Privacy Policy

This policy explains what personal information Car Shepherd collects, why we collect it, how we use it, and what your rights are. Car Shepherd is operated by Kenneth Finnbogason, a sole proprietor based in Vancouver, British Columbia, Canada.

We comply with the British Columbia Personal Information Protection Act (PIPA) and the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

1. What we collect

We collect only what we need to provide our service and operate our business. The specific information depends on how you interact with us.

If you visit our website:

• Standard web server logs (IP address, browser type, pages visited, referral source). These are used for debugging, security, and aggregate analytics.
• Cookies and similar technologies only if enabled by third-party tools like Vercel Analytics or any advertising platforms we connect. We do not use cookies for cross-site tracking on our own.

If you book an intake call:

• Your name, email address, phone number (if provided), and any information you share in the Calendly booking form. This is collected and stored by Calendly under their own privacy policy.

If you purchase an engagement:

• Your name, email, and billing details. Payment card details are handled directly by Stripe and are never stored by us.
• During the engagement: your vehicle preferences, budget, location, commute details, family/household context relevant to your vehicle need, and any documents or correspondence you share (for example, existing listings you're considering, inspection reports, trade-in details).

2. Why we collect it

• To deliver your engagement. We need to understand your needs to produce a useful buying brief, listings, and pricing guidance.
• To process payment and issue receipts. Handled by Stripe.
• To communicate with you. Email and, if you provide a number, occasional text messages about your active engagement.
• To coordinate with third parties on your behalf, with your consent (for example, briefing an inspection shop).
• To comply with legal obligations (tax records, business records retention).
• To improve our service. Aggregated, de-identified information may inform how we run future engagements.

3. Who we share it with

We do not sell personal information. We share only with service providers necessary to operate, and only what they need:

• Stripe (payments). Handles billing information; see stripe.com/privacy.
• Calendly (intake call scheduling). Handles booking information; see calendly.com/privacy.
• Vercel (website hosting). Handles web analytics and server logs; see vercel.com/legal/privacy-policy.
• Google Workspace / Gmail (email). Handles correspondence; see policies.google.com/privacy.
• Advertising platforms (Meta, Google) if we run ad campaigns. These platforms may receive anonymized conversion events (e.g., "someone booked a call") but never personally identifying information from us.
• Third parties you ask us to contact on your behalf, such as an inspection shop, with your consent.

Some of these providers may store or process data outside Canada (primarily in the United States). British Columbia's PIPA permits this, and the providers above have their own privacy commitments, but you should know it happens.

We will disclose personal information if legally required to do so (for example, under a court order or in response to a tax audit).

4. How long we keep it

• Active engagement data: kept for the duration of your engagement and for 90 days after, in case of follow-up questions.
• Transaction records: kept for seven years, as required by Canadian tax law.
• Email correspondence: kept for up to two years, then archived or deleted.
• Website logs and analytics: typically kept for 30–90 days depending on the provider's own retention policy.

You may request earlier deletion of your information at any time (see Section 6 below). Some information must be retained even after deletion requests in order to meet legal obligations.

5. How we protect it

• We use reputable service providers with their own security practices.
• Email and documents are stored within Google Workspace with two-factor authentication.
• Payment data is tokenized by Stripe and never touches our systems.
• Access to your information is limited to the people necessary to deliver your engagement (currently, just the operator).

No system is perfectly secure. If a data breach occurs that affects you, we will notify you and the British Columbia Office of the Information and Privacy Commissioner as required by law.

6. Your rights

Under British Columbia PIPA and federal PIPEDA, you have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate or incomplete.
• Withdraw consent for us to use your information, subject to legal or contractual limitations.
• Request deletion of your information, subject to our legal obligation to retain certain records.
• Make a complaint to the British Columbia Office of the Information and Privacy Commissioner if you believe we have mishandled your information. Their contact details are at oipc.bc.ca.

To exercise any of these rights, email hello@carshepherd.ca. We will respond within 30 days.

7. Children

Our service is not directed at individuals under the age of 19 (the age of majority in British Columbia). We do not knowingly collect personal information from minors. If you believe we have done so, contact us and we will delete it.

8. Changes to this policy

We may update this policy from time to time. The current version is always posted at carshepherd.ca/privacy with an updated date. If we make material changes that affect how we handle existing customer information, we will notify active clients by email.

9. Contact

Questions about this policy, or to exercise any of your rights above: hello@carshepherd.ca