StickerShock Privacy Policy

This Privacy Policy describes how StickerShock (available at getstickershock.com) collects, uses, retains, and discloses information when you use the Service. StickerShock is an informational decision-support tool for reviewing individual line items on an automobile dealer quote. It does not offer user accounts, sign-in, or authentication — you use it anonymously.

Depending on how you use the Service, you may provide:

• Pasted dealer quote text;
• Uploaded quote images (photos or screenshots of your dealer paperwork);
• Vehicle year, make, model, and trim;
• Sale price;
• Individual line items (fee descriptions and amounts);
• State (optional);
• Dealer name (optional);
• VIN (optional);
• Consumer feedback after receiving an analysis, which may include your reported final price, your reported out-the-door price, which line items were removed or reduced, whether you purchased or walked away, and free-text notes.

When you use the Service we also create:

• AI-extracted quote information (what the AI service parsed from your paste or image);
• Consumer-confirmed quote information (what you reviewed and confirmed before analysis);
• Analysis results (assessment, confidence, per-line comparisons, questions, and any state regulatory reference material);
• A share token, if you elect to generate one;
• An anonymous session identifier used to preserve your progress across the pages of a single analysis;
• Timestamps of the analysis and, if applicable, of any consumer feedback submission;
• A short-lived rate-limit identifier (see Section 6 below).

StickerShock uses a third-party AI service (OpenAI GPT-4o) to extract charges from pasted quote text and uploaded quote images. Extracted information may be misread, omitted, or misclassified. Please review the extracted line items before relying on the analysis.

In practical terms, the text you paste or the image you upload is transmitted to OpenAI GPT-4o for extraction. The extracted structured data (line items, sale price, vehicle details) is what StickerShock's analysis engine then compares against its benchmarks. If the extraction misreads or misclassifies a line item, please correct it in the review step before requesting the analysis.

Your information is used to:

• Run the AI extraction on your paste or uploaded image;
• Compare the resulting line items against StickerShock's market benchmarks and, where applicable, state regulatory reference information;
• Present the analysis and questions you may want to ask the dealer;
• Generate and serve a share link if you elect to create one;
• Accept and store your consumer-reported outcome after the analysis, if you choose to submit one;
• Enforce anti-abuse controls, including rate limits and request-size limits;
• Improve StickerShock's benchmarks, methodology, and product quality in aggregate.

StickerShock does not sell your information, does not use it to serve personalized advertising, and does not use it to build user profiles across sites.

StickerShock enforces per-endpoint rate limits to protect the Service against abuse. Your raw IP address is derived from standard HTTP headers only for the purpose of computing a keyed hash (HMAC-SHA256) used as the rate-limit identifier. Raw IP addresses are not persisted to StickerShock's database and are not written to StickerShock's application logs.

The keyed-hash identifier itself is stored temporarily in a rate-counter table only as long as necessary to enforce the rate limits, and is subject to an approximately 48-hour opportunistic purge. Platform infrastructure that hosts StickerShock may separately log connection metadata for security purposes; that behavior is controlled by the platform provider, not by StickerShock.

When you generate a share link, StickerShock creates a random share token and makes a sanitized subset of the analysis accessible at the resulting URL. Anyone with this link can see this analysis. Share carefully. Anyone who possesses a StickerShock share link can access the shared analysis.

The shared view specifically does not expose:

• the VIN,
• the dealer name,
• the internal session identifier,
• the raw quote text you pasted,
• any uploaded image data,
• any consumer feedback you may have submitted after the analysis.

Share links cannot currently be revoked. Please treat any share link as equivalent to publicly disclosing the sanitized shared analysis to anyone who obtains the link.

The Service currently depends on the following third-party technical services:

• OpenAI GPT-4o (via an AI gateway) for quote extraction from pasted text and uploaded images.
• Supabase for the database that stores StickerShock submissions, analyses, and consumer-reported outcomes.

The infrastructure platform that hosts StickerShock may additionally provide hosting, edge, and bot-management services. Each of these providers operates under its own terms and privacy notices.

[TO BE REVIEWED BY COUNSEL BEFORE PUBLIC LAUNCH: contractual processor and sub-processor relationships, data residency, and geographic storage locations depend on the executed agreements with each provider and are not asserted here.]

StickerShock does not itself use cookies for accounts, analytics, advertising, or user tracking. Platform infrastructure that hosts StickerShock may use cookies or similar technologies for security and bot-management purposes; that behavior is controlled by the platform provider, not by StickerShock.

Your browser may also store small amounts of local state (for example, inlocalStorage) that StickerShock uses to preserve your in-flow input on the current device. This data stays on your device and is not transmitted for analytics or advertising.

StickerShock V1 currently retains quote submissions, analyses, and consumer-reported outcomes indefinitely. There is no automated retention window, no scheduled purge, and no scheduled deletion of quote submissions or their associated analyses in the current release.

Rate-limit identifiers (the keyed-hash values described in Section 6) are subject to a separate approximately 48-hour opportunistic purge and are not part of the indefinite retention above.

You may contact us at info@getstickershock.com with privacy or deletion requests. We will review and respond to requests as appropriate under applicable law.

Because StickerShock does not have user accounts, we may need enough information from you to locate the specific submission you are asking about — for example, a share token, the approximate submission date, or other details that let us identify the record without collecting further personal information than necessary.

California residents may have specific privacy rights under state law with respect to categories of personal information collected about them, the purposes for which it is used, the categories of third parties with whom it is shared, and requests to know, delete, or correct that information. The categories of information StickerShockprocesses are described in Sections 2 and 3 above; the purposes are described in Section 5; and the third-party technical services are described in Section 8.

StickerShock does not sell personal information and does not share personal information for cross-context behavioral advertising as those terms are defined under California law. To exercise any applicable privacy rights, contact info@getstickershock.com.

[TO BE REVIEWED BY COUNSEL BEFORE PUBLIC LAUNCH: the specific applicability of the California Consumer Privacy Act, the California Privacy Rights Act, and any corresponding required disclosures, verifiable consumer request procedures, and authorized-agent handling, depend on StickerShock's applicable-law status and are to be finalized with counsel.]

StickerShock is not directed to children and is not intended for use by individuals under 16. StickerShock does not knowingly collect personal information from children. If you believe a child has submitted information to the Service, please contact info@getstickershock.com and we will review the request as appropriate under applicable law.

[TO BE REVIEWED BY COUNSEL BEFORE PUBLIC LAUNCH: applicability of children's privacy laws (including COPPA) depends on the Service's intended audience and legal posture at launch.]

StickerShock enforces rate limits, request-size limits, strict security response headers, and a strict content-security policy on all Service pages. Database access flows through SECURITY DEFINER functions with row-level-security enforced at the database, so application code cannot bypass the intended access controls. No system is perfectly secure; you use the Service at your own risk.

When we update this Privacy Policy we will change the effective date and policy version shown at the top of this page. Please review this policy periodically.

For any questions about this Privacy Policy, email info@getstickershock.com.