Privacy Policy

Codonca Inc. (“Codonca,” “we,” “us,” or “our”) is a Florida-based licensed motor vehicle dealer operating a salvage vehicle analytics platform at codonca.com (the “Platform”). We are committed to protecting your privacy and being transparent about how we collect, use, and safeguard your personal information.

This Privacy Policy explains our practices regarding the information we collect when you visit our Platform, create an account, purchase reports, or otherwise interact with our services. By using the Platform, you agree to the practices described in this policy.

1. Information We Collect

1.1 Information You Provide

• Account Information: When you create an account, we collect your name, email address, and authentication credentials. If you sign in using Google OAuth, we receive your name, email address, and profile picture from Google.
• Payment Information: When you purchase reports or subscribe to a plan, payment details (such as credit card number, billing address, and transaction history) are collected and processed by our third-party payment processor, Stripe. We do not store your full credit card number on our servers.
• Search and Report Data: VIN numbers you search, vehicle reports you generate, and any saved vehicles or watchlist preferences.
• Communications: Information you provide when you contact us for support, submit feedback, or otherwise communicate with us.

1.2 Information Collected Automatically

• Usage Data: Pages visited, features used, search queries, report views, timestamps, and interaction patterns.
• Device Information: Browser type and version, operating system, device type, screen resolution, and language preferences.
• Network and Log Information: IP address, referring URLs, access times, and server log data.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our salvage vehicle analytics services, including generating vehicle reports, ROI calculations, and market data insights.
• Process transactions and send you related information such as purchase confirmations and invoices.
• Create and manage your account, authenticate your identity, and provide customer support.
• Send you service-related communications including updates, security alerts, and administrative messages.
• Analyze usage trends to improve Platform functionality, user experience, and data accuracy.
• Detect, investigate, and prevent fraudulent transactions, unauthorized access, and other illegal activities.
• Comply with legal obligations and enforce our Terms of Service.
• Dealer Sites: when a dealership stores its Annual Resale Certificate with us and asks us to send it to its vendors, we keep the certificate and the vendor email addresses it gives us in order to send it (now and at renewal). We may use that vendor list in aggregate, internally, to improve our services; it is never shown to other dealerships or sold.

3. Information Sharing and Disclosure

We do not sell your personal information. We may share your information in the following limited circumstances:

• Service Providers: With trusted third-party providers who perform services on our behalf, such as payment processing, data hosting, and analytics (see Section 6 below).
• Legal Requirements: When required by law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, in which case your information may be transferred as part of that transaction. We will notify you of any such change.
• With Your Consent: When you have given us explicit consent to share your information for a specific purpose.
• Dealerships You Contact: When you ask about a car or submit a credit application on Codonca or on a dealership website powered by Codonca, we send your information to that dealership so it can answer you and process your application. The dealership uses it under its own privacy policy.

Consent records. When you submit a credit application, we keep a record of the consent you gave — the exact text shown to you, the boxes you checked, the date and time, your IP address and your browser — and share it with the dealership that received your application, so it can show that you agreed. We keep this record for as long as we keep the application.

4. Data Security

We implement industry-standard technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL protocols.
• Secure authentication via Supabase Auth with support for multi-factor authentication.
• Row-level security policies on our database to ensure users can only access their own data.
• Regular security reviews and monitoring for suspicious activity.

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but are committed to promptly notifying affected users in the event of a data breach in accordance with applicable law.

6. Third-Party Services

We integrate with the following third-party services to operate the Platform:

• Stripe — Payment processing. Stripe collects and processes your payment information in accordance with its own Privacy Policy. We receive limited transaction data (such as the last four digits of your card, billing address, and transaction status) but never your full card number.
• Supabase — Authentication and database services. Supabase manages user authentication tokens and stores application data in accordance with its Privacy Policy.
• Google OAuth — Optional single sign-on. If you choose to sign in with Google, we receive your basic profile information (name, email, and profile photo) as authorized by your Google account settings.
• Google Business Profile APIs — Optional, for dealers only. If a dealer chooses to connect its Google Business Profile, we read that business's profile information, performance metrics and reviews to show them in the dealer's dashboard. See Section 8 for full details.
• Vercel — Application hosting and content delivery. Vercel may process server-side request logs in accordance with its own privacy practices.
• Meta Platforms — WhatsApp Business Platform — Business messaging. We use the WhatsApp Business Platform provided by Meta Platforms, Inc. to send and receive messages with users who contact us or opt in to WhatsApp communications. Meta processes your WhatsApp phone number, WhatsApp profile name, and message content in accordance with the WhatsApp Business Messaging Policy and the Meta Privacy Policy. See Section 7 for full details.

Each third-party provider operates under its own privacy policy, and we encourage you to review their policies. We only share the minimum information necessary for each service to function.

7. WhatsApp Business Messaging & Meta Platform

Codonca Inc. uses the WhatsApp Business Platform provided by Meta Platforms, Inc. (“Meta”) to communicate with users who message us on WhatsApp or who provide their phone number to receive WhatsApp messages from Codonca. This section describes how we handle data in connection with that integration.

7.1 Data We Process Through WhatsApp

• WhatsApp Phone Number: The mobile number you use to contact us on WhatsApp, or that you provide in order to opt in to WhatsApp messages from Codonca.
• WhatsApp Profile Name: The display name associated with your WhatsApp account.
• Message Content: The messages you send to and receive from us through WhatsApp, including text, any images you choose to share (such as vehicle photos), and related metadata such as timestamps.

7.2 How We Use WhatsApp Data

• Respond to your inquiries and provide customer support through our automated assistant and our team.
• Send you the service-related messages you request, such as vehicle information, market reports, appointment confirmations, and shipping or dispatch status updates.
• Maintain a record of our conversation so we can provide continuity of service.

We send WhatsApp messages only to users who have contacted us first or who have explicitly opted in. We do not sell or share your WhatsApp data for third-party advertising. Data transmitted through WhatsApp is also processed by Meta in accordance with the WhatsApp Business Messaging Policy and the Meta Privacy Policy.

7.3 Opting Out & Deleting Your WhatsApp Data

You can stop receiving WhatsApp messages from Codonca at any time by replying STOP in the chat. To request deletion of your WhatsApp phone number, profile name, and message history, reply DELETE in the chat, email us at privacy@codonca.com, or follow the instructions on our Data Deletion page. We will delete your WhatsApp data within 30 days, except where retention is required by law.

7.4 Connecting a Facebook Page or Instagram Account (Dealers)

Dealers who use Codonca Dealer Sites may choose to connect the Facebook Page and Instagram professional account of their business using Facebook Login for Business. The connection is optional and is made only by a person with access to those business assets, who sees and approves the requested permissions in Meta's own consent screen. With that approval we read basic information about the Page and Instagram account (name, ID, profile picture) and their insights (for example reach, impressions, profile visits, followers and engagement on posts) to show them in the dealer's Codonca dashboard and monthly report. We do not publish, edit or delete anything on the dealer's Page or Instagram account, we do not read private messages through this connection, and we do not sell this data or use it for advertising. Access tokens are stored encrypted on our servers and are never shown to other users. A dealer can disconnect at any time from its dashboard or from its Facebook settings (Business Integrations); when it does, we delete the stored token immediately and delete the insights we stored from that connection within 30 days.

7.5 Connecting a TikTok Account (Dealers)

Dealers who use Codonca Dealer Sites may choose to connect their TikTok account using TikTok Login Kit. The connection is optional and is made only by the account holder, who sees and approves the requested access in TikTok's own consent screen. With that approval we read basic profile information (display name, avatar and an account identifier) to show the connection in the dealer's Codonca dashboard and, only when the dealer clicks “Send to TikTok” on one of its vehicles, we upload that vehicle's video to the dealer's TikTok inbox as a draft. The dealer then reviews, edits and decides whether to post it from the TikTok app; Codonca does not publish anything on the dealer's TikTok account by itself and does not read its videos, followers, comments or messages. Access tokens are stored encrypted on our servers and are never shown to other users. We do not sell this data or use it for advertising. A dealer can disconnect at any time from its dashboard or from TikTok's app permissions settings; when it does, we revoke the authorization with TikTok and delete the stored token immediately.

9. Your Rights

Depending on your location, you may have certain rights regarding your personal information:

All Users

• Access: Request a copy of the personal information we hold about you.
• Correction: Request that we correct inaccurate or incomplete information.
• Deletion: Request that we delete your personal information, subject to certain legal exceptions.
• Account Closure: You may close your account at any time by contacting us. We will delete or anonymize your personal data within 30 days unless retention is required by law.

California Residents (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:

• Right to Know: You may request details about the categories and specific pieces of personal information we have collected, the sources of that information, the business purposes for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You may request the deletion of your personal information, subject to certain exceptions.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
• No Sale of Personal Information: We do not sell personal information as defined under the CCPA.

To exercise any of these rights, please contact us at privacy@codonca.com. We will respond to verifiable requests within 45 days.

10. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with our services. Specifically:

• Account Data: Retained while your account is active and for up to 30 days after account closure.
• Transaction and Report Data: Retained for up to 3 years for business records and dispute resolution purposes.
• Usage Logs: Retained for up to 12 months for analytics and security purposes, then aggregated or deleted.
• IP Addresses in Security Logs: Kept for 30 days to detect abuse and attacks, then deleted automatically. Keys, tokens and passwords that appear in a request are never stored in readable form. When an IP address is recorded as evidence of an agreement or transaction (for example a bid acceptance, a deposit or a signature), it is kept with that record under Transaction and Report Data.

We may retain certain information for longer periods when required by law, for legitimate business purposes (such as fraud prevention), or to resolve disputes.

11. Children's Privacy

The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected information from a child under 18, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us at privacy@codonca.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Update the “Last Updated” date at the top of this page.
• Notify registered users by email or through an in-app notification for significant changes.

We encourage you to review this policy periodically. Your continued use of the Platform after changes are posted constitutes your acceptance of the updated policy.

13. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: