Privacy Policy

1. Who we are and what this policy covers

Effective date: October 15, 2026. Last updated: October 15, 2026.

Carpages.ca is a division of Autopath Technologies Inc. ("Carpages", "we", "us"), 9A-2458 Dundas St West, Mississauga, Ontario, Canada. We are responsible for the personal information we collect and have named a Privacy Officer to oversee compliance (contact details in section 12).

This policy explains how we collect, use, share and protect personal information when you:

• visit dealers.carpages.ca [and www.carpages.ca, help.carpages.ca];
• contact us, request a demo or quote, or sign up for our newsletter;
• become a dealer customer or use our dealer products, including DealerPage+, DealerSite+, DealerEdge+, Carpages.ca advertising, the Carpages.ca Dashboard app, MarketPulse, Background Studio, AutoIntelligence, Image Overlays, Cruise Control, the Facebook Marketplace listing tool and Bill of Sale; and
• interact with us on social media or at events.

"Personal information" means information about an identifiable individual. It includes business contact details when they are used for purposes other than communicating with you about your job or business.

Dealer websites we build and host are operated by each dealer, who publishes its own privacy policy. Section 8 explains our role when dealers enter their customers' information into our products.

2. Personal information we collect

We collect only what we need for the purposes in section 3. Most of it comes from you directly; some is collected automatically when you use our websites and apps.

Swipe to see more →

We do not knowingly collect sensitive information such as health information, and we ask that you not send it to us.

3. How we use personal information

We use personal information only for the purposes below, or for a new purpose we tell you about and, where required, get your consent for.

1. Respond to inquiries, demo and quote requests, and support tickets.
2. Set up, manage, bill and support dealer accounts and products.
3. Publish and syndicate dealer inventory, listings and media as the dealer directs.
4. Operate, secure and fix our websites and apps, and prevent fraud and misuse.
5. Understand how our websites and products are used so we can improve them.
6. Send service messages, such as account notices, billing reminders and product changes.
7. Send marketing messages and show relevant ads, with consent where the law requires it (sections 4 and 5).
8. Meet legal, tax, accounting and regulatory obligations, and establish or defend legal claims.

Some of our products use AI to create or edit content, such as vehicle descriptions and photo backgrounds. We tell users when a feature uses AI. We do not use dealer, customer or partner data to train or fine-tune AI models, and our contracts with AI providers bar them from training on our data.

We do not sell personal information. We do not rent or trade it for others' marketing.

4. Cookies and tracking technologies

Our websites use cookies, pixels, tags and log files. Essential ones run automatically; all others stay off until you turn them on in our cookie banner.

Swipe to see more →

You can change your choice at any time through the Cookie Settings link in the site footer. You can also block or delete cookies in your browser, though some features may stop working. Declining non-essential cookies does not affect your ability to use the site.

In our mobile apps, we collect crash and performance data to keep the app working.

5. Consent and marketing messages

We rely on your consent to collect, use and share personal information, except where the law allows otherwise. We ask for express consent for anything you would not reasonably expect, such as non-essential cookies or marketing to you as an individual.

You can withdraw consent at any time, subject to legal or contractual limits. We will tell you what withdrawing means, for example that we may not be able to provide a service.

We send commercial electronic messages (emails, texts, direct messages) in line with Canada's Anti-Spam Legislation (CASL). We send them only when:

• you have given us express consent, for example by ticking a box or subscribing; or
• we have implied consent, for example you are a current or recent customer, or you asked us about our products within the past six months.

Every marketing message identifies Carpages, includes our contact information and has a working unsubscribe link. We process unsubscribe requests within 10 business days. Unsubscribing from marketing does not stop service messages about your account.

6. Who we share information with

We share personal information only as described here, and only what each recipient needs.

• Service providers who host, run or support our business for us, such as cloud hosting, CRM and marketing automation, email and SMS delivery, analytics, payment processing, customer support and professional advisers. They must protect the information under contract and may use it only to provide services to us.
• Advertising and listing platforms when a dealer directs us to publish or syndicate inventory, for example to Facebook Marketplace or other listing sites.
• Our dealer customers, when you submit a lead or inquiry about a dealer's vehicle through our products.
• Vehicle manufacturers running certified website programs (for example Ford, Toyota or Honda), limited to program reporting.
• A buyer or successor in a sale, merger or financing of all or part of our business, under an agreement to protect the information.
• Authorities or others when the law requires or allows it, for example to comply with a court order, prevent fraud or protect someone's safety.

Our main service providers today are Google Cloud Platform (hosting and storage), Amazon Web Services (backup storage), Twilio SendGrid (email delivery), HubSpot (CRM and marketing), Microsoft 365 (business email and productivity), Google (analytics, ads and reCAPTCHA), Meta (ads), Benji Pays (payments), and Intuit QuickBooks (accounting).

7. Storage and processing outside Canada

Some of our service providers store or process personal information outside Canada, mainly in the United States. While there, it is subject to the laws of that country, and courts, law enforcement or national security authorities there may be able to access it.

Before we transfer personal information outside Canada, or outside Quebec for Quebec residents, we assess whether it will be adequately protected. We use contracts that require the provider to protect it to a standard comparable to Canadian law.

To ask about our providers or how we protect information sent outside Canada, contact our Privacy Officer (section 12).

8. Information dealers enter into our products

When a dealer uses our products to handle its own customers' information, the dealer controls that information and we act as its service provider. Examples include leads from dealer websites, buyer details in a Bill of Sale, and contact form submissions.

In that role, we:

• use the information only to provide our services to the dealer and as our agreement with the dealer allows;
• do not use it for our own marketing or sell it;
• protect it with the safeguards in section 10; and
• return or delete it when the dealer's account ends, subject to legal retention requirements.

If you are a dealer's customer and have questions about your information, or want to access or correct it, please contact the dealer. We will help the dealer respond.

Dealers are responsible for having a lawful basis and any needed consent for information they enter, and for their own privacy policies.

9. How long we keep information

We keep personal information only as long as we need it for the purposes in section 3 or as the law requires. Then we securely delete it or make it anonymous.

Swipe to see more →

If we used your information to make a decision about you, we keep it long enough for you to request access to it.

10. Security and privacy incidents

We protect personal information with safeguards suited to its sensitivity. These include encryption in transit (HTTPS/TLS), encryption at rest, access limited to staff who need it, unique logins with multi-factor authentication, background checks for staff who handle sensitive information, and annual security and privacy training for all staff.

Our security controls are independently audited. Carpages has a SOC 2, Type 2 report issued by an independent CPA firm, covering the Security Trust Services Criteria. Dealers and partners can request a copy of our most recent report, under a confidentiality agreement, from our Privacy Officer.

We also hold our service providers to a high standard. Before we use a provider that handles sensitive information, and at least once a year after, we review its security practices, including its own SOC 2 report where one is available.

No system is completely secure. Please use a strong, unique password for your account and tell us right away if you think it has been compromised.

If a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as PIPEDA requires. For Quebec residents, we will notify the Commission d'accès à l'information where a confidentiality incident presents a risk of serious injury. We keep a record of all breaches and incidents.

11. Your rights

You can ask us to:

• tell you what personal information we hold about you, how we use it and who we have shared it with;
• give you a copy of it;
• correct information that is inaccurate or incomplete;
• withdraw your consent, including for marketing or non-essential cookies; and
• delete information we no longer need or have no legal basis to keep.

Quebec residents also have the right to have information sent to them or another organization in a structured, commonly used technological format (data portability). They can ask us to stop disseminating their information or to de-index links to it, where the law allows.

To make a request, contact our Privacy Officer (section 12). We may need to confirm your identity first. We will respond within 30 days, or tell you if we need more time and why. Requests are free, except we may charge a modest fee for unusually large requests after telling you the cost first. If we refuse a request, we will explain why and how to challenge it.

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada. Quebec residents can also complain to the Commission d'accès à l'information du Québec.

12. Minors, changes and contact

Minors. Our websites and products are for businesses and adults. We do not knowingly collect personal information from anyone under 18. If you believe we have, contact us and we will delete it.

Changes to this policy. We will update this policy when our practices or the law change, and post the new version here with a new "last updated" date. If a change materially affects how we use information we already hold, we will tell you in advance by email or a notice on our site. We will ask for your consent where the law requires it.

Contact our Privacy Officer. For questions, requests or complaints about privacy:

Ben Mirecki, President and Privacy Officer
Carpages.ca, a division of Autopath Technologies Inc.
9A-2458 Dundas St West, Mississauga, Ontario
Email: [privacy@carpages.ca]
Phone: 416-848-0710