Privacy Policy

This Privacy Policy is issued by:

Glowing Minds AI Inc.

Florida profit corporation · d/b/a GetYourCar
Principal address: 677 N Washington Blvd, Sarasota, Florida 34236, USA
Florida document number: P26000015199 · EIN: 32-0850469
Date of incorporation: March 17, 2026

(“GetYourCar,” “getyourcar.ai,” “we,” “us,” or “our”)

getyourcar.ai operates an online platform that generates advertising content (images, videos, and carousel ads) from the vehicle inventory of registered car dealerships (“Participating Dealers”) and distributes these ads on Meta platforms (Facebook and Instagram). When a visitor responds to an ad through a lead form, we collect their inquiry and route it to the relevant Participating Dealer or Dealers as described in Section 5.

EU Representative (Art. 27 GDPR): EU Data Representative Ltd., Dublin, Ireland, appointed under Article 27 GDPR.

Privacy contact: privacy@getyourcar.ai — this is the single point of contact for all privacy questions and rights requests referenced in this Policy.

This Policy applies to personal data we collect through getyourcar.ai, our advertising creatives, our lead forms (including Meta Lead Ads / Instant Forms), and any related services. It is written to address:

• The EU/UK GDPR, for visitors and leads located in the European Economic Area or United Kingdom; and
• The California Consumer Privacy Act as amended by the CPRA (“CCPA/CPRA”), and other applicable U.S. state privacy laws, for visitors and leads located in the United States.

Where this Policy refers to your “rights,” the specific rights available to you depend on where you live; Sections 9 and 10 set these out separately for clarity.

We do not knowingly collect government ID numbers, precise geolocation, financial account numbers, or other CCPA/CPRA “sensitive personal information” through the lead form. If a Participating Dealer later collects such data directly from you (e.g., during financing), that collection is governed by the dealer's own privacy notice, not this Policy.

We do not use your data for any purpose incompatible with the purpose for which it was collected, and we do not sell your data to entities outside the dealer-matching purpose described here.

5.1 Category of recipients

We do not publish a fixed, name-by-name list of every Participating Dealer, because the specific recipient is determined dynamically, per inquiry, using the logic below rather than fixed in advance. Instead, we describe the category and determination logic, consistent with our obligation under Art. 13(1)(e) GDPR:

“The recipient of your inquiry is the Participating Dealer whose advertisement or vehicle listing generated your submission, as identified by the unique ad/campaign reference attached to the lead form you completed; and, only where Section 5.2 applies, one or more additional Participating Dealers in our network with matching inventory.”

An up-to-date list of current Participating Dealers is available in our online dealer directory or on request.

Your right to know the specific recipient. If you submit a verified request, we will identify the exact dealer(s) that received your data, unless doing so is impossible or your request is manifestly unfounded or excessive (consistent with the CJEU's ruling in Österreichische Post, C-154/21). Because our system logs which ad ID maps to which dealer for every lead, this is generally not impossible for us — expect a substantive answer, not a generic category, when you ask.

5.2 Single-dealer vs. multi-dealer routing

• If you indicate you are interested only in the specific vehicle advertised: your full inquiry (name, contact details, message) is sent only to that one Participating Dealer.
• If you indicate you are open to similar vehicles: you will be shown a separate, clearly worded consent request (not bundled with general terms acceptance) before submission. Only if you affirmatively agree will we, in the event the original dealer does not accept or purchase your inquiry within 48 hours, offer your inquiry to one or more additional Participating Dealers with matching inventory in your region.
• You may withdraw this consent, or object to further sharing, at any time by contacting us at privacy@getyourcar.ai or using the opt-out link in any dealer communication sent on our behalf. Withdrawal does not affect data already lawfully shared before your request.

5.3 Preview data shown to dealers before purchase

Before a Participating Dealer pays to unlock your full contact details, we may show them a limited preview to help them decide whether to purchase, such as:

• The vehicle or vehicle category you inquired about;
• A broad geographic indicator (e.g., state or metro area — never a precise address, ZIP/postal code, or GPS coordinate);
• A general indicator of inquiry quality (e.g., “verified submission”).

This preview is designed so that, in the hands of the receiving dealer, it does not reasonably identify you as an individual. We do not consider a dealer who only views this preview and does not purchase access to be a “recipient” of your personal data; however, we retain a log of every dealer to whom a preview was shown, for accountability and in case a broader disclosure is later required (see Section 5.1).

5.4 Service providers

We also share limited data with service providers who process it on our behalf and are contractually bound to use it only for the purposes we specify (Art. 28 GDPR “processor” obligations apply to each): Lovable Cloud (hosting/database), Meta Platforms, Inc. (ad delivery and Lead Ads), Stripe (payment processing), and Plausible Analytics (privacy-focused analytics). A signed Data Processing Agreement is in place with each provider.

5.5 Relationship with Participating Dealers

Because we determine key aspects of how and to whom inquiries are routed, we and each Participating Dealer are likely joint controllers under Art. 26 GDPR for the processing described in Section 5.2–5.3, rather than us acting purely as the dealer's processor. A written Article 26 joint-controller arrangement is in place with each Participating Dealer, allocating responsibility for responding to data subject requests, providing this notice, and handling breaches.

If you are located in the EEA, UK, or elsewhere outside the United States, your data will be transferred to and processed in the United States, where Glowing Minds AI Inc. is established. Where required, we rely on Standard Contractual Clauses (2021 EU SCCs) for such transfers, and we assess supplementary measures where necessary.

• Inquiries that are purchased by a dealer: retained for 7 years to support the transaction and legal/accounting obligations, then deleted or anonymized.
• Inquiries not purchased by any dealer within 90 days: deleted or anonymized after this period; we do not keep unsold inquiries in an indefinite “unsold pool.”
• Ad interaction logs (ad ID → dealer mapping): retained for 2 years, to allow us to respond to access requests under Section 5.1 and for fraud prevention.

We and Meta use cookies, pixels (Meta Pixel), and server-side signals (Conversions API) to measure ad performance and attribute leads to the correct ad. Where required by the ePrivacy Directive/GDPR, we obtain your consent via a cookie banner before placing non-essential cookies. See our Cookie Policy for details and controls.

Subject to legal exceptions, you have the right to:

• Access your data and receive the information in Art. 15 GDPR (including, on verified request, the specific identity of recipients — see Section 5.1);
• Rectify inaccurate data;
• Erase your data (“right to be forgotten”);
• Restrict processing in certain circumstances;
• Data portability for data you provided to us;
• Object to processing based on legitimate interest (Art. 21(1)), and an absolute right to object to any processing for direct marketing purposes, including onward sharing with additional dealers under Section 5.2 (Art. 21(2));
• Withdraw consent at any time, without affecting past lawful processing;
• Lodge a complaint with your local data protection supervisory authority, or with the Data Protection Commission (DPC) of Ireland.

We will respond to verified requests within 30 days (extendable by 60 days for complex requests, with notice to you).

If you are a California resident, you have the right to:

• Know what personal information we have collected, used, disclosed, and — as applicable — sold or shared about you;
• Delete personal information we hold about you, subject to exceptions;
• Correct inaccurate personal information;
• Opt out of “sale” or “sharing” of your personal information. Because we transfer inquiry data to Participating Dealers in exchange for payment, this may constitute a “sale” under the CCPA/CPRA's broad definition. Use our "Do Not Sell or Share My Personal Information" link, or set the Global Privacy Control (GPC) signal in your browser, which we will honor as an opt-out request;
• Limit the use of sensitive personal information (not applicable to most data we collect, per Section 3);
• Non-discrimination for exercising any of these rights.

We will acknowledge requests within 10 business days and substantively respond within 45 calendar days (extendable once by 45 days).

We have a direct relationship with every individual whose data we process (you submit your inquiry to us directly), so we do not believe we meet the definition of a “data broker” under California's Delete Act; we will monitor this classification if our business model changes.

getyourcar.ai is not directed to, and we do not knowingly collect personal data from, individuals under 18. If you believe a minor has submitted data to us, contact privacy@getyourcar.ai and we will delete it.

We use appropriate technical and organizational measures (Art. 32 GDPR) to protect your data, including TLS 1.3 encryption in transit and AES-256 encryption at rest, along with strict role-based access controls. No system is completely secure, and we cannot guarantee absolute security.

We may update this Policy from time to time. Material changes will be posted on this page with an updated “Last updated” date, and, where required by law, we will provide additional notice or seek renewed consent.

Glowing Minds AI Inc.

677 N Washington Blvd, Sarasota, Florida 34236, USA
privacy@getyourcar.ai