Privacy Policy
Out of Spec Deals LLC operates this website. This page describes what our application collects when you use the forms on this site, which service providers are involved, and how long records are kept.
What we collect
When you request a free consultation, we collect the name, email address and phone number you enter, the vehicle you are interested in, whether you are looking at new or used, and anything you choose to add in the optional notes field.
When you submit a paid search request, we collect the same details plus your state and ZIP code, and we record your acceptance of the Service Agreement — the version you accepted, when you accepted it, and a cryptographic hash of the exact text that was shown to you.
We do not ask for a date of birth, a government identifier, a driving licence number, or any financial account details.
How we use it
We use what you submit to respond to your request, to carry out the vehicle search you hired us for, to arrange and confirm calls, to take payment for the paid service, and to keep the records described below.
The service providers named on this page receive the information they need in order to perform those functions for us.
Payments
Payment is taken on Stripe’s own hosted checkout page. Card details are entered on Stripe’s page and are never sent to, processed by, or stored on our servers.
To create the checkout we send Stripe your email address, an internal reference for your request, and a small set of identifiers that link the payment back to it. Stripe confirms the payment to us; we record that the payment succeeded, the amount, the currency and Stripe’s identifiers for it.
Scheduling a call
When a call is scheduled, our application creates a private event on our own calendar using the Google Calendar API. The event carries your name and email address so we know who the call is with.
You are not added to that event as an attendee, and no calendar invitation is sent to you from it. We email your confirmation ourselves, with the call details and a calendar file you can add yourself.
We use Resend to deliver transactional messages — your confirmations, and the notifications that reach us — and we record the delivery status of each message so we can tell whether it went out.
Our application does not store email open or click events.
Anti-spam checks
Our forms use Cloudflare Turnstile to block automated submissions. As part of that verification, your IP address is sent to Cloudflare.
IP addresses and rate limiting
To stop our forms being flooded, our application counts recent submissions. The rate-limit records in our database store a keyed cryptographic hash of the IP address rather than the address itself, and those records are deleted after seven days.
Separately, our hosting, security and email providers may process IP addresses and request metadata as part of operating and protecting the service.
Cookies
Our application sets the __Host-osd_result first-party cookie. It is written after a successful payment so that the confirmation page can recognise your own payment without putting anything identifying in the address bar. It is HttpOnly and Secure, expires after 30 days, and is cleared once your kickoff call is confirmed.
Our application itself does not set analytics or advertising cookies.
Third-party services on this site
Cloudflare Turnstile and the embedded video player may process browser and network information according to their own service behaviour. Videos on this site use YouTube’s privacy-enhanced player, served from youtube-nocookie.com.
Logging
We keep operational logs so we can run and troubleshoot the site. Error details are filtered to strip out contact details, payment identifiers and other identifying values before anything is stored.
How long we keep records
Core customer and business records — consultation requests, paid search requests and their payment records — are kept for five years from the date the record is created. After that period they are reviewed and then deleted or anonymised, unless we still need to keep them for legal, tax, accounting, dispute or fraud-prevention reasons.
Short-lived security and operational records are deleted sooner, according to what they are for: rate-limit records after seven days, and email delivery and payment-processing records after 90 days.
Access and deletion
You can ask us what we hold about you, or ask us to delete it, by emailing Dave@outofspecstudios.com. Requests are handled by Dave.
Where we have to keep a financial record of a completed payment, we remove the contact details from that record rather than deleting the record itself.
If a message has already been sent to you, we cannot recall it; deletion applies to the records we hold.
Contact
For any question about this page, or about the information we hold, contact Dave@outofspecstudios.com.