This Privacy Policy describes how Car Warranty Refunds ("we," "us" or "our") handles information through carwarrantyrefunds.com and our warranty-review and cancellation-assistance services.
Information we collect
- Contact and account information: your name, mobile number, email and mailing address when provided, phone-verification status, communication preferences and consent records.
- Warranty and request information: uploaded contracts and supporting files, vehicle and VIN details, mileage, purchase and cancellation dates, provider and dealer details, loan or lienholder information, claims history, your answers, correspondence, review results and cancellation or refund status. We receive information from you and, when authorized, the providers, dealers or lenders handling your request.
- Transactions: selected services, authorizations, payment status, processor references, fees and refund amounts. Payment processors collect payment credentials through their own checkout; do not put card or bank-login details in an upload or message.
- Device and usage information: IP address, browser and device characteristics, approximate location derived from IP, page visits, timestamps, referral sources, campaign and advertising click identifiers, interactions, form-completion events, diagnostic information and browser or session identifiers.
Submit only information you are entitled to share and that is needed for the request. Redact unrelated Social Security numbers, full financial-account numbers, medical information and other unnecessary sensitive details.
How we use information
We use information to verify access, review your contract, prepare instructions and estimates, answer questions, perform separately authorized assistance, communicate with you and relevant providers, process payments, prevent abuse, troubleshoot, improve the service, measure advertising effectiveness, keep business records and meet legal obligations. An upload requests a review; it does not by itself authorize cancellation.
Documents, AI and service providers
Authorized reviewers and software, including AI model and document-processing providers, may process your files and request information to extract contract provisions and prepare a review. AI output can contain errors and must be checked against your actual contract. When you authorize assistance, remote-browser and automation providers may process relevant task information, screenshots and documents to help prepare provider submissions.
We use hosting, database and private file-storage services provided through Vercel, including Neon Postgres and Vercel Blob; communications providers such as AgentPhone; payment providers such as Stripe or Helcim when checkout is offered; and providers of AI processing, browser automation, security and analytics. These providers receive information needed for their functions. Providers, dealers and lenders receiving an authorized cancellation request also handle information under their own policies.
Google Analytics, Google Ads and Tag Manager
We use Google Analytics to understand website use, Google Ads to advertise and measure results, and Google Tag Manager to manage measurement tags. Google and its partners may use cookies, similar technologies and device or online identifiers to collect activity on this site and, depending on your settings and enabled features, across other sites or devices. Measurement can associate an ad interaction with a later request or transaction.
User-provided data and enhanced conversions: if enabled with the necessary permissions, we may share information you provide, such as your phone number or email address, with Google to perform advertising measurement on our behalf. Matching identifiers are hashed before transmission using the supported Google implementation. Google can match them with information associated with Google accounts to measure conversions. Hashing does not make this information anonymous or replace any required consent. We do not use this feature to send your warranty documents, financial-account details or message contents to Google.
Google Signals and advertising features: if enabled with the necessary permissions, Google may associate activity on this site with information from signed-in Google users who permit ad personalization, supporting aggregated demographic, interest and cross-device reporting. Advertising features may also support audience measurement and remarketing, subject to your choices and applicable requirements. This policy describes these features; it is not itself your consent to activate them.
Learn how Google uses information from sites that use its services. You can manage personalization in Google My Ad Center, manage activity in Google My Activity, and use the Google Analytics opt-out browser add-on. These controls have different scopes and do not necessarily stop every measurement technology.
PostHog analytics and session replay
We use PostHog on eligible public pages for product analytics, referral attribution, interaction events, heatmaps, performance diagnostics and session replay. Replay reconstructs interactions such as clicks and scrolling and phone-number entry so we can find usability problems. The phone number entered in the public review form is visible in replay. Our configuration masks other form inputs and selected upload, error and private-content areas, blocks embedded documents, and excludes private case and sign-in pages from PostHog capture. Browser and session identifiers can connect public-site activity to request-processing events without including the uploaded document in those events.
Our PostHog integration uses local storage and does not start when the browser sends Global Privacy Control or Do Not Track. These PostHog controls do not by themselves disable Google tags. See PostHog’s privacy policy for its handling of information.
Cookies, storage and your choices
We use browser storage for sign-in, request access, upload continuation and attribution. Analytics and advertising providers may also use cookies or similar storage. You can block or delete storage in your browser; doing so may interrupt sign-in or remove saved preferences. Browser Do Not Track is not a universal opt-out across every provider. Where applicable law requires consent for optional technologies or advertising-data sharing, a separate consent mechanism is required; submitting a review request or reading this policy is not that consent.
Text messages and communications
When you request verification or agree to request updates, we use your mobile number to send the requested texts. Frequency varies; message and data rates may apply. Reply STOP to stop updates or HELP for help. Verification texts you specifically request may still be needed to sign in. Mobile messaging consent records are used to administer the messaging program and are not shared with third parties for their marketing. Permission to send service texts is separate from permission to use a phone number for advertising matching.
If you choose “I need to find it” and request a text link, we use the number you provide to send one link back to the secure policy-upload form. This does not open a review request or enroll you in reminders. We keep a protected record of the request to limit duplicate texts, without saving the number in a new review case. Reply STOP to stop texts.
Other disclosures and advertising sharing
We may disclose relevant information to comply with law or valid legal process, protect people and systems, prevent fraud, resolve disputes, or support a merger, acquisition or transfer of the business subject to appropriate protections. Analytics and advertising disclosures of identifiers and online activity may qualify as a “sale,” “sharing,” or targeted advertising under some state privacy laws even without a cash payment. The applicable categories and recipients are described above; a service request does not authorize a warranty provider to market unrelated products to you on our behalf.
Retention and security
Retention depends on the type of information and why it is needed: open requests and supporting documents for delivering assistance; payment and authorization records for accounting, disputes and legal obligations; and usage data for measurement and diagnostics. Records may be retained longer for a legal hold, fraud investigation or unresolved dispute. Deletion requests are subject to these exceptions, and backup copies may remain until their normal replacement cycle. We use private storage, access controls and encryption safeguards, but no system can guarantee absolute security. Protect your phone, verification codes and private request links.
Privacy requests and state rights
Depending on your location and whether a privacy law applies to our business, you may have rights to know or access personal information, obtain a portable copy, correct inaccuracies, delete information, withdraw consent, opt out of sale, sharing or targeted advertising, limit certain uses of sensitive information, or appeal a denied request. You may exercise applicable rights without unlawful discrimination. We use sensitive information contained in your documents for your requested service and related security and legal needs, rather than to infer personal characteristics for advertising.
Contact us to exercise a right, request an advertising-sharing opt-out, or appeal a decision. Identify the right you wish to exercise and the contact information associated with your request. We may verify identity for access, correction or deletion and ask authorized agents for evidence of authority; we do not require verification for an applicable sale/sharing opt-out. We respond within applicable legal deadlines and explain any exception or denial. Where applicable law requires us to honor an opt-out preference signal, it must be honored for the covered processing.
For support or a privacy request, open your private request and contact your case operator. Describe your request without sending passwords, verification codes, payment-card numbers or unnecessary sensitive documents.
Children and international visitors
The service is intended for adults in the United States, not children under 18. We do not knowingly collect children’s information; contact us if you believe a child provided it. We and our providers may process information in the United States and other countries with different privacy laws. Where applicable, processing must use the legal basis and transfer safeguards required by law.
Changes to this policy
We may update this policy as our service changes. The date above identifies the latest revision. We will provide additional notice or obtain new consent when required; an updated policy does not retroactively create consent.