Privacy policy

• Account details: your email address, and if you add them, your name, phone number, country and time zone, and your mail and alert preferences.
• What you post: listings, photos, documents, dealer profiles, want-to-buy requests and reports. We remove location and camera data (EXIF) from photos when you upload them.
• Enquiries and replies: the name, email, optional phone number and message a buyer sends a seller, and the replies that follow.
• Saved items: favourites, saved searches and the alerts we have sent for them.
• Payments: the plan you bought, amounts, dates and Stripe references. Stripe collects card details directly; we never see or store a card number.
• Devices: if you turn on notifications, the push address your browser gives us and its user-agent string.
• Technical data: a one-way hash of your IP address for rate limits and abuse checks (we do not store the address itself), your browser's user-agent for your sign-in sessions, and counts of listing views, phone-number reveals and alert hits.
• Site usage: we count page views and actions such as searches, listing views and enquiries ourselves, with no cookie. A visit keeps the page address (without any private link code), the site that referred you and any campaign tags in the link. Visitors are told apart by a code made each day from the IP address and browser, which cannot be turned back into either; we keep no IP address.
• Our emails: the emails we send contain a small image and links that pass through avlists.com, so we can see whether an email was opened and which link was followed. Sign-in code emails and unsubscribe links are never tracked. Some email apps load images automatically, so an open does not always mean you read it.

• To run your account, sign you in with an emailed code, and show your listings, favourites and searches.
• To pass enquiries between buyers and sellers, and to send the alerts and notices you asked for.
• To take payment for dealer plans and keep the records tax law requires.
• To keep AvLists safe: registry checks, photo-reuse detection, rate limits, spam scoring and reviews of reported listings.
• To give sellers and dealers statistics about their own listings, and to publish market numbers that identify no one.
• To understand how the site is used and fix problems, through analytics: on unless you say no in the United States, and only if you accept it everywhere else.

We do not sell personal information, and we do not share it for targeted advertising. Marketing email and the monthly market email are off until you opt in.

• Everyone: what you publish in a listing or dealer profile. A seller's phone number is shown only when a visitor asks to reveal it. Want-to-buy requests are shown without your name or contact details.
• The other side of an enquiry: a seller receives the buyer's name, email, any phone number given and the message. When you answer a want-to-buy reply, that seller sees your name and email. Dealer team members share their dealer's lead inbox.
• Service providers who process data for us under contract: Microsoft Azure (hosting, database, file storage and email delivery, in the United States), Stripe (payments), Google (reCAPTCHA spam checks on public forms, and Google Analytics as described under Cookies below).
• The law: when required by law, court order or to protect people from fraud or harm.
• A new owner of AvLists, if the business is sold or merged, under the same protections.

Our servers are in the United States. If you are in Canada, your information is stored and processed there, where the authorities may be able to access it under US law.

• Sign-in session (avl_session): keeps you signed in for up to 30 days. Essential; set only when you sign in.
• Your choices on this device, kept in your browser's local storage: analytics consent, the compare tray and whether you dismissed the notification offer.
• Google Analytics runs in consent mode, and Google works out your region from your connection. In the United States it is on by default: choose No thanks in the bar at the bottom of the page to turn it off. Everywhere else, Canada included, it stores nothing and sends no identifiers until you accept in that bar. While it is on, Google sets its analytics cookies (_ga and _ga_*), which last up to two years. When you sign up, sign in or send a form that takes you to another page, AvLists sets avl_ga for at most five minutes: it holds only what you did (for example “sign_up”), never who you are, and the next page passes it to Google Analytics on the terms above and deletes it.Change your analytics choice
• reCAPTCHA loads on forms such as contact and enquiries to tell people from bots. Google's privacy policy applies to it.

The installed app keeps copies of pages and photos you viewed so they open offline. It never stores account, seller or admin pages.

• Account details: until you delete your account.
• Enquiries: a conversation with no new message for 30 days is archived and sends nothing more. Enquiries are kept for abuse and dispute handling, and the emails already delivered stay with the person who received them.
• Listings: shown until they expire, are removed or are sold (sold listings stay visible for 30 days). Anonymous price and days-on-market history is kept for the market data.
• Payment records: as long as tax and accounting law requires, usually seven years.
• Sign-in codes expire after 10 minutes. Mail records keep a hash of the address, not the address.
• Push addresses: deleted when you turn notifications off, or when your browser tells us they no longer work.

When you delete your account we remove your name, email, phone and preferences, your saved searches, favourites, push addresses and sessions, take down your listings and close your want-to-buy requests. Listing history stays without anything that identifies you. To have your details removed from enquiries you exchanged, write to us.

• See and change your details in your account, and your alerts in notifications.
• Unsubscribe from any alert or marketing email with the link at its foot.
• Delete your account from your account page at any time.
• Ask us for a copy of your information, to correct it, or to explain how it was used, by writing to support@avlists.com. We answer within 30 days and may ask you to confirm your identity first.

Canadian residents have these rights under PIPEDA and, in Quebec, Alberta and British Columbia, provincial law; you may complain to the Office of the Privacy Commissioner of Canada. Residents of US states with consumer privacy laws, such as California, may also request access, correction and deletion, and will not be treated differently for doing so.

Data travels over HTTPS. The database and files are encrypted at rest and reached only by the application's own managed identity; there are no shared passwords. Sign-in uses one-time codes, and admin actions are logged. No system is perfectly secure; if we learn of a breach that affects you, we will tell you and the regulators as the law requires.

AvLists is for adults. It is not directed to children, and we do not knowingly collect information from anyone under 16.

We will post any change here with a new date. If a change is significant, we will email account holders before it takes effect.