Legal
Privacy Policy
This Privacy Policy (“Policy”) describes how Soulvaya Labs, Inc., doing business as Carlarity (“Carlarity,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects personal information in connection with the Services (as defined in our Terms of Service). We have written this Policy to be clear and practical. If you have any questions, please contact us at [email protected].
Effective Date: September 21, 2026
1. Introduction
Carlarity is an independent, buyer-paid vehicle decision-support service. To operate the Services, we collect and process certain information about you, your account, your vehicles, and your deals. This Policy explains what we collect, how we use it, when we disclose it, and the choices and rights you have.
This Policy is incorporated into and forms part of our Terms of Service.
2. Scope
This Policy applies to personal information collected through:
- the Carlarity website at getcarlarity.com (and the redirect domain carlarity.io) and any successor or related domains;
- the Carlarity web application;
- any current or future Carlarity mobile application;
- Carlarity Reports (including PDF reports) and report generation flows;
- payment and checkout flows;
- account creation, sign-in, and management;
- support communications (email, contact forms, and any future chat features);
- analytics performed in connection with the Services; and
- any other current or future interaction with Carlarity products or services.
This Policy does not apply to information collected by third parties through their own websites, services, or applications, even if linked to or from the Services. Please review the privacy policies of those third parties separately.
3. Personal Information We Collect
We collect the following categories of personal information.
3.1 Account Information
Information you provide when creating or managing your account, including: name, email address, password or authentication credential, account settings, account-status data, and verification or anti-fraud signals.
3.2 Vehicle and Deal Information
Information you provide to generate or refine a Carlarity Report, including: vehicle identification number (VIN); year, make, model, trim, and other identity fields; mileage; ZIP code or geographic location; purchase price or asking price; transaction type (dealer purchase, private sale, online retailer, etc.); annual percentage rate (APR), loan term, down payment, monthly payment, and other financing terms; trade-in details; dealer fees, taxes, add-ons, and other deal line items; manual-entry vehicle identity fields when VIN data is incomplete; saved-report history; Carlarity Garage / “My Car” entries; and other deal-specific or vehicle-specific information.
3.3 Payment Information
Payment status, transaction identifiers, billing email or address, and limited payment-method metadata. Carlarity does not store full payment card numbers on its own systems. Full payment-method data is collected and stored by our payment processor, Stripe, Inc., in accordance with PCI-DSS standards.
3.4 Device and Usage Information
When you use the Services, we automatically collect: IP address, browser type and version, operating system, device identifiers, referring URL, pages viewed, clicks, navigation paths, session timestamps, log files, error reports, and other technical event data.
3.5 Cookies, Pixels, and Similar Technologies
Cookies, web beacons, pixels, software development kits (SDKs), local storage, and similar technologies used for authentication, analytics, fraud prevention, and performance measurement. With your consent, Carlarity also uses advertising and measurement cookies set by the vendors listed in Section 7. Without your consent none of them are set. See Section 7 for details and controls.
3.6 Communications
Information you provide when contacting our support team at [email protected], completing a contact form, responding to a survey, replying to an email, or otherwise communicating with Carlarity, including the content and metadata of those communications.
3.7 Location Information
ZIP code (provided by you for Report localization) and approximate geographic location derived from IP address. Carlarity does not collect precise GPS-level location.
3.8 Generated Report Data
The outputs of the Carlarity Pre-Signature Intelligence™ Systems for your reports, including verdicts, scores, confidence labels, target deals, ranges, depreciation projections, equity timelines, fee detections, recommendations, negotiation scripts, PDF binaries, and Report metadata.
3.9 Marketing Data
Email-engagement metrics (opens, clicks), referral source, UTM and campaign parameters, A/B test cohort assignments, and similar marketing-analytics data.
3.10 Inferences
Information that Carlarity derives from the data above to operate, secure, and improve the Services, including buyer-mode signals, segment assignments, and propensity scores. We do not use inferences to make automated decisions that have legal or similarly significant effects on you.
3.11 Information We Do Not Knowingly Collect
We do not knowingly collect information from individuals under eighteen (18). We do not collect government-issued identification numbers, Social Security numbers, biometric identifiers, precise geolocation, or health information through the Services. We do not knowingly collect special categories of personal information beyond what is necessary to provide the Services.
4. Sources of Information
We collect personal information from the following sources:
- directly from you, when you create an account, enter vehicle and deal data, contact support, complete a purchase, respond to a communication, or otherwise interact with the Services;
- automatically, through cookies, pixels, SDKs, and similar technologies, when you use the Services;
- from third-party data providers with which Carlarity has data licensing relationships, including VehicleDatabases, MarketCheck, NHTSA vPIC, NHTSA Recalls, and FuelEconomy.gov / EPA;
- from public and government sources, such as NHTSA vPIC, NHTSA recalls, and FuelEconomy.gov / EPA data;
- from Stripe, Inc. (our payment processor) and other service providers acting on Carlarity’s behalf; and
- from analytics providers (including Sentry for error monitoring) that help us understand and improve the Services.
5. How We Use Information
We use personal information for the following purposes:
(a) Provide the Services — generate Reports; decode VINs; resolve vehicle identity; compute valuations, financing estimates, depreciation curves, equity timelines, ownership cost projections, and recommendations; render PDFs; and maintain saved reports and Carlarity Garage entries.
(b) Operate accounts — create and manage accounts; authenticate sign-ins; enable saved-report access; manage entitlements and tier features.
(c) Process payments — process and confirm purchases; manage refunds; prevent chargebacks; and maintain transactional records.
(d) Provide support — respond to your questions, requests, and complaints sent to [email protected].
(e) Improve the Services — analyze usage; debug; develop new features; test improvements; refine confidence scoring; tune model accuracy.
(f) Secure the Services — detect, prevent, investigate, and respond to fraud, abuse, unauthorized access, security incidents, and Terms-of-Service violations.
(g) Comply with law — meet legal, regulatory, audit, tax, and law-enforcement obligations; respond to lawful requests; and exercise or defend legal rights.
(h) Communicate with you — deliver Service Communications; deliver marketing communications (subject to opt-out); deliver beta-program communications, surveys, and feedback requests.
(i) Personalize experience — tailor content, recommendations, and Report views to your context and household.
(j) Analytics and measurement — measure engagement, conversion, retention, and Report-quality metrics; conduct A/B and multivariate tests.
(k) Measure our own accuracy — Where you tell us what you actually paid for a vehicle, we compare that figure with the estimate in your report to measure and improve how accurate our estimates are. We use this only for internal quality measurement. Answering is optional, nothing in your report depends on it, and we do not sell or license this information.
(l) Corporate transactions — evaluate, conduct, and consummate mergers, acquisitions, financings, reorganizations, divestitures, or asset sales.
6. Third-Party Data Providers
To generate Reports, Carlarity sends limited vehicle and deal information — such as VIN, mileage, ZIP code, and trim — to third-party data providers and public sources, including: VehicleDatabases, MarketCheck, NHTSA vPIC, NHTSA Recalls, and FuelEconomy.gov / EPA. Those providers return data that Carlarity processes into the Report.
Third-party data providers may collect, use, and retain information in accordance with their own privacy practices. We select providers we believe have adequate safeguards in place, but we do not control providers’ independent practices. If you interact with a provider directly (for example, through a link to a provider’s website), the provider’s privacy policy governs that interaction.
7. Cookies and Tracking Technologies
7.1 Categories
Carlarity uses the following categories of cookies and similar technologies:
- Strictly necessary — required to operate the Services (authentication, session, fraud prevention, security). These cannot be disabled.
- Functional — remember your preferences, language, and Report-view settings.
- Analytics — measure how the Services are used. Carlarity collects usage events through its own first-party analytics, stored on Carlarity systems, and uses Sentry for error and performance monitoring. With your consent we also use Google Analytics 4 (loaded through Google Tag Manager) to measure how the Services are used.
- Advertising and measurement — only with your consent, cookies and pixels from Google (Tag Manager, Analytics 4, Ads), Meta (Facebook and Instagram), TikTok, Reddit measure whether our advertising led to a purchase. They are not set until you choose Accept in the consent control, and you can withdraw at any time through Privacy choices in the footer.
7.2 Your Choices
You can manage cookie preferences through:
- the consent control we display when you first visit the Services, and the Privacy choices link in the footer, which lets you change your choice at any time;
- the Global Privacy Control browser signal, which we honor as a decline of advertising and measurement cookies;
- your browser settings (e.g., block, delete, or limit cookies); and
- the opt-out mechanisms described in Section 13 (State Privacy Rights).
When you first visit, a consent control lets you accept or decline advertising and measurement cookies; declining is one tap and changes nothing about how your Report works. You can change your choice at any time via Privacy choices in the footer.
Note that disabling strictly necessary cookies will prevent the Services from functioning correctly.
7.3 Cookies We and Our Vendors Set
| Cookie | Set by | Purpose | Lifetime | Consent |
|---|---|---|---|---|
| carlarity_attr | Carlarity (first-party) | remembers which campaign, referral or promotion code brought you here (first and most recent visit) so a purchase can be attributed | 30 days | not required (functional and analytics); disclosed here |
| carlarity_consent_v1 (browser storage) | Carlarity | your consent choice and when you made it | until cleared | n/a |
| _ga, _ga_* | Google Analytics 4 | usage measurement | up to 14 months | required |
| _gcl_* | Google Ads | conversion attribution | 90 days | required |
| _fbp, _fbc | Meta | advertising attribution | 90 days | required |
| _ttp | TikTok | advertising attribution | 13 months | required |
| _rdt_uuid | advertising attribution | 90 days | required |
8. How We Disclose Information
We may disclose personal information to the following categories of recipients, subject to appropriate confidentiality and use restrictions:
(a) Service providers — vendors that perform services on our behalf under contract, including cloud hosting, infrastructure, payment processing (Stripe, Inc.), email delivery (Resend), customer support, analytics (Sentry), fraud prevention, and security.
(b) Data providers — third-party data providers that supply vehicle, market, recall, or related data necessary to generate Reports (VehicleDatabases, MarketCheck, NHTSA, FuelEconomy.gov / EPA, and search-augmented open-web sources).
(c) Payment processors — Stripe, Inc., to process purchases and refunds and prevent payment fraud.
(d) Analytics and advertising-measurement partners — to measure and improve the Services; with your consent, Google (Tag Manager, Analytics 4, Ads), Meta (Facebook and Instagram), TikTok, Reddit (see Section 7).
(e) Affiliates — to Carlarity affiliates, parents, or subsidiaries, subject to this Policy.
(f) Legal and compliance recipients — to courts, regulators, law-enforcement, or other governmental authorities to comply with subpoenas, court orders, lawful requests, or applicable law; to enforce our Terms; to protect the rights, safety, or property of Carlarity, users, or others; or to respond to suspected fraud or abuse.
(g) Successors in a business transaction — in connection with a merger, acquisition, reorganization, financing, asset sale, bankruptcy, or similar corporate transaction.
(h) With your consent or at your direction — when you instruct us to share information (for example, by forwarding a Report to a spouse, lender, mechanic, or advisor).
(i) Other parties for fraud prevention and security — to protect Carlarity, users, and the public against fraud, abuse, or harm.
9. Sale of Personal Information; Sharing for Cross-Context Behavioral Advertising
Carlarity does not sell personal information for money.
With your consent, Carlarity shares limited, pseudonymous conversion data with Google (Tag Manager, Analytics 4, Ads), Meta (Facebook and Instagram), TikTok, Reddit to measure advertising: a purchase event, the amount, a browser identifier set by the vendor’s cookie, and — where you consented — your IP address and browser type. We do not share your name or email address. Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”), or comparable state privacy laws, this may be a “share.” You can opt out at any time via Privacy choices in the footer or the Global Privacy Control browser signal.
We do not sell or share information about children under sixteen (16) without affirmative consent as required by law.
10. Targeted Advertising / Cross-Context Behavioral Advertising
With your consent, Carlarity measures its advertising on the platforms named in Section 7 and may show you its own advertising on those platforms based on your visit (retargeting). The Privacy choices link in the website footer is the opt-out and also serves as the “Do Not Sell or Share My Personal Information” control; the Global Privacy Control browser signal is honored as an opt-out.
11. Data Retention
We retain personal information for as long as needed to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. Specific retention periods vary by category:
| Category | Retention period |
|---|---|
| Account information | For the life of the account, plus a thirty (30) day soft-delete wind-down period |
| Reports and Report metadata | For the life of the account, unless the user deletes them |
| Payment records | Seven (7) years to comply with tax, accounting, and anti-fraud obligations |
| Communications and support tickets | Two (2) years from last contact |
| Cookies and device data | Per cookie expiration; analytics typically up to fourteen (14) months |
| Security and audit logs | Twelve (12) to twenty-four (24) months |
| Legal-hold data | For the duration of the legal requirement |
When personal information is no longer needed for the purposes for which it was collected, we will delete, anonymize, or de-identify it in accordance with our retention schedule and applicable law.
12. Security
Carlarity maintains reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These safeguards include encryption in transit, access controls, audit logging, incident response procedures, and vendor security review.
No security program is perfect. Carlarity cannot guarantee the absolute security of personal information. You can help protect your account by using a strong, unique password, enabling any available multi-factor authentication, signing out of shared devices, and notifying us promptly at [email protected] of suspected unauthorized access.
13. Your Choices and Privacy Rights
You have the following choices regarding your personal information:
- Access and update — review or update your account information at any time through your account settings, or by contacting [email protected].
- Delete account — request account deletion at any time through your account settings at getcarlarity.com/account/settings or by contacting [email protected]. Certain data may be retained as described in Section 11. Account deletion triggers a hard-delete cascade across our user records and associated Stripe customer profile.
- Marketing opt-out — unsubscribe from marketing emails using the link in the message, or by contacting [email protected]. You will continue to receive Service Communications necessary to operate the Services.
- Cookies and advertising — manage cookies through your browser settings (Section 7); withdraw advertising and measurement consent at any time via Privacy choices in the footer (Section 10).
- State privacy rights — exercise the rights described in Section 14, subject to applicable verification.
To submit a privacy request, please visit getcarlarity.com/privacy-request or email [email protected].
14. State Privacy Rights
Depending on where you reside, you may have the following rights under applicable state privacy laws (including California’s CCPA/CPRA, Virginia’s CDPA, Colorado’s CPA, Connecticut’s CTDPA, Utah’s UCPA, and other comparable state laws). Carlarity honors these rights consistent with each applicable state’s law.
| Right | Description |
|---|---|
| Right to know / access | Request confirmation that we process your personal information and, where applicable, a copy of that information. |
| Right to correct | Request correction of inaccurate personal information we maintain about you. |
| Right to delete | Request deletion of personal information we have collected about you, subject to legal and operational exceptions. |
| Right to opt out of sale / share | Direct us not to “sell” or “share” personal information (as those terms are defined under applicable law). Carlarity does not sell personal information; consented advertising measurement may be a “share” — use Privacy choices in the footer or the Global Privacy Control signal to opt out. |
| Right to opt out of targeted advertising | Direct us not to use your information for cross-context behavioral advertising. Use Privacy choices in the footer or the Global Privacy Control signal. |
| Right to limit use of sensitive personal information | Where applicable, limit the use or disclosure of sensitive personal information beyond what is necessary to provide the Services. |
| Right to non-discrimination | Exercise privacy rights without receiving discriminatory treatment. |
| Right to appeal | Where required by state law, appeal a denial of a privacy request by emailing [email protected] with the subject “Privacy Appeal.” |
| Authorized agent | Designate an authorized agent to submit requests on your behalf, subject to verification. |
Verification. We will verify your identity before responding to a request, typically by matching information you provide against information already in our records. For deletion or access requests, we may require additional verification proportionate to the sensitivity of the request.
Submitting a Request. Submit privacy requests via getcarlarity.com/privacy-request or by emailing [email protected]. We will respond within the timeframe required by applicable law (typically 45 days, extendable once by 45 days for complex requests).
15. California Notice at Collection
In addition to the rights described in Section 14, California residents are entitled to the following notice at collection:
| Category of personal information collected | Purposes | Retention | Sold or shared? |
|---|---|---|---|
| Identifiers (name, email, IP, device IDs, account ID) | Provide and operate the Services; security; communications | See Section 11 | No |
| Vehicle and deal information (VIN, mileage, ZIP, price, financing terms) | Generate Reports; provide Services; improve accuracy | See Section 11 | No |
| Purchase outcome (whether you bought, and what you paid, if you tell us — optional) | Measure and improve the accuracy of our estimates (internal quality measurement only) | See Section 11 | No |
| Payment information (transaction status, billing email; full card data held by Stripe) | Process payments; prevent fraud | See Section 11 | No |
| Internet or other network activity (logs, clicks, sessions) | Operate, secure, and improve the Services; analytics | See Section 11 | No |
| Geolocation (ZIP code, approximate IP-based location) | Localize Reports; market analysis | See Section 11 | No |
| Audio, electronic, visual, or similar information (support emails, feedback) | Provide support; improve Services | See Section 11 | No |
| Inferences derived from above (buyer-mode signals, segment) | Operate and improve the Services | See Section 11 | No |
| Sensitive personal information | Carlarity does not knowingly collect sensitive personal information beyond what is necessary to provide the Services. | N/A | No |
We do not knowingly sell or share personal information of consumers under sixteen (16) years of age.
15.1 California "Shine the Light" (Cal. Civ. Code §1798.83)
California residents may request information about the categories of personal information (if any) that Carlarity shared with third parties for those third parties' own direct marketing purposes during the preceding calendar year. As of the Effective Date, Carlarity does not share personal information with third parties for their own direct marketing purposes. If this practice changes, we will update this disclosure and comply with §1798.83's notice and response requirements. To submit a Shine the Light request, email [email protected] with “Shine the Light Request” in the subject line.
15.2 Business Purposes for Disclosure
For the categories of personal information described in Section 15, Carlarity discloses information to service providers, data providers, payment processors, and other recipients described in Section 8 solely for the following CCPA business purposes: (a) providing and operating the Services; (b) processing payments and preventing payment fraud; (c) generating Carlarity Reports using licensed data-provider inputs; (d) providing customer support; (e) securing the Services, detecting fraud, and responding to security incidents; (f) auditing, debugging, and improving Service quality; (g) complying with legal obligations; and (h) short-term, transient use consistent with the context in which you provided the information. Carlarity does not authorize service providers to use personal information for their own purposes beyond those necessary to perform the contracted service.
15.3 Right to Opt Out of Automated Decision-Making
Under CPRA §1798.185(a)(16) and forthcoming California regulations, California residents may have the right to opt out of certain automated decision-making that has legal or similarly significant effects. Carlarity does not use automated decision-making to produce legal or similarly significant effects on any user. Carlarity Reports are decision-support tools intended to inform your independent judgment; Report outputs (verdicts, scores, confidence labels, target prices, recommendations) do not constitute automated decisions about you, do not determine your access to Services, and do not affect your legal rights, credit, employment, insurance, or eligibility for any product or service. If Carlarity's use of automated decision-making changes in the future, we will update this disclosure and provide any opt-out mechanism required by applicable California regulations.
16. Children’s Privacy
The Services are not directed to, and Carlarity does not knowingly collect personal information from, children under eighteen (18). Carlarity does not knowingly collect personal information from any individual under the age of thirteen (13) in violation of the Children’s Online Privacy Protection Act (COPPA). If you believe a child has provided personal information to Carlarity, please contact [email protected] and we will take appropriate action to delete it.
17. International Users
The Services are intended for users located in the United States. Carlarity stores and processes personal information in the United States. If you access the Services from outside the United States, you understand that your information may be transferred to, processed in, and stored in the United States, which may have data-protection laws different from those of your jurisdiction. Where applicable, Carlarity relies on appropriate safeguards for such transfers.
18. Third-Party Links and Services
The Services may contain links to third-party websites, services, dealers, lenders, manufacturers, government databases, or data providers. Carlarity does not control, and is not responsible for, the privacy practices of those third parties. We encourage you to review their privacy policies before providing information.
19. SMS and Text Messaging Privacy
Carlarity does not currently send SMS or text messages. If Carlarity introduces SMS communications in the future, separate program-specific terms and privacy disclosures will apply at the time of opt-in.
20. Beta Privacy Notice
The Carlarity Garage (also referenced as “My Car”) is offered as a Beta feature. During the beta period for Garage, Carlarity may collect additional diagnostic, telemetry, and usability information necessary to debug, improve, and refine the feature. We use this information solely to operate and improve the Services. We do not use beta diagnostic data to make automated decisions affecting your account beyond debugging and quality improvement.
21. Changes to This Privacy Policy
We may update this Policy from time to time. The “Effective Date” at the top of the Policy indicates when it was most recently revised. Material changes will, where feasible, be communicated by email or in-product notice. Your continued use of the Services after the Effective Date of an updated Policy constitutes acceptance of the updated Policy.
22. Contact
For questions, requests, or complaints regarding this Privacy Policy or Carlarity’s privacy practices, please contact us at:
Soulvaya Labs, Inc.
d/b/a Carlarity
Attn: Privacy
131 Continental Drive, Suite 305
Newark, Delaware 19713
Email: [email protected]
For the contractual frame around using the service, see the Terms of Service. For what a Carlarity report is and isn’t, see the Disclaimer.