Privacy Policy

Effective October 14, 2026

CarPencil (carpencil.com) is software that car dealerships use to prepare vehicle quotes and share them with their customers. It is operated by CarPencil, a U.S.-based company ("we"). This policy explains what information CarPencil handles and why.

Did a dealership send you a quote link? The dealership named on the quote prepared it and sent you the link; we host it for them. Questions about the vehicle, the price, financing, or messages the dealership sends you go to that dealership.

When you open a quote link

The quote itself: what the dealership entered, such as your name, the vehicle and the figures.
That it was opened: the time, and your approximate city, region and country, which our hosting provider derives from your network address. We send this to the salesperson who shared the link so they know you have seen it. We do not store your IP address with it.
The quote page sets no cookies and carries no advertising or analytics trackers. It loads its fonts from Google Fonts and the vehicle photo from the dealership's inventory photo service; those services receive your IP address in order to deliver the file.

Dealership accounts

Account details: email address, name, dealership and role.
Sign-in: the one-time codes we email (stored only as a hash and deleted within a day), and each session's IP address and browser description, kept to secure the account until the session ends (at most 30 days).
Quotes and settings: the pencils a dealership saves (customer name, vehicle, stock number, VIN, figures) and its settings, which may include product cost. A dealership's data is visible only to its own members.
Open alerts: if a user turns on push alerts, the browser's push subscription for that device.
Billing: handled by Stripe. We keep the Stripe customer and subscription references, never card numbers.

How we use it

Only to run CarPencil: signing in, saving and sharing quotes, sending open alerts by email and push notification, billing, and keeping the service secure. We do not sell personal information, and we do not share it with third parties or affiliates for their marketing.

Text messages

CarPencil does not send text messages, and it does not collect mobile phone numbers or consent to receive texts. A dealership may paste a CarPencil link into a text message it sends from its own messaging system; that dealership's messaging program and its own privacy policy govern those messages, including how to opt out.

Service providers

Cloudflare: hosting, database and bot protection (Turnstile).
Resend: delivery of sign-in codes, invitations and open alerts by email.
Stripe: subscription billing.
Google Fonts: web fonts.
Apple, Google and Mozilla push services: open alerts, only on devices where a user turned them on.

How long we keep it

Sign-in codes are deleted within a day and sessions end after 30 days at most. Saved quotes, share links and their open records are kept while the dealership's account is active; a dealership can remove a saved quote from its list at any time. To have a dealership's data, or a quote about you, erased, write to support@carpencil.com. A customer can also ask the dealership that prepared the quote.

Security

Every page is served over HTTPS. Sign-in uses one-time codes instead of passwords, and sessions are held in secure, HTTP-only cookies that can be revoked at any time.

Children

CarPencil is a tool for businesses and is not directed to children under 13.

Changes

If this policy changes, the new version will be posted here with a new effective date.

Contact

CarPencil
support@carpencil.com