Privacy Policy

Cardinkum ("we", "us", "our") is an Australian open vehicle data platform operated by Cardinkum Pty Ltd. This policy explains what information we collect, how we use it, and your rights. If you have questions, email us at privacy@cardinkum.com.au.

1. What data we collect

• Usage analytics. We use three privacy-focused analytics tools: PostHog (served through our own domain, so no data is sent directly to a third party from your browser), Plurism Analytics, which we run in cookieless mode, and Cloudflare Web Analytics, which is cookieless and also measures how quickly pages actually load for real visitors so we can find and fix slow ones. All three record aggregated page views and referrer data to tell us which pages are useful. We do not use them for advertising, behavioural profiling, or cross-site tracking, and we do not sell or share what they collect.
• API usage. If you use our API with an API key, we log request counts and endpoints accessed for rate-limit enforcement and abuse prevention. We do not log request bodies or personal query content.
• Community submissions. If you submit vehicle data, corrections, or owner reports, we collect your email address (for verification and follow-up) and the submitted content. Submitted content may be published on the platform attributed to "Verified Australian Owner" or similar.
• Payment data. If you purchase a paid product (e.g., an EV Match Report), payment is processed by Stripe. We do not store card numbers. Stripe's privacy policy applies to payment processing.
• Contact enquiries. If you email us, we store your email address and message content to respond to your enquiry.

2. We do not sell personal data

We do not sell, rent, or trade your personal information to third parties. Full stop.

3. Cookies

We use essential cookies required for the site to function (e.g., session state for authenticated API users), plus one analytics cookie set by PostHog, which distinguishes repeat visits so our page-view counts are not inflated. Plurism Analytics and Cloudflare Web Analytics both run without cookies and store nothing on your device. We do not use advertising cookies, and we do not use cookies for behavioural profiling or cross-site tracking.

4. Third-party services

• Cloudflare. Our platform is hosted on Cloudflare Pages and Cloudflare Workers. Cloudflare processes network requests and may log IP addresses for security and DDoS protection. See Cloudflare's privacy policy.
• Stripe (future). Payment processing for paid products will be handled by Stripe Inc. See Stripe's privacy policy.

5. How we use your data

• To operate and improve the platform
• To enforce API rate limits and fair-use terms
• To verify and publish community-submitted vehicle data
• To respond to enquiries and support requests
• To process payments (via Stripe)

We do not use your data for advertising or behavioural profiling.

6. Your rights

Under the Australian Privacy Act 1988 and, where applicable, the EU General Data Protection Regulation (GDPR), you have the right to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Delete your personal data (right to erasure)
• Object to how we process your data
• Export your data in a portable format

To exercise any of these rights, email privacy@cardinkum.com.au. We will respond within 30 days.

7. Data retention

We retain contact enquiries for up to 2 years. API usage logs are retained for 90 days. Community submissions are retained indefinitely as part of the platform dataset unless you request deletion. Payment records are retained as required by Australian law (7 years).

8. Security

We use industry-standard security practices including HTTPS for all data in transit, and access controls for data at rest. No method of transmission or storage is 100% secure. If you believe your data has been compromised, please contact us immediately.

9. Changes to this policy

We may update this policy from time to time. Material changes will be noted with a revised "last updated" date. Continued use of the platform after changes constitutes acceptance.

10. Contact

Privacy enquiries: privacy@cardinkum.com.au
Cardinkum Pty Ltd, Australia