Privacy Policy

This Privacy Policy explains how HOMEX USA LLC, a New Jersey limited liability company doing business as CarLinks (“CarLinks”, “we”, “us” or “our”), collects, uses, shares and protects personal information, and the choices you have. It covers:

• our website at carlinks.io, including its free tools, contact form and Sell my car page
• the CarLinks dealer portal at app.carlinks.io
• private sellers whose vehicles we work on, whether you contact us or our agents find your vehicle in a public listing
• the tools we use to publish to CarLinks’ own social-media accounts
• the CarLinks Chrome extension we plan to give our agents

It doesn’t cover websites and services run by other companies, even when we link to them, or information about our own staff and contractors, which we handle under separate notices.

Who we are

HOMEX USA LLC operates CarLinks, contracts with and invoices partner dealerships, and is responsible for the personal information described in this policy.

Our affiliate, HOMEX VIRTUAL AGENCY LLC, a company in Kosovo, provides our sourcing and support team. Its staff work on our behalf: they find vehicles, contact sellers, prepare vehicle details, work with dealerships in the dealer portal and answer questions. To do that, they access personal information from Kosovo.

CarLinks is a private-party vehicle sourcing service and a workspace for dealerships. Our agents find vehicles offered by private sellers, largely through public listings such as Facebook Marketplace and through sellers who contact us on our Sell my car page. They contact sellers by phone, text message or email, share vehicle details with partner dealerships, handle the price conversation and arrange inspections or visits. CarLinks does not buy vehicles and never promises sellers an offer, price or payment. Each dealership decides for itself whether to buy.

Information we collect and how we use it

Website visitors

Information collected automatically. When you visit carlinks.io, your browser sends your IP address, browser and device details (the “user agent”), the page you asked for, the page that referred you, and the date and time. Cloudflare, which delivers and protects our website, and our own server use this to deliver pages, block attacks and abuse, and keep technical logs.

Analytics and advertising tags. On the live website, we run these tags through Cloudflare Zaraz:

• Google Analytics 4, to understand how people find and use the website
• Google Ads, to measure and show our ads
• Meta Pixel and Meta’s Conversions API, to measure and show our ads on Facebook and Instagram; with the Conversions API, events reach Meta from Cloudflare’s servers rather than directly from your browser
• the LinkedIn Insight Tag, if we start advertising on LinkedIn

These providers may set cookies or use similar identifiers in your browser. They receive your IP address, your browser and device details, the pages you view and the events we send. Our events record actions such as sending the contact form, selecting Book a demo or Dealer login, using a free tool, and starting or submitting the Sell my car form. A few events carry one extra detail: the barcode format you chose, whether you scanned with the camera or an image, or whether a seller’s ZIP code is in an area we currently serve. Our events never include VINs, images, names, email addresses or phone numbers.

We use this information to see how the website performs, to measure whether our ads work and to show CarLinks ads to people who have visited our website while they use other websites and apps. The providers also use it for their own purposes, as Google, Meta and LinkedIn explain. Your choices are described under “Sale, sharing and targeted advertising” below.

Free tools.

• The VIN barcode generator, VIN barcode scanner and dealer acquisition calculator run entirely in your browser. The VINs, figures and images you enter or scan are not sent to us. The scanner turns on your camera only after you select “Use camera”, and the images stay on your device. If you send a scanned VIN to the generator, your browser holds it for that tab only.
• The VIN decoder works differently. It sends the VIN you enter to our server, which looks it up in the public vPIC database of the National Highway Traffic Safety Administration (NHTSA). NHTSA receives the VIN from our server, not your IP address. We keep each decoded result, stored by VIN only, for up to 30 days so repeat lookups are faster. Our server uses your IP address to limit how many lookups can be made, and its technical logs may record the request, including the VIN and your IP address.

Your choices in your browser. We store your analytics and advertising choices in your browser so we can respect them on later visits.

People who contact us or book a demo

Contact form. Our contact form asks for your name, dealership and work email address and, if you choose, your phone number and a message. We store what you send in our website’s content management system and email it to our team using ZeptoMail. To block spam, the form uses Cloudflare Turnstile, which checks signals from your browser and device, and our server uses your IP address to limit repeated submissions. We use the information to reply to you and to follow up on your request, for example to arrange a demo.

Booking a demo. Book a demo takes you to Calendly, a scheduling service run by another company. Calendly collects what you enter under its own privacy policy and shares the booking with us, including your name, email address and any answers you give. We use them to prepare for and hold the demo and to follow up.

Email and phone. If you email or call us, we keep your contact details and what you tell us so we can help you and keep a record of the conversation.

Private sellers

This section is for people selling a vehicle we work on, whether you came to us through Sell my car or one of our agents found your vehicle.

What you give us through Sell my car. The form collects:

• vehicle details: the VIN (typed or scanned) or the year, make and model; trim, vehicle type, transmission and fuel type; mileage; title status (loan, lease or paid off); vehicle history; the condition of the exterior, interior, tires and mechanics, with any notes; colors; and your asking price
• where the vehicle is: ZIP code and city (we work out the state from the ZIP code)
• up to 10 photos, if you add them
• your first and last name, mobile phone number and email address, and the best time to reach you if you choose to tell us
• a record of your consent to be contacted: the version of the consent wording you agreed to, the date and time, your IP address and your browser’s user agent

If you enter a VIN, the form looks it up through our VIN decoder, described above, and fills in vehicle details for you to check.

Your photos are resized in your browser before they upload, which removes location data stored in them, and our server removes image metadata again. They are stored privately in Cloudflare R2 and are never published. Photos you upload but don’t submit are deleted within 24 hours. Each submission is emailed to our team with links to the photos that stop working after 14 days. The form also uses Cloudflare Turnstile and limits by IP address to block spam.

What our agents collect from public listings. Most vehicles we work on are offered for sale in public listings, especially on Facebook Marketplace and also on other vehicle-listing websites. From a listing, our agents may record the vehicle details and photos, the asking price, the location shown, the name shown on the listing and the listing’s web address.

What we learn when we talk with you. We contact sellers by phone, text message or email, and we may also reply through the messaging feature of the website where your vehicle is listed. In those conversations we may collect your name, phone number and email address, the VIN, the vehicle’s condition, history and title status, any loan or lease, your asking price, when you’re available, and notes about what we discussed. We don’t record phone calls.

What we get from others. We look up vehicle specifications by VIN in NHTSA’s public database. Dealerships tell us their offers, decisions and inspection results for your vehicle.

How we use sellers’ information. We use it to:

• contact you about selling the vehicle by phone, text message or email
• describe the vehicle accurately and avoid duplicates (we check VINs and listing links)
• share the vehicle with partner dealerships so they can decide whether to make an offer
• pass offers and counteroffers between you and dealerships, so you can decide whether to accept a price
• arrange an inspection or visit and record what happened
• record completed deals, bill dealerships for our service and prepare internal reports
• keep records of consent and opt-outs, and comply with the law

What dealerships see. When we send your vehicle to partner dealerships, they see the vehicle details, photos, condition report, asking price, and the city, state and ZIP code. A dealership sees your name and phone number only once an inspection or visit with that dealership is arranged. We then include them in the appointment details, including the appointment email we send the dealership, so it can reach you about the visit. Dealerships are independent businesses, and once a dealership has your information its own privacy practices also apply.

When your submission becomes a lead. When an agent takes on a vehicle from Sell my car, its details move into our dealer portal as a lead. From then on, the lead is handled as described in this section and kept as described under “How long we keep information”.

Text messages. If you give us your mobile number, or we contact you about a vehicle you’ve listed, we may call or text you about that vehicle. How often we text depends on your conversation with our agent. Message and data rates may apply. Reply STOP to stop texts, reply HELP for help, or call us at (562) 200-0003. Agreeing to calls and texts on our form is not a condition of selling: you can call or email us instead. We don’t share mobile phone numbers or text-message opt-in information with third parties or affiliates for their marketing. A dealership receives your phone number only for an arranged inspection or visit, as described above. Our full text-message terms are in our Terms of Use.

Dealer portal users

The dealer portal at app.carlinks.io is used by staff of partner dealerships and by the CarLinks team. CarLinks creates every account; there is no public sign-up.

What we collect.

• Account and profile: name, work email address, phone number, role, the dealership or dealerships you belong to, account status and who created the account. Your password is stored only in hashed form.
• Dealership details: name, address, contact person and contact details, time zone, buying preferences, notification settings, and billing details such as the fee per deal, vendor or store number and billing contacts.
• Activity: the leads sent to your dealership, bids and the reasons given, counteroffers, declines and their reasons, cancellation requests, appointments and their outcomes, notes, and a timeline of who did what and when.
• Notifications and email: in-app notifications and whether you’ve read them, your email preferences, and records of the emails we send, such as when each was sent and whether sending succeeded.
• Billing and payments: closed deals and their fees, invoices, payments, credits, adjustments and write-offs. When a dealership pays online, Stripe collects the card or bank account details directly, and we never receive full card or account numbers. We keep Stripe’s reference for each payment and its status. For saved payment methods we keep the type, the card brand or bank name, the last four digits, the card’s expiry date, whether it is the default, and a record of the authorization given: the wording shown, the name and email address of the person who agreed, and the time.
• Vehicle photos that our team adds to leads, stored on our image server.
• Technical information: IP address and browser details, used to keep the portal secure, limit repeated sign-in attempts and keep technical logs.

The portal keeps your sign-in session, which lasts up to 7 days, and your display preferences in your browser. The portal doesn’t use analytics or advertising tags.

How we use it. We use dealer portal information to:

• run the portal: deliver leads, record bids, counteroffers and appointments, and show each dealership only the leads sent to it
• send service emails, such as new-lead alerts and roundups, counteroffers, appointment confirmations, changes and reminders, deal updates, weekly summaries, invoices, receipts and password resets; you can change most email settings in your profile, but some emails, such as password resets and invoices sent to billing contacts, aren’t controlled by those settings
• bill dealerships and collect payments, including automatic payments for dealerships that turn them on, with a reminder email before each automatic payment
• alert our own team, through Slack, to offers, accepted deals, appointments, declined leads and closed deals; these alerts include dealership names, the names of the people involved, vehicle details and amounts
• provide support, keep the portal secure, prevent misuse and prepare internal reports
• meet legal, tax and accounting obligations

Add to Google Calendar. If you add an appointment to Google Calendar from the portal, the appointment details, including the seller’s name and phone number, go to Google under your own Google account.

Payment links. Invoice emails may include a link that lets your dealership pay online without signing in. Please treat those emails like the invoice itself.

Social-media platform integrations

CarLinks uses the tools social-media platforms provide to developers (their APIs) to publish and manage posts on CarLinks’ own accounts. We start with Meta: our Facebook Pages and Instagram business accounts. We will update this section before we connect any other platform. We don’t use these integrations to sign anyone in or to access anyone else’s accounts.

What we access. For the CarLinks accounts we connect, we may access:

• the access tokens and account IDs the platform issues so our system can act for our Pages and accounts
• the posts, images, videos and links we publish
• insights and engagement figures for our accounts and posts, such as reach, reactions and shares
• if we use this feature, comments on our own posts, including the commenter’s name or username as the platform shows it and what they wrote

Why. To publish and schedule CarLinks’ posts, see how they perform, and reply to or moderate comments on them.

Storage and protection. We store this data, encrypted, on our server, and only authorized CarLinks staff can use the integration.

No sale. We don’t sell, rent or license data we receive from these platforms. We use it only for the purposes above, and we share it only with the service providers that host our systems or where the law requires.

Retention. We keep this data until access is revoked or until we no longer need it for those purposes, and then delete it. We also delete it when the platform asks us to, or when you ask us to and the law allows.

Revoking access. Access can be revoked at any time in the platform’s settings, or by contacting us. Our Data deletion page explains how to remove an app connection in Facebook and Instagram and how to ask us to delete data.

Google. We don’t use Google APIs for this today. If we do, our use and transfer of information received from Google APIs will follow the Google API Services User Data Policy, including its Limited Use requirements.

The CarLinks Chrome extension

We plan to give our agents a Chrome extension that saves vehicle listings to the dealer portal. It isn’t available yet and won’t be offered to the public. If you use it once it is released:

• It works only on listing pages of the websites it supports, starting with Facebook Marketplace, and only when you select it.
• When you select it, it reads the listing page open in that tab: the visible text of the listing (such as the title, price, mileage, location, description and the seller’s name as the website shows it), the addresses of the listing’s photos and the page’s web address.
• It sends that information over an encrypted connection to CarLinks, where it becomes a draft lead in the dealer portal. Our server copies the photos to our image server.
• You connect the extension from your dealer portal account. It never asks for or stores your password, and the connection can be removed at any time.
• It doesn’t read other pages or tabs, your browsing history or your messages, and it doesn’t collect listings automatically, scroll through pages or send messages.

Leads saved with the extension are handled like any other lead, as described under “Private sellers” and “How long we keep information”. Our use of information from the extension will follow the Chrome Web Store User Data Policy, including its Limited Use requirements.

How we share information

We share personal information only as described in this policy:

• Partner dealerships receive sellers’ vehicle information, as described under “What dealerships see”. Dealership users also see their own dealership’s activity and billing records.
• Our affiliate, HOMEX VIRTUAL AGENCY LLC in Kosovo, whose staff work on our behalf as our sourcing and support team.
• Service providers that host, deliver or support our services for us, listed below. They may use personal information only to provide their services to us, except where this policy says a provider also uses data for its own purposes.
• Advertising and analytics providers (Google, Meta and, if we add it, LinkedIn), as described under “Website visitors”.
• NHTSA, which receives VINs to decode them. From our website, the request comes from our server. In the dealer portal, it comes from the user’s browser.
• For legal and safety reasons, when we believe disclosure is required by law, a court order or a lawful government request, or is needed to protect the rights, property or safety of CarLinks, our users, sellers or others, or to prevent fraud.
• In a business transfer, if CarLinks is involved in a merger, acquisition, financing or sale of assets, as part of that transaction and subject to this policy.
• With your permission or at your direction.

We don’t give the details you enter in our forms, or information from the dealer portal, to advertising companies.

Sale, sharing and targeted advertising

We do not sell personal information for money.

Our website’s advertising tags (Google Ads, Meta Pixel and Conversions API, and the LinkedIn Insight Tag if we add it) let those companies collect information about your visit: identifiers such as cookie IDs and your IP address, your browser and device details, the pages you view and the events described above. They use it to measure our ads and to show you ads on other websites and apps. California law calls this “sharing” personal information for cross-context behavioral advertising. New Jersey and other states call it targeted advertising, and some state laws may also treat it as a “sale”.

How to opt out:

• Select Your privacy choices at the bottom of any page of our website to turn off advertising tags, analytics tags or both.
• Use a browser or extension that sends a Global Privacy Control signal. We treat it as a request to opt out of targeted advertising and of “sharing” and “sale” for that browser, with nothing else for you to do.
• Your choice applies to the browser and device you use. If you clear your cookies or site data, or use another browser or device, make your choice again.
• You can also use the providers’ own controls, such as Google’s My Ad Center, the Google Analytics opt-out add-on and the ad preferences in your Facebook or Instagram settings.

If you visit from the European Economic Area or the United Kingdom, you’ll see a banner, and analytics and advertising tags stay off unless you accept them. You can change your mind at any time through Your privacy choices.

Do Not Track. Some browsers can send a “Do Not Track” signal. There is no common standard for it, so our website doesn’t respond to it. We do respond to Global Privacy Control, as described above.

We don’t knowingly sell or share the personal information of anyone under 16.

How long we keep information

We keep personal information only as long as we need it for the purposes in this policy, then delete it or remove the details that identify you.

How we protect information

• Our website and dealer portal use encrypted connections (HTTPS), and Cloudflare protects our website from attacks and automated abuse.
• Sell my car photos are stored privately and can be opened only through signed links that expire.
• Dealer portal passwords are stored in hashed form, sign-in attempts are limited, and each user sees only what their role allows. For example, a dealership sees only the leads sent to it.
• Our website’s content management system, which holds contact messages and seller submissions, has a single owner account protected by two-factor authentication.
• Card and bank account details for online payments are handled by Stripe, not by us.
• Access by our team and our affiliate’s team is limited to the people who need it for their work.

Vehicle photos in the dealer portal are stored on our image server at long, hard-to-guess web addresses that aren’t listed or published, but anyone who has a photo’s exact address can open it.

No method of storing or sending information is completely secure, so we can’t guarantee security. If a security incident affects your personal information, we will notify you as the law requires.

International transfers

We are based in the United States. Our affiliate’s team accesses personal information from Kosovo. Email we send and receive is processed in the United States and may also be processed in the European Union, and our other service providers may store or process personal information in other countries where they operate. These countries’ data protection laws may differ from the laws where you live. Wherever your information is handled, we protect it as this policy describes, give access only to people who need it, and require those who handle it to keep it confidential and secure. Our affiliate is also subject to Kosovo’s Law No. 06/L-082 on the Protection of Personal Data. Where European or UK law applies to a transfer, we rely on safeguards that law recognizes, such as the standard contractual clauses our service providers offer.

Children

Our website and services are for adults and businesses. They are not directed to children under 16, and we don’t knowingly collect personal information from anyone under 16. You must be 18 or older to submit our forms. If you believe a child has given us personal information, contact us and we will delete it.

Your privacy rights in the United States

Several states, including California and New Jersey, give residents rights over their personal information. We honor the requests below from residents of any US state.

• Know and access: ask what personal information we hold about you, where it came from, why we use it and who we disclose it to, and get a copy, including in a portable format.
• Correct: ask us to correct inaccurate information.
• Delete: ask us to delete your information, subject to exceptions the law allows, such as records we must keep.
• Opt out of sale, sharing and targeted advertising: as described under “Sale, sharing and targeted advertising”.
• Profiling: we don’t use personal information to make decisions that produce legal or similarly significant effects about you, such as decisions about credit, housing, employment or insurance.
• Sensitive personal information: the only sensitive personal information we collect is dealer portal sign-in details (your email address and password). We use them only to let you sign in and to keep accounts secure, which the law allows without a right to limit, so we don’t offer a separate option to limit their use.
• No discrimination: we won’t treat you differently for using these rights.

How we verify requests. We ask for enough information to match you to the information we hold, such as the email address or phone number you used with us, the VIN or listing involved or, for dealer portal users, a request sent from your account email address. We use what you give us only to verify and answer your request.

Authorized agents. Someone can make a request for you if they give us your signed permission or a valid power of attorney. We may still ask you to confirm your identity with us directly.

Timing. We confirm we’ve received your request within 10 business days and answer it within 45 days. If we need more time, we may extend that once by up to 45 more days and will tell you why.

Appeals. If we decline your request, we’ll explain why. You can appeal by replying to our answer or by emailing [email protected] with the subject “Privacy appeal”. We will answer your appeal in writing within 45 days. If you disagree with the outcome, you can contact your state attorney general. In New Jersey, that’s the Division of Consumer Affairs. California residents can also contact the California Privacy Protection Agency.

Categories of personal information (California)

The table below uses the categories named in California law. The sources, purposes and retention for each are described in the sections above.

We don’t collect precise geolocation.

Visitors and users in the EEA, the UK and Kosovo

Our services are aimed at the United States. If the GDPR, the UK GDPR or Kosovo’s data protection law applies to our handling of your information, HOMEX USA LLC is the controller, and you can reach us at [email protected].

Legal bases. We rely on:

• contract, to provide the dealer portal to dealerships and their users
• legitimate interests, to run and secure our website, reply to inquiries, find vehicles in public listings and contact sellers about selling them, share vehicle details with dealerships, manage our social-media accounts, and keep records and defend legal claims; we weigh these interests against your rights
• consent, for analytics and advertising tags and wherever else the law requires it; you can withdraw consent at any time, which doesn’t affect what we did before
• legal obligation, for tax and accounting records and lawful requests from authorities

Your rights. You can ask to access, correct or delete your information, to restrict or object to how we use it (including any use based on legitimate interests), and to receive it in a portable format. You can object to direct marketing at any time. We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects.

Complaints. You can complain to the data protection authority where you live or work: in the EEA, one of the authorities listed by the European Data Protection Board; in the UK, the Information Commissioner’s Office; in Kosovo, the Information and Privacy Agency. We’d appreciate the chance to help first.

How to make a request

• Email [email protected] with the subject “Privacy request” or, to delete information, “Data deletion request”. You can also call (562) 200-0003.
• Tell us your name, the email address or phone number you used with us, what your request is about (for example, a vehicle listing or VIN, a Sell my car submission, a contact message or a dealer portal account) and what you’d like us to do. Dealer portal users should also name their dealership.
• Please don’t send identity documents or financial details unless we ask for them.
• To opt out of analytics and advertising, use Your privacy choices or Global Privacy Control; you don’t need to email us.

Our Data deletion page explains the deletion process step by step.

Changes to this policy

We may update this policy as our services change. We’ll change the “Last updated” date at the top of this page. If we make a material change, we’ll post a notice on our website and, for dealer portal users, send an email to the address on the account. Changes apply from the date we post them.

Contact us

HOMEX USA LLC, doing business as CarLinks

• Email: [email protected]
• Phone: (562) 200-0003
• Mail: HOMEX USA LLC, 14 Laurel Terrace, Cherry Hill, NJ 08002, United States

Please send privacy and deletion requests to [email protected]. Payment pages and emails from our payment processor may show [email protected], which is also ours.