Privacy Policy

1. Information we collect

When you create an account or contact us, we collect basic personal information: your name, email address, phone number, and the account credentials you set. We also keep records of vehicles you favorite and your interactions with the site.

When you send us an inquiry through the site — a contact message, a test-drive request, or a trade-in request — we collect what you submit: your name, how to reach you back (email and/or phone), your message, and for trade-ins the details of the car you describe (year, make, model, mileage, condition, and VIN if you provide it). These inquiries go to Guilford Motors so we can follow up with you.

When you submit an online financing application, we collect information you provide for that purpose, including: your legal name as it appears on your government ID; date of birth; contact information; current and (if different) ID addresses; housing information (housing type, rent or mortgage amount, time at address); employment and income history (at least three years of work history); driver's license number, state, issue date, and expiration date; Social Security number; vehicle of interest (including stock fields and the listed cash price, plus any down payment you say you can offer); and optional trade-in details you choose to add on the same form. We do not collect banking or account numbers on the financing application form.

Online vehicle payments are not live yet. When they launch, card and bank details will go to a PCI-compliant payment processor and will not be stored on our servers.

2. Cookies

We use only one first-party cookie of our own — the strictly-necessary session cookie that keeps you signed in — and no advertising or cross-site tracking cookies of our own.

One page, our homepage, embeds a Google Map so you can find our lot. When that map loads, Google may set its own cookies and receive your IP address and map interactions, under Google's privacy policy. That embedded map is the only third-party service that can set cookies through the site. If we ever add non-essential cookies of our own, we'll add a cookie-consent choice before turning them on.

3. Service providers we share with

We share information only with the providers that help us run the site and process deals, under contracts that limit their use of it:

• Supabase — hosts our database and handles authentication.
• Cloud encryption-key services (AWS KMS) — help us encrypt sensitive financing fields at rest. We do not store encryption keys in the public website bundle.
• Dealer management system (DMS) providers — when you inquire, apply for financing, schedule a test drive, request a trade-in appraisal, or buy a vehicle, we may enter your information into our DMS so staff can process your deal.
• Google Maps — renders the embedded map of our lot on the homepage. See the cookie note above; we share no account information with it.
• Resend — delivers our transactional email (inquiry confirmations, request status updates, and the alert that tells us a new inquiry arrived). It processes the recipient address, name, and the type of request — never Social Security numbers or other financing application secrets.
• Consumer reporting agencies — only if and when we obtain a consumer report, which is done in person at the dealership (not as an automated online pull on this website), and only with your authorization.
• Stripe and Plaid (planned) — will process payments and verify bank accounts when online payment features launch. Card and bank numbers go directly to them and are never stored on our servers.

We do not sell your personal information. We do not share for affiliate or nonaffiliate marketing.

4. Your rights and choices

You can access and correct your account information at any time from your account settings, and you can delete your account — which removes your account's personal data after a short grace period. Exceptions: (1) inquiries you sent to the dealership (contact messages, test-drive and trade-in requests) and (2) financing applications are dealership financial / business records. Deleting your account unlinks them from your login but does not erase them until our retention schedule expires. If you want a specific record deleted sooner, call us and we'll handle it as a verified request. Where the law gives you additional rights — for example, the California Consumer Privacy Act (CCPA/CPRA) for California residents, or the GDPR for residents of the European Economic Area — you may request access to, correction of, or deletion of your personal information, and you may object to certain processing. We honor verified requests and won't discriminate against you for making one.

Marketing email and marketing text messages are opt-in only and are never required to submit a financing application or use the site. If you opt in, you can unsubscribe from emails via the link in each message, reply STOP to marketing texts, call us, or adjust preferences in your account when that control is available. Account and service messages (password reset, application received, appointment reminders) are separate from marketing and do not include promotional content.

5. Financial information (GLBA)

Guilford Motors offers its own in-house buy-here-pay-here financing. Information you provide in a financing application — including Social Security number, income, employment, driver license, and related details — is “non-public personal information” under the Gramm-Leach-Bliley Act (GLBA). We do not collect banking account numbers on the online financing form.

Before you submit an online financing application, we present a dedicated Financial Privacy Notice (versioned) for your acknowledgment inside the application flow. That notice covers the categories of information we collect, the parties we share with (including DMS providers and, if applicable, consumer reporting agencies), your marketing opt-out choices, and how we protect your information. The same notice content is the source for this section.

We protect sensitive financing fields with encryption in transit (HTTPS/TLS) and encryption at rest using envelope encryption with keys managed in AWS KMS. Access is limited to authorized dealership staff. Staff use multi-factor authentication, and cleartext sensitive fields are shown only through an audited reveal action. We do not pull your credit online as part of the website application; if a consumer report is needed, it is obtained in person at the lot under a separate authorization you give on the application.

6. How long we keep information

We keep account information for as long as your account is active. When you delete your account, we remove your personal account data after a short grace period. Backup copies age out on our hosting provider's schedule (typically days, not years) — we cannot promise immediate erasure from every backup snapshot.

Financing applications follow regulation-driven retention: funded accounts are generally kept for the longer of seven years or until the balance is paid off; denied applications about two years; abandoned applications about sixty days from submission with no status progress — then securely deleted from our active systems.

Inquiries you send us (contact messages, test-drive and trade-in requests) are kept as dealership business records until we no longer need them, even if you later delete your account — see section 4 for how to request deletion of an inquiry itself.

7. How we protect your information

The site runs over HTTPS. Access to data is controlled by row-level security and role checks so accounts and dealers see only what they are authorized to see. We keep Social Security numbers and other financing secrets out of application logs, analytics, and transactional email. In user interfaces we show truncated forms (for example, Social Security number last four) except when an authorized staff member reveals a field for a legitimate business need, which is logged. We never store raw card numbers. We securely dispose of financing records when retention expires. If a breach ever affects your information, we'll notify you as required by North Carolina law (including G.S. 75-65 where it applies).

8. Driver's license and government IDs

Driver's license information collected on a financing application is used for identity and deal processing. It is not used as your website login credential.

9. Contact

Questions about your privacy, or want to exercise a right above? Call us at (336) 299-6555. Our Terms of Service cover how you may use the site.