Last updated: July 19, 2026 · Effective: July 19, 2026
This Privacy Policy explains how Exzato LLC (“Exzato,” “we,” “us,” “our”) collects, uses, shares, and protects your information when you use the Exzato website, mobile applications, and related services (the “Service”), which include a vehicle and auto-parts marketplace and social features (feed, posts, short videos, stories, groups, group chats, and direct messages). It is incorporated into our Terms of Service. The Service is offered in 48 U.S. states, excluding California and New York.
Account information: your email, username, profile photo, and profile details.
Identity-verification data: images of your government-issued ID and a selfie (sensitive — see Section 2).
Transaction & payment data: listings, bids, purchases, shipping details, and payments (processed by our payment providers — Stripe and, for escrow transactions, a licensed escrow provider; we do not store full card numbers or bank credentials).
User content: photos, videos, captions, listing details, posts, and the content of messages and direct messages you send through the Service.
Usage, device & analytics data: device type, OS and app version, crash logs, IP address, feature interactions, and device identifiers and device-fingerprinting signals (such as hardware and configuration characteristics), which we collect for fraud prevention and account security.
In-app interaction data: signals about how you interact with content in the app (for example, which listings, posts, and videos you view and for how long), collected for signed-in users and used to personalize the content shown to you.
VIN queries: if you use VIN lookup features, the VIN you enter is processed against third-party vehicle-data sources to return vehicle information (Section 6); a VIN identifies a vehicle, not a person.
Location: approximate (city/state) location you provide for listings and proximity filtering, and coarse location inferred from IP; we do not continuously track precise GPS location.
Marketing list: if you opt in or create an account, your email may be added to our mailing list (Section 4).
To verify identity and age (18+), reduce fraud and impersonation, protect the marketplace, and meet legal and financial-compliance obligations, we collect images of your government-issued ID and a selfie, which we treat as sensitive personal information.
How verification is performed. Identity verification is performed solely by human review by authorized Exzato reviewers. We do NOT use face-recognition or facial-geometry technology, we do not generate any biometric identifier or biometric information from your ID or selfie, and we do not use an algorithmic face-match vendor. Because no facial-geometry data is created, no biometric identifier is collected. We do not sell your biometric data or any other personal information.
Storage & retention. Verification images are transmitted over encrypted connections and stored in access-restricted systems available only to authorized reviewers and the systems needed to process verification. We retain verification images only as long as needed to complete and substantiate verification and to satisfy legal, fraud-prevention, and record-keeping obligations, and we delete or de-identify them when that purpose is satisfied or within the period required by applicable law, whichever is earlier. Some payment-related identity checks may be performed by Stripe under Stripe’s own terms. Ask about the status or deletion of your verification data at privacy@exzato.com.
• Create and manage your account; process transactions, payouts, and the security deposit (via our payment providers).
• Display listings, match buyers and sellers, and facilitate payments and fund holding/release.
• Verify identity and age and detect and prevent fraud, abuse, and prohibited listings, including by using device identifiers and device-fingerprinting signals to protect accounts and the marketplace.
• Personalize the content shown to signed-in users based on in-app interaction data (e.g., content viewing activity).
• Send transactional notifications about bids, listing outcomes, messages, payments, disputes, and account activity.
• Resolve disputes between buyers and sellers.
• Send marketing communications you can opt out of at any time (Section 4).
• Maintain, secure, and improve the Service using analytics, collecting only what is reasonably necessary (data minimization).
We may send marketing emails about features, listings, and promotions, and we comply with the federal CAN-SPAM Act: every marketing email is identifiable as an advertisement, uses accurate headers and non-deceptive subject lines, includes a working unsubscribe mechanism and our valid physical postal address, and we honor opt-out requests within 10 business days. You may also opt out at support@exzato.com. Opting out of marketing does not stop transactional or service messages necessary to operate your account.
We send transactional and service messages (bids, payments, disputes, security) by email, in-app, and push notification as needed to operate your account. Where we send marketing push notifications, we do so consistent with applicable consent requirements, and you can opt out of marketing messages without affecting service messages.
Firebase (Google): authentication, database, file storage, hosting, push notifications, and analytics.
Stripe, Inc.: payment processing, payouts, fund holding and release, and certain identity/financial-compliance checks. For Stripe-processed sales, sale proceeds are held in the seller’s own connected Stripe account and released at Exzato’s direction; Exzato does not hold user funds in its own accounts.
Licensed escrow provider: where escrow is used for a transaction (as shown at checkout), a licensed escrow provider — which may be Internet Escrow Services, Inc. (operator of Escrow.com), a licensed and bonded escrow company — receives the transaction and payment details needed to hold and disburse the sale funds under its own terms.
Vehicle-data providers: when you use VIN lookup features, the VIN you enter is processed against third-party vehicle-data sources (e.g., the U.S. National Highway Traffic Safety Administration (NHTSA) and, where available, NMVTIS-based or other commercial providers) to return vehicle information; VIN queries are sent without your personal identifiers.
Google reCAPTCHA: our website uses reCAPTCHA to protect sign-up and other web flows from abuse; reCAPTCHA collects hardware and software information and sends it to Google for analysis. This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.
Nominatim / OpenStreetMap: city-level location search (queries sent without personal identifiers).
We share only what is needed for these providers to perform their function; their own terms apply to services they provide as independent controllers.
We share information: with other users as needed for the marketplace (your username and profile photo are visible to signed-in users; listing and transaction details are shared with your counterparty); with service providers (Section 6); when required by law, subpoena, or court order, or to protect rights, property, or safety; and in connection with a merger, acquisition, financing, or sale of assets, with notice as required by law.
We do NOT sell your personal information or biometric data for money, and we do not use your personal information for cross-context behavioral or targeted advertising. To the extent any analytics integration is deemed a “sale” or “targeted advertising” under a state law, we provide a way to opt out at privacy@exzato.com or through in-app privacy settings, and we honor recognized universal opt-out signals where required.
We keep information while your account is active or as needed to provide the Service. Transaction and financial records may be retained up to 7 years for tax, accounting, and legal obligations. Identity-verification data is retained per Section 2. When data is no longer needed, we delete or de-identify it.
We use industry-standard safeguards, including encrypted connections, Firebase Authentication, server-side security rules, access-restricted storage, and Stripe’s PCI-DSS-compliant infrastructure. No system is perfectly secure; use a strong, unique password and report suspected unauthorized access to security@exzato.com. If a data breach affecting your personal information occurs, we will notify affected users and authorities as required by applicable state breach-notification laws.
Depending on your state of residence, you may have the right to access, correct, delete, and obtain a portable copy of your personal data; to opt out of targeted advertising, any “sale,” and certain profiling; and to opt out of marketing. To exercise these rights, contact privacy@exzato.com; we will respond within 45 days (extendable as permitted) and within any period required by law, and you may appeal a denial by replying to our response. We will not discriminate against you for exercising your rights. We honor recognized universal opt-out preference signals where required by law.
You can close your account at any time (Settings → account closure) or at support@exzato.com. On closure we delete or de-identify your personal data, except information we must retain for legal, tax, fraud-prevention, dispute-resolution, or financial-compliance reasons (e.g., transaction records under Section 8). Content you shared publicly or with other users may persist where required for those users’ records or by law.
The Service is intended only for adults 18 and older and is not directed to children. We do not knowingly collect personal information from anyone under 18, and we enforce an age gate at registration. If we learn we have collected data from a minor, we will delete it promptly.
We may update this Policy. For material changes we will notify you via in-app notice or email and update the “Last updated” date above; your continued use after the effective date constitutes acceptance.
Exzato LLC
421 West Broadway, Ste 302 #847
Council Bluffs, Iowa 51503, USA
Privacy requests: privacy@exzato.com
General: support@exzato.com