Legal

Car Handshake Privacy Notice

This notice explains what Dealer Handshake Inc. collects, why we use it, who receives it, how long we retain it, and the choices available when you use Car Handshake.

Effective
August 20, 2026
Last updated
October 9, 2026
Sections
13

1. Scope and responsible company

This notice covers carhandshake.com, api.carhandshake.com, mcp.carhandshake.com, and Car Handshake tools used through ChatGPT, Claude, Perplexity, or another compatible AI host. Dealer Handshake Inc., a Delaware corporation, operates Car Handshake. A dealership receiving your request and the AI host you choose have their own privacy responsibilities and notices.

2. Information we collect

Public inventory and dealership data

Participating US dealerships and supported Canadian dealerships outside Quebec choose whether eligible inventory is public through website search, AI search, or both. Public data can include vehicle identity and attributes, price, currency, mileage, media, availability, source freshness, dealer identity, business hours, services, and exact public dealership location information.

Search and location data

A search can include request text, filters, a US ZIP code or supported Canadian postal code, country preference, and location. Device location is optional and requires browser permission. An AI host may provide a coarse location when needed for a location-based request. Car Handshake does not request an AI host's full conversation history, memory, user files, address book, or unrelated account data.

Dealer-contact data

If you choose a write action, we can collect your name, email, phone, message, selected vehicle, appointment preference, trade-in information, consent text, allowed contact channels, confirmation time, and an idempotency identifier used to prevent duplicate submissions. Read-only inventory tools do not require a Car Handshake account.

Website shopping assistant

When you use our optional AI shopping assistant, we process your messages, recent conversation, stated shopping preferences, and the public vehicle or dealership context needed to answer. These are sent to the configured AI service provider, Anthropic or OpenAI. Avoid entering sensitive information in chat. Contact fields entered in the dealer-request form go through our lead-delivery service, separately from the AI model. A dealership receives only the request you review and explicitly send, not your full conversation.

We store shopping-assistant conversations on our servers, including messages, vehicle and page context, request drafts, and submission confirmations. Authorized staff may review them to support shoppers and improve the assistant. Conversation content is encrypted in storage and is not sent to website analytics. Each chat expires seven days after its last message or request attempt; viewing a page does not extend it. Expired chats become inaccessible immediately and are removed by scheduled cleanup, normally within an hour. Encrypted backups follow the retention period described below.

A Secure, HttpOnly browser cookie lets you continue without signing in. Local storage under carhandshake.bdc.v2 contains only the selected chat ID and expiry information, not the transcript or its access credential. Anyone using the same browser profile can access its unexpired chats. “New chat” starts a separate conversation; clearing site storage removes this browser’s access, but does not immediately delete server records. Contact us to request deletion. Deleting a chat does not delete requests already delivered to a dealership or records retained by service providers under their applicable terms.

Cloudflare Turnstile processes browser and network security signals to help prevent automated abuse of the assistant and request forms. You can use inventory pages without using the assistant. See Cloudflare’s Privacy Policy for its processing practices.

Technical, reliability, and security data

We process timestamps, request identifiers, AI host or browser family, tool name, success or error status, response time, request and response size, result count, coverage and fallback stage, rate-limit events, consent presence, and security signals. Public MCP analytics use shortened protected hashes for network address and user-agent data rather than storing those raw values. They do not contain a full AI conversation, raw contact values, credentials, authorization tokens, or internal chain-of-thought.

3. Website cookies and analytics

The country selector stores a first-party cookie named ch_country for up to one year. It contains only US or CA. Search-page state stored in browser session storage lasts until the tab or browser session ends or you clear it.

Carhandshake.com uses Google Analytics 4 to measure aggregate website traffic and which parts of the site visitors use. It sets a first-party cookie named _ga and records page addresses, referring source, approximate city-level location derived from IP address, device and browser type, and interactions such as running a search or opening a dealer listing. Google Signals and advertising personalization are turned off, no advertising account is linked, and the measurement is not used to build advertising profiles or track you across other websites. It collects no name, email address, or phone number, and ZIP and postal codes are removed from recorded page addresses.

To opt out of Google Analytics, block or clear site cookies, use browser privacy controls, or install the Google Analytics opt-out browser add-on. Declining analytics does not change core site functionality. Google Analytics data is retained for 14 months.

We also send operational alerts to our team through Telegram when a dealer request is accepted or fails to submit, a dealer listing is opened, its call button is clicked, a car is shared, saved or added to a comparison, or a comparison is viewed. These alerts describe the action and public vehicle and dealership context. They do not include your name, email, phone number, message, search text, or precise location. Website interaction alerts use listing identifiers and the type of page where the action happened, separately from Google Analytics.

4. How and why we use information

We use the information described above to:

  • interpret requests and search, rank, compare, and display public inventory;
  • calculate distance and provide vehicle and dealership details;
  • deliver a dealer request only after the required consent and confirmation;
  • prevent duplicate submissions, abuse, fraud, and security incidents;
  • measure reliability, coverage, latency, and aggregate product usage;
  • debug failures, provide support, enforce our terms, and comply with law; and
  • improve search quality and the safety and usability of the service.

Car Handshake does not use connector data to create a general-purpose profile of your AI conversations and does not use submitted lead contact details to train a general-purpose AI model.

5. When information is shared

  • The selected dealership. A confirmed contact, test-drive, appointment, or trade-in request and its consent record are delivered to that dealership.
  • Dealership service providers. The dealership's configured CRM, email, or lead-routing providers may receive the request for follow-up.
  • Our processors. Infrastructure, security, email, analytics, geocoding, and support providers process data to operate Car Handshake.
  • The AI host you choose. ChatGPT, Claude, Perplexity, or another host processes your prompt, account, model output, and connector invocation under its own terms and privacy notice.
  • Legal and safety disclosures. We may disclose information when required by law or reasonably necessary to protect users, dealerships, our rights, or the service.

Relevant provider notices include OpenAI's Privacy Policy, Anthropic's Privacy Policy, Perplexity's Privacy Policy, Google's Privacy Policy, and AWS's Privacy Notice. Their notices govern their own services; this notice governs Dealer Handshake's processing.

6. Retention

Unless a legal hold or longer period required by law applies, we retain:

  • the ch_country cookie for up to one year and browser session search state until the session ends or you clear it;
  • Google Analytics website data for 14 months;
  • sanitized application, infrastructure, edge, and security logs for 30 days;
  • connector and search telemetry for no more than 90 days;
  • support correspondence for no more than 24 months after the request closes;
  • dealer-contact, appointment, and trade-in request records for no more than 24 months after submission; and
  • consent evidence associated with a dealer request for up to four years after the last related communication, to demonstrate the authorized action and meet legal obligations.

After deletion from active systems, information can remain in encrypted database backups until the 14-day backup lifecycle expires. A dealership controls retention in its own CRM or systems after receiving a request. OpenAI, Anthropic, Perplexity, Google, and other third parties apply their own retention practices to data they process independently.

7. Security

We use encryption, access controls, tenant boundaries, private infrastructure, audit records, rate limits, and monitoring designed to protect information. We minimize tool inputs and responses to what is needed for the requested action. No system is completely secure. See our Support page for vulnerability-reporting instructions.

8. Your choices and privacy rights

You can decline device location, omit optional search details, avoid submitting a dealer request, manage or clear browser storage, opt out of Google Analytics, and decline optional communications. Depending on applicable law, you may request access, correction, deletion, or restriction and may appeal a denied request. We may verify your identity or authority. A dealership may need to handle information already delivered to its systems.

9. Advertising and sale

Car Handshake does not currently sell consumer lead contact details or use them for cross-context behavioral advertising. The first-party analytics cookie described above is used only for aggregate traffic measurement; because Google Signals and advertising personalization are disabled and no advertising account is linked, it is neither a sale of personal information nor a share for cross-context behavioral advertising. Car Handshake does not accept payment to place one matching vehicle above another. If these practices change, we will update this notice and provide legally required choices before the change applies.

10. Children and teens

Car Handshake is not directed to children under 13, and we do not knowingly collect their personal information. Users ages 13 through 17 should use the service with a parent or guardian where applicable law requires it and should not submit dealer-contact details without appropriate permission.

11. Markets and international processing

Car Handshake serves participating dealerships in the United States and supported parts of Canada outside Quebec. Service providers may process information in the United States or other locations where they operate, subject to applicable safeguards. Quebec and dealerships in other countries are not eligible for public search at this time.

12. Changes to this notice

We will update the date above when this notice changes. If a change materially affects how we use personal information, we will provide an appropriate additional notice before the change takes effect where required.

13. Contact

Email privacy questions or requests to support@dealerhandshake.com. Identify the relevant email address, dealership, listing, or request so we can locate the record. Dealer Handshake Inc. is the operator of Car Handshake.