarPay does not use call audio or transcripts for biometric identification.
  • Information about other individuals associated with a customer account (such as co-buyers or authorized payers), such as name and contact information, where such information is provided by a Dealer or Consumer. Dealers and Consumers are responsible for ensuring they have appropriate authorization to provide such information.

Sources of Personal Information

We collect Personal Information directly from individuals; from Dealers and their authorized personnel; automatically from devices and browsers; from payment, communications, analytics, advertising, identity, security, and other service providers; from Dealer websites, inventory feeds, and other sources Dealers make available; and from public or commercially available sources where permitted by law.

2. How We Use Your Personal Information

We use Personal Information for the purposes below. Some uses are carried out for Dealers and at their direction; others are carried out for CarPay’s own purposes.

Providing and operating the services

We use personal information to provide, administer, and support the services requested by Dealers, including to:

  • administer and service Dealer customer accounts;
  • facilitate, route, and confirm payments through independent third-party payment processors;
  • configure, schedule, initiate, and manage automatic or recurring payments (including retrying failed payments and sending related notifications);
  • send transactional, operational, and account-related communications to Consumers and Dealer personnel via email, SMS/text message, IVR, in-application messaging, or other supported channels;
  • provide customer support, respond to inquiries, and troubleshoot issues; and
  • maintain records relating to payment history, account activity, and communications.

Connecting Shoppers with Dealers (Carpay Shop)

We use Shopper Personal Information to operate Carpay Shop, including to display inventory and estimated or Dealer-confirmed listing information; apply search and budget inputs; deliver an inquiry to the Dealer offering the vehicle; contact the Shopper about the inquiry as permitted by law; facilitate communications; maintain consent and opt-out records; prevent fraud and misuse; and measure, support, and improve the marketplace.

Communications and messaging

Our platform is used to generate, send, receive, log, and manage communications on behalf of Dealers, including payment reminders, alerts, confirmations, delinquency and collections-related messages, account notices, and other communications configured by Dealers. Communications may include language provided or selected by Dealers and may relate to the administration or protection of a Dealer’s collateral or account interests, as permitted by applicable law. If you have any questions regarding these communications, please contact your applicable Dealer.

Research, analytics, and service improvement

We may use personal information to monitor, analyze, and improve the performance, functionality, security, and reliability of the services. Where practicable, we use aggregated or de-identified data for these purposes.

Marketing and Advertising

We may send marketing or promotional communications on behalf of Dealers or about CarPay’s own services, as permitted by law. You may opt out as described below.

We use cookies and similar technologies, including Google Analytics, Google Ads conversion measurement, and Meta (Facebook and Instagram) Pixel and conversions measurement, for analytics, attribution, and advertising measurement. We may share limited event data with advertising platforms — for example, that an inquiry was submitted after an advertisement click, together with the associated click identifier. We do not disclose the contents of Shopper inquiries (such as your name, phone number, or income information) to advertising platforms for their independent advertising purposes. Some of these limited disclosures may be considered a “sale,” “sharing,” or processing for targeted advertising under certain state laws, even when no money changes hands. You may opt out as described in Your Choices and State Privacy Rights below.

Compliance, safety, and legal obligations

We use personal information to:

  • comply with applicable laws, regulations, and lawful requests;
  • enforce the terms and conditions that govern the services;
  • protect the rights, safety, and property of CarPay, Dealers, Consumers, and others; and
  • prevent, detect, investigate, and respond to fraud, security incidents, and misuse of the services.

CarPay does not use personal information to make creditworthiness determinations, obtain consumer credit reports, or make lending or underwriting decisions. All such decisions, if any, are made solely by Dealers or their independent third-party providers.

3. How We Share Your Personal Information

We share personal information in the following circumstances:

  • Dealers you choose to contact. When you submit an inquiry or otherwise ask to connect about a vehicle, we disclose the inquiry information to the Dealer offering that vehicle so the Dealer can respond. Once received, the Dealer handles the information under its own privacy notice and legal obligations. Dealers may pay CarPay a fee to access Shopper inquiries. Because this disclosure is made at your direction — to the Dealer you chose to contact — it is not a “sale” of Personal Information under applicable state privacy laws, and we do not provide your inquiry to Dealers you did not ask to connect with.
  • Advertising and analytics partners. We disclose limited device, usage, attribution, and conversion-event information to providers that help measure, analyze, and advertise the Services. Depending on the recipient and applicable law, this may constitute a sale, sharing, or targeted advertising; see Your Choices and State Privacy Rights below.
  • Dealers and parties acting on behalf of Dealers. We share personal information with Dealers whose customer accounts are administered through the services and with parties designated or authorized by Dealers. This sharing occurs because CarPay provides services on behalf of Dealers and at their direction.
  • Service providers and infrastructure partners. We disclose Personal Information to vendors that perform services for us or help operate the Services, such as hosting, payment processing, communications, customer support, analytics, security, and Dealer-system integration providers. We contractually restrict service providers from retaining, using, or disclosing Personal Information except to perform services for us or as otherwise permitted by law.
  • Marketing communications. We may share personal information as necessary to send communications on behalf of Dealers or in connection with CarPay’s services, including through email or messaging service providers.
  • Professional advisors. We may share personal information with professional advisors, such as attorneys, auditors, insurers, and bankers, where reasonably necessary in connection with the professional services they provide to us.
  • Legal and compliance purposes. We may disclose personal information to law enforcement authorities, government agencies, courts, regulators, or private parties if we believe in good faith that such disclosure is reasonably necessary to comply with applicable law or legal process, protect the rights or safety of CarPay, Dealers, Consumers, or others, or enforce our agreements and policies.
  • Business transfers. We may share personal information in connection with a corporate transaction or potential transaction involving a merger, acquisition, reorganization, sale of assets, financing, or similar transaction involving CarPay or its affiliates. In such cases, personal information may be disclosed to advisors and counterparties subject to customary confidentiality protections.

4. Your Choices

You have choices regarding Personal Information, subject to applicable law and CarPay’s role as a service provider or processor for Dealers.

  • Marketing communications. You may opt out of receiving marketing-related emails from CarPay by following the unsubscribe instructions included in those emails or by contacting us using the information provided below.
  • Text messages. If you have consented to receive text messages from CarPay or a Dealer about your inquiry, you may opt out at any time by replying STOP to any message. Message and data rates may apply. Consent to be contacted is not a condition of purchasing any vehicle, good, or service.
  • Dealer-directed communications. Many communications sent through the services are sent on behalf of Dealers and relate to the administration or servicing of Dealer customer accounts. Requests to modify, limit, or stop such communications may need to be directed to the applicable Dealer, and CarPay may not be able to independently honor all such requests.
  • Cookies, sale/sharing, and targeted advertising. Most web browsers allow you to control cookies and similar technologies through browser settings; disabling cookies may affect some features. Where applicable law gives you the right to opt out of sale, sharing, or targeted advertising, you may exercise that right by emailing support@carpay.com with “Privacy Request” in the subject line, and we will apply the opt-out to the information associated with you.
  • Mobile device settings. Users of CarPay’s mobile applications may control certain data collection practices, such as location permissions or notification settings, through their mobile device settings.
  • Third-party platforms and integrations. If you connect or interact with third-party platforms or services in connection with the services, such as payment methods or Dealer systems, you may be able to limit or revoke CarPay’s access to information from those platforms through their settings. Revoking access does not affect information already received, processed, or retained as required by applicable law or contractual obligations.
  • Browser privacy signals. The Services do not respond to legacy “Do Not Track” signals. Where applicable law requires us to treat a recognized opt-out preference signal, such as Global Privacy Control, as a valid opt-out request, we will honor that signal as the law requires.

5. State Privacy Rights

Depending on where you live and subject to legal exceptions, you may have the right to know or access Personal Information; correct inaccuracies; delete Personal Information; obtain a portable copy; opt out of sale, sharing, targeted advertising, or certain profiling; limit certain uses or disclosures of sensitive Personal Information; and receive equal service without unlawful discrimination for exercising a privacy right.

To submit a request concerning Controller Data, email support@carpay.com with “Privacy Request” in the subject line, or write to us at the address in How to Contact Us below. We may verify your identity and authority before acting. An authorized agent may submit a request where permitted by law. If we deny a request, residents of states that provide an appeal right may appeal by replying to our decision. Requests concerning Processor Data should be directed to the applicable Dealer.

6. Other Sites and Services

The services may contain links to, or integrations with, websites, mobile applications, or online services operated by third parties. These links and integrations are provided for convenience only and do not constitute an endorsement of, or representation that CarPay is affiliated with, any third party. CarPay does not control, and is not responsible for, the privacy practices, content, or operations of third-party websites or services. Your interactions with third-party websites or services are governed by their own privacy policies and terms.

7. Data Retention

We retain each category of Personal Information only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, maintain transaction and consent records, comply with legal and contractual obligations, resolve disputes, enforce agreements, and protect security. Retention periods vary based on the nature and sensitivity of the information, the relationship and service involved, legal limitation periods, and applicable recordkeeping requirements. We delete or de-identify information when it is no longer reasonably necessary, unless law permits or requires longer retention.

8. Security

We employ reasonable administrative, technical, and physical safeguards designed to protect personal information from loss, misuse, unauthorized access, disclosure, alteration, or destruction. However, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security of personal information.

9. Children

The Services are intended for adults and are not directed to children under 18. We do not knowingly collect Personal Information from a child under 13. If you believe a child has provided Personal Information to us, contact us so we can investigate and take appropriate action.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the revised policy and update the effective date above. If changes materially affect how we use or disclose Personal Information, we will provide any additional notice required by law. A privacy notice describes our practices and is not a contract requiring acceptance merely through continued use.

11. How to Contact Us

If you have questions or concerns about this Privacy Policy or our privacy practices, you may contact us using the information below:

Email: support@carpay.com

Mail: 362 Gulf Breeze Parkway, Suite 411, Gulf Breeze, FL 32561, United States

Phone: 1-877-388-4265