FindCarsWithAIScan a deal
Security & data handling

What happens to your deal documents

A plain-language explanation of storage, provider access, retention, deletion, and the difference between verified calculations and AI-assisted review.

1You submit a dealPaste text or upload a supported document. File type and size are validated before storage.
2Private uploadDocuments are stored in a private Supabase bucket when storage is configured.
3Short-lived accessThe app creates a signed document URL valid for 15 minutes so analysis services can read the file without making the bucket public.
4AnalysisRelevant deal data can be sent to MarketCheck, NHTSA, and the OpenAI API depending on the check.
5Retention & deletionOriginal uploaded files are automatically scheduled for deletion within 30 days. Earlier deletion can be requested through Support.

Private storage, not a public file link

The deal-document bucket is configured as private. The service uses server-side credentials for storage operations and generates signed URLs for temporary access. Provider API keys and the Supabase service-role credential stay on the server and are not intentionally exposed to the browser.

Document retention

File paths include their upload date. A daily protected retention endpoint identifies date folders older than the configured retention period and deletes those files using the storage API. The default and maximum policy window is 30 days. The retention job is protected by a server-side cron secret.

What is “verified” versus AI-assisted?

Deterministic / provider-backed

Loan arithmetic, extracted values you confirm, VIN decoding, MarketCheck valuation/inventory results, and other calculations tied to specific inputs or providers.

AI-assisted

Vehicle-specific risk review, contextual interpretation, and generated negotiation language. These can be useful, but they can be incomplete or wrong and should be verified.

Data minimization

Only upload pages and fields needed to review the deal. Redact Social Security numbers, bank-account numbers, driver-license numbers, passwords, and unrelated personal information before uploading. The product does not need those values to compare a car deal.

Request earlier deletion

Use Support, choose “Delete my data / uploaded documents,” and provide the scan ID if available. We may ask for enough information to verify the correct record before deleting it.

Security limitations

No service can promise absolute security. If you believe you found a vulnerability or an uploaded document is accessible when it should not be, submit a high-priority request through Support.