Privacy Policy

1. About This Privacy Policy

Canadian Automotive Reality Financial Inc. (“CARF,” “we,” “us,” or “our”) operates CARF Dealer Intelligence, a platform that provides automotive dealers with inventory, customer communication, financing, marketing, media, website, and third-party integration tools.

This Privacy Policy explains what information CARF collects, how it is used, when it may be shared, how it is protected, how long it is retained, and how users may request access to or deletion of their information.

This Privacy Policy applies to the CARF Dealer Intelligence website, portal, mobile applications, dealer websites powered by CARF, and supported third-party integrations, including Google, YouTube, Meta, Facebook Pages, Messenger, and Facebook Marketplace inquiry services.

2. Information We Collect

Depending on the services used, CARF may collect or process:

• Dealer and business information, such as dealership name, address, telephone number, website, dealer number, staff members, and business contact information.
• Account information, such as names, email addresses, account roles, login records, and authentication information.
• Vehicle and inventory information, including vehicle descriptions, photographs, videos, stock numbers, VINs, pricing, mileage, options, and availability.
• Customer and lead information voluntarily provided through forms, applications, messages, telephone calls, dealer staff, or connected services.
• Uploaded content, including photographs, videos, documents, captions, descriptions, and other media.
• Technical and usage information, including browser type, device information, IP address, timestamps, security logs, error logs, and interactions with CARF features.
• Information received from connected third-party platforms where a user has expressly authorized CARF to access that information.

CARF does not ask users to provide their Google, YouTube, Facebook, or Meta account password to CARF. Those connections are authorized through the platform’s own sign-in and permission screens.

3. Google and YouTube API Services

CARF Dealer Intelligence uses Google OAuth and YouTube API Services to allow an authorized dealership user to connect a YouTube channel and upload dealer-selected video content from the CARF portal.

Information processed

When a user connects YouTube, CARF may access or process:

• The connected YouTube channel identifier.
• The channel name and basic channel information.
• Information needed to confirm that the intended channel is connected.
• Video identifiers, titles, descriptions, tags, visibility settings, processing status, and related metadata for videos uploaded through CARF.
• OAuth access tokens and refresh tokens issued by Google.
• Error and status information required to complete, verify, or troubleshoot an authorized upload.

Google OAuth permissions requested

CARF currently requests the following Google OAuth permissions:

• youtube.readonly, used to identify the connected channel, display relevant channel information, and verify uploaded video information.
• youtube.upload, used only when an authorized user expressly selects and submits a video for upload to the connected YouTube channel.

Google may grant a subset of the permissions requested. CARF confirms the permissions actually granted before enabling features that depend on them.

How the information is used

CARF uses this information to:

• Authenticate and maintain the dealer-authorized YouTube connection.
• Clearly identify the connected YouTube channel.
• Upload a video selected by an authorized dealer user.
• Transmit the title, description, tags, category, audience selection, visibility selection, and other upload settings selected or confirmed by the user.
• Confirm whether the upload was accepted and processed by YouTube.
• Display the resulting video information and link to the authorized dealer.
• Diagnose connection or upload errors.

CARF will not upload a video without an authorized user initiating or expressly confirming the upload. A video is uploaded only to the YouTube channel that the dealership connected, and CARF applies the visibility setting the dealership has saved for its channel unless a different visibility is submitted with that upload.

What CARF does not do with Google or YouTube data

CARF does not use Google or YouTube API data to:

• Sell personal information.
• Create advertising profiles.
• Deliver targeted advertising.
• Make credit, financing, insurance, warranty, or lending decisions.
• Transfer information to data brokers.
• Train a general-purpose artificial intelligence or machine-learning model.
• Upload, modify, or delete content without the user’s knowledge and authorization.

Who YouTube information is disclosed to

YouTube information is disclosed only:

• To Google and YouTube as required to perform the action requested by the user.
• To service providers acting on CARF’s instructions to host, secure, maintain, or support the CARF platform.
• Where required by law or necessary to protect users, CARF, or the security of the platform.

Service providers are not permitted to use Google or YouTube user data for their own advertising, data-broker, profiling, or unrelated commercial purposes.

Google and YouTube data retention

CARF may retain OAuth authorization tokens for as long as the connection remains active and they are required to provide the authorized service. Tokens are stored encrypted and are never returned to a dealer-facing browser.

When a user disconnects YouTube through the CARF portal, CARF immediately deactivates the stored authorization so that it can no longer be used to reach the channel, disables the connection, and clears the saved channel association.

Users may revoke CARF’s Google access at any time through their Google Account permissions page, which immediately ends CARF’s ability to access the connected channel:

• https://security.google.com/settings/security/permissions

Users may also request deletion of the YouTube API information CARF holds, and CARF will delete it after verifying the request, through:

• https://www.carfii.com/data-deletion/

Deleting data stored by CARF does not delete videos or other information stored in the user’s YouTube account. Content stored by YouTube must be deleted through YouTube or another application authorized to delete that content.

4. Meta, Facebook, Messenger, and Marketplace Inquiry Integrations

CARF Dealer Intelligence may allow a dealership to connect a Facebook Page and related Meta messaging services so that inquiries sent to the dealership’s Page can be received and answered by dealership staff inside CARF.

Where approved and made available by Meta, CARF may receive inquiries associated with a connected Facebook Page, Messenger conversation, advertisement, vehicle listing, or Facebook Marketplace interaction.

Information processed

Depending on the permissions approved by Meta and enabled for the dealership, CARF may process:

• Facebook Page identifiers and Page names.
• Page access tokens and connection status information.
• Meta sender-scoped or Page-scoped user identifiers. CARF stores these identifiers as one-way hashes rather than as the raw identifiers supplied by Meta.
• Message text sent to the connected Page, together with the number and type of any attachments included in a message. CARF does not store the attached image, audio, video, or file content itself.
• Message timestamps and delivery or read-status events where available.
• Vehicle listing, advertisement, catalogue, inventory, or conversation context supplied by Meta.
• Contact information, vehicle preferences, financing questions, trade-in details, and other information voluntarily included by the person in a conversation.
• Webhook events and technical information required to receive, route, secure, and troubleshoot messages.

Before message text is stored, CARF automatically redacts patterns that look like payment card numbers, Social Insurance Numbers, or authorization tokens. CARF does not request a person’s Facebook profile information from Meta.

How the information is used

CARF uses Meta Platform Data only to provide dealer-authorized features, including:

• Connecting and verifying the dealership’s Facebook Page.
• Receiving messages delivered by Meta to the connected Page.
• Displaying the conversation to authorized dealership staff.
• Identifying the relevant vehicle or inventory listing.
• Preparing a suggested reply for a member of the dealership’s staff to review.
• Answering inventory, dealership, financing-process, appointment, and availability questions using information approved by the dealer.
• Collecting and routing a lead to the connected dealership.
• Allowing dealership staff to review, continue, or take over a conversation.
• Maintaining conversation history and operational records for the dealer.
• Detecting abuse, securing accounts, resolving errors, and complying with legal obligations.

AI-assisted messages

Where the dealership has enabled AI assistance, message content and relevant dealer-approved inventory or dealership information may be processed to generate a suggested reply.

CARF’s Meta integration currently receives and stores messages and prepares suggested replies for a person at the dealership to review. It does not deliver messages back through the connected Facebook Page. Replies are sent by dealership staff using Facebook, Messenger, or the Meta tools available to the Page. This Privacy Policy will be updated before any automated reply delivery is enabled.

CARF may use contracted technology providers to process this information solely to operate the requested feature. CARF does not authorize those providers to sell the information, use it for independent advertising, create unrelated user profiles, or train general-purpose models using Meta Platform Data.

AI-generated suggestions may contain mistakes. Dealers are responsible for configuring the feature, reviewing its output before using it, keeping dealership and inventory information current, and handling conversations where human assistance is appropriate.

What CARF does not do with Meta Platform Data

CARF does not use Meta Platform Data to:

• Sell personal information.
• Transfer information to data brokers.
• Build advertising profiles unrelated to the connected dealership interaction.
• Target unrelated third-party advertising.
• Make automated credit, financing, lending, insurance, or warranty eligibility decisions.
• Discriminate against individuals.
• Contact users outside the communication permissions and timeframes allowed by Meta.
• Reward or incentivize users for Facebook or YouTube interactions.
• Send unsolicited bulk or deceptive messages.

Meta data sharing

Meta Platform Data may be shared only:

• With the dealership whose connected Page received the communication.
• With authorized dealership staff.
• With Meta where required to send or receive the requested communication.
• With service providers operating under CARF’s instructions to host, secure, maintain, or support the CARF platform.
• Where required by law or necessary to protect users, CARF, or the security of the service.

CARF does not share one dealership’s Meta conversations or leads with another dealership unless the affected user and dealer have expressly authorized that transfer.

Meta data retention and deletion

CARF retains Meta Platform Data only for as long as reasonably necessary to provide the dealer-authorized messaging, lead-management, security, contractual, and legal functions described in this Privacy Policy. Suggested replies generated for staff review are retained for 30 days.

When a Facebook or Meta connection is disconnected, CARF stops using the applicable access token to receive new messages and removes the Platform Data that CARF is no longer legally or operationally required to retain.

When Meta or a user sends a valid deletion request, CARF will delete the applicable Platform Data promptly after verifying the request and as soon as reasonably possible.

Users may request deletion at:

• https://www.carfii.com/data-deletion/

Removing CARF’s stored information does not automatically delete messages, posts, listings, advertisements, or other content retained by Facebook, Meta, the connected dealership, or another authorized recipient.

5. How We Share Information

CARF does not sell personal information.

CARF may share information with:

• The dealer or business account responsible for the user’s transaction, inquiry, application, or communication.
• Authorized employees and contractors who need the information to provide the requested service.
• Cloud hosting, communications, document, security, analytics, payment, artificial intelligence, and technology providers operating under contractual restrictions.
• Google, YouTube, Meta, Facebook, and other connected services when required to perform an action authorized by the user.
• Regulators, courts, law-enforcement authorities, or other parties where disclosure is required by law.
• A purchaser or successor in connection with a legitimate corporate transaction, subject to applicable privacy obligations.

CARF requires service providers to process information only for authorized purposes and to apply appropriate confidentiality and security protections.

6. Security

CARF uses administrative, technical, and organizational safeguards designed to protect information against unauthorized access, use, alteration, disclosure, or destruction.

These measures may include access controls, role-based permissions, encrypted network communications, protected credential storage, logging, monitoring, backups, and restrictions on employee and service-provider access.

No electronic system is completely secure. CARF cannot guarantee absolute security, but it will take reasonable steps to protect information and respond to identified security incidents.

OAuth access tokens and refresh tokens are stored encrypted and are not intentionally exposed to dealer-facing browsers, public source code, or public logs.

7. Retention

CARF retains information only for as long as reasonably necessary to:

• Provide the requested services.
• Maintain the dealer account and integrations.
• Complete transactions and support requests.
• Protect the security and integrity of the platform.
• Maintain legally required records.
• Resolve disputes and enforce agreements.

Different information may be subject to different retention periods.

Where Google, YouTube, Meta, or another platform requires a shorter refresh, retention, or deletion period, CARF will apply the platform-specific requirement.

8. Access, Correction, Withdrawal of Consent, and Deletion

Subject to applicable law, individuals may request:

• Access to personal information held by CARF.
• Correction of inaccurate information.
• Withdrawal of consent.
• Disconnection of a third-party integration.
• Deletion of eligible personal information.
• Information about how their data has been used or disclosed.

Requests may be submitted through:

• https://www.carfii.com/data-deletion/

or by contacting credit@carfii.com.

CARF may need to verify the identity and authority of the person making the request before providing access to or deleting information.

Some information may be retained where required by law, needed to prevent fraud or abuse, required to complete a transaction, or necessary to establish, exercise, or defend a legal claim.

9. Cookies and Similar Technologies

CARF may use cookies, local storage, session storage, and similar technologies to authenticate users, maintain sessions, remember preferences, secure the platform, measure performance, and improve functionality.

Third-party services may set their own cookies or use similar technologies according to their own privacy policies.

10. International Processing

CARF and its service providers may process information in Canada, the United States, the European Union, or other jurisdictions where CARF or its providers operate.

Information processed outside a user’s jurisdiction may be subject to the laws of the country where it is processed.

11. Children

CARF Dealer Intelligence is a business platform intended for automotive dealerships and adult users. It is not directed to children.

Videos uploaded to YouTube through CARF are submitted as content that is not made for children. Dealers must not use CARF to upload content that is directed to children, and remain responsible for correcting the audience setting in YouTube Studio and for complying with all applicable child-protection requirements.

12. Changes to This Privacy Policy

CARF may update this Privacy Policy to reflect changes in law, platform requirements, technology, or business practices.

The updated policy will be posted on this page with a revised “Last updated” date. Where required, CARF will provide additional notice or obtain consent before materially changing how previously collected information is used.

13. Contact

Questions, privacy concerns, and data requests may be directed to:

Canadian Automotive Reality Financial Inc.
CARF Dealer Intelligence
Email: credit@carfii.com