Privacy Policy

This policy explains what personal information Car Shepherd collects, why we collect it, how we use it, and what your rights are. Car Shepherd is operated by Kenneth Finnbogason, a sole proprietor based in Vancouver, British Columbia, Canada.

We comply with the British Columbia Personal Information Protection Act (PIPA) and the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

1. What we collect

We collect only what we need to provide our service and operate our business. The specific information depends on how you interact with us.

If you visit our website:

• Standard web server logs (IP address, browser type, pages visited, referral source). These are used for debugging, security, and aggregate analytics.
• Cookies and similar technologies only if enabled by third-party tools like Vercel Analytics or any advertising platforms we connect. We do not use cookies for cross-site tracking on our own.
• Meta Pixel. We use the Meta (Facebook) Pixel to measure the effectiveness of our advertising and to understand how visitors use the site. The Pixel sets cookies and sends Meta information such as your IP address, browser data, and the pages you view on our site. It also sends events when you click the "Book a call" button (recorded as a Lead) or the "Start now, $300" button (recorded as an InitiateCheckout with a value of $300 CAD). Meta may match this information to your Facebook or Instagram account if you have one. You can read Meta's description of how the Pixel works and opt out of their advertising at facebook.com/privacy/policy and facebook.com/settings?tab=ads.
• Google Analytics 4. We use Google Analytics 4 to understand which pages visitors read, how they arrived (search engine, direct, referral), and which calls-to-action they engage with. Google Analytics sets cookies and sends Google information such as a randomly assigned client identifier, your truncated IP address (we have IP anonymization enabled), browser data, and the pages you view. It also records a cta_click event when you click "Book a call" or "Start now, $300", labelled with the page you clicked from. We use this data only to evaluate which content brings useful visitors. You can opt out across all sites by installing the Google Analytics Opt-out Browser Add-on, or read more at policies.google.com/privacy.

If you book an intake call:

• Your name, email address, phone number (if provided), and any information you share in the Calendly booking form. This is collected and stored by Calendly under their own privacy policy.

If you purchase an engagement:

• Your name, email, and billing details. Payment card details are handled directly by Stripe and are never stored by us.
• During the engagement: your vehicle preferences, budget, location, commute details, family/household context relevant to your vehicle need, and any documents or correspondence you share (for example, existing listings you're considering, inspection reports, trade-in details).

2. Why we collect it

• To deliver your engagement. We need to understand your needs to produce a useful buying brief, listings, and pricing guidance.
• To process payment and issue receipts. Handled by Stripe.
• To communicate with you. Email and, if you provide a number, occasional text messages about your active engagement.
• To coordinate with third parties on your behalf, with your consent (for example, briefing an inspection shop).
• To comply with legal obligations (tax records, business records retention).
• To improve our service. Aggregated, de-identified information may inform how we run future engagements.

3. Who we share it with

We do not sell personal information. We share only with service providers necessary to operate, and only what they need:

• Stripe (payments). Handles billing information; see stripe.com/privacy.
• Calendly (intake call scheduling). Handles booking information; see calendly.com/privacy.
• Vercel (website hosting). Handles web analytics and server logs; see vercel.com/legal/privacy-policy.
• Google Workspace / Gmail (email). Handles correspondence; see policies.google.com/privacy.
• Google Analytics (website analytics). Receives information about how you use the site, as described in Section 1; see policies.google.com/privacy.
• Meta (Facebook, Instagram). The Meta Pixel on our site sends Meta information about your visit and actions taken, as described in Section 1. See facebook.com/privacy/policy.
• Other advertising platforms (such as Google) if we run ad campaigns there. These platforms may receive conversion events (e.g., "someone booked a call") but we do not send them personally identifying information beyond what's needed for measurement.
• Third parties you ask us to contact on your behalf, such as an inspection shop, with your consent.

Some of these providers may store or process data outside Canada (primarily in the United States). British Columbia's PIPA permits this, and the providers above have their own privacy commitments, but you should know it happens.

We will disclose personal information if legally required to do so (for example, under a court order or in response to a tax audit).

4. How long we keep it

• Active engagement data: kept for the duration of your engagement and for 90 days after, in case of follow-up questions.
• Transaction records: kept for seven years, as required by Canadian tax law.
• Email correspondence: kept for up to two years, then archived or deleted.
• Website logs and analytics: typically kept for 30–90 days depending on the provider's own retention policy.

You may request earlier deletion of your information at any time (see Section 6 below). Some information must be retained even after deletion requests in order to meet legal obligations.

5. How we protect it

• We use reputable service providers with their own security practices.
• Email and documents are stored within Google Workspace with two-factor authentication.
• Payment data is tokenized by Stripe and never touches our systems.
• Access to your information is limited to the people necessary to deliver your engagement (currently, just the operator).

No system is perfectly secure. If a data breach occurs that affects you, we will notify you and the British Columbia Office of the Information and Privacy Commissioner as required by law.

6. Your rights

Under British Columbia PIPA and federal PIPEDA, you have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate or incomplete.
• Withdraw consent for us to use your information, subject to legal or contractual limitations.
• Request deletion of your information, subject to our legal obligation to retain certain records.
• Make a complaint to the British Columbia Office of the Information and Privacy Commissioner if you believe we have mishandled your information. Their contact details are at oipc.bc.ca.

To exercise any of these rights, email hello@carshepherd.ca. We will respond within 30 days.

7. Children

Our service is not directed at individuals under the age of 19 (the age of majority in British Columbia). We do not knowingly collect personal information from minors. If you believe we have done so, contact us and we will delete it.

8. Changes to this policy

We may update this policy from time to time. The current version is always posted at carshepherd.ca/privacy with an updated date. If we make material changes that affect how we handle existing customer information, we will notify active clients by email.

9. Contact

Questions about this policy, or to exercise any of your rights above: hello@carshepherd.ca