Privacy Policy
Last updated: · Version 2
Who we are
Dropwatch is operated by Allen Hormoz, sole proprietor, 4 Aveena Road, Brampton, ON L6P 0Z5, Canada. It is independent of AutoTrader.ca, AutoHebdo, and Trader Corporation. The operator is the individual accountable for personal information under PIPEDA. Privacy contact: privacy@dropwatch.ca.
What we collect
This is the complete list, not a summary.
- Your email address — the one you pay with and the one alerts go to.
- The AutoTrader.ca URLs you submit.
- What we read from those public pages: asking prices and price history, year, make, model and trim, VIN, listing URL, photo URL, and check timestamps.
- Payment confirmation from Stripe — session, subscription and customer ids, and the card brand and last four digits Stripe shows us. We never see or store a full card number.
- Your IP address and browser User-Agent, processed in memory for up to an hour to rate-limit Open-hub requests and public form posts. These are not written to our database.
- A log of Open-hub link requests — the email address, the time requested, and the time the link was used — kept for 30 days.
- The unsubscribe and dashboard tokens contained in the links we email you.
- If you cancel, the reason you give Stripe — the option you pick and anything you type in the comment box. We read it to find out what we got wrong. It is deleted with your hub, 30 days after the account ends, and it is never shown to another customer.
- Whether you marked an alert useful — one of two values, recorded against the price change it was about. No free text, and it is deleted with the change log at 180 days.
- Email delivery metadata from Resend — whether a message was accepted, bounced, or reported as spam.
Why we use it
To provide the service you bought, to bill you for it, to keep it from being abused, and to answer you when you write to us. We snapshot asking prices, enumerate the competitor lots you submit, send price-drop, listing-gone, weekday digest and Open-hub emails, show your dashboard or dealer hub, process payment, and run the hourly recheck job. We do not sell personal information and we do not use it for advertising.
Two products
- Shopper watch — $29 CAD, 90 days: one URL, listing or search. Emails go to the address you entered. You stop or resume alerts from the private dashboard link.
- Dealer watch — $79 CAD per month: 1–3 competitor lots (a dealer page or a listing from that lot). We enumerate units on those lots. Billed by Stripe. Email and billing stay on the private dealer hub.
What we fetch, and how often
For a shopper watch we fetch the one listing or search page you gave us, about once an hour.
For a dealer plan we fetch the public inventory pages of each lot you add — up to 40 pages per lot, about once an hour — and we fetch an individual listing page from that lot when the inventory page does not give us a price or the vehicle details. We identify ourselves in every request with the User-Agent Dropwatch/1.0 (+https://dropwatch.ca; abuse@dropwatch.ca), we read and honour each site’s robots.txt, and we space our requests to at least one every two seconds per site.
Where your data lives
Dropwatch is operated from Canada, but every service we use to run it is operated by a company headquartered in the United States, and your information is stored and processed there.
- Vercel — hosting and request logs — United States
- Neon — the production database — United States
- Resend — outgoing email and delivery metadata — United States
- Stripe — payment processing and billing records — United States
While your information is in the United States it is subject to the laws of that country, and may be accessible to US courts, law enforcement and national-security authorities under those laws. We use these providers under contracts that require them to protect the information, but we cannot exempt them from the law where they operate. If this matters to you, please decide before you sign up, or write to privacy@dropwatch.ca.
How long we keep it
Everything runs on a schedule now. A shopper watch runs for 90 days; a dealer hub runs for the paid Stripe period. When the period ends, our hourly job marks the watch or hub expired, and we stop watching and stop emailing. A daily job then deletes:
- Open-hub link requests, 30 days after they are made.
- A checkout nobody completed, 7 days after it was started.
- A watch that expired or was cancelled, and its price history, 30 days after it ended.
- A dealer hub that expired or was cancelled — with its lots, their stock and their change log — 30 days after it ended. A dealer who resubscribes after that starts from a fresh baseline.
- A vehicle that has been off a watched lot for 90 days, and entries in a lot’s change log after 180 days.
You can also ask us to delete your records before any of those dates, and we will do it within 30 days.
Billing records that Canadian tax law requires us to keep are retained for six years regardless of a deletion request; we keep only what the law requires.
Access, correction and deletion
You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Email privacy@dropwatch.ca from the address you signed up with, or tell us which email address the request concerns. We respond within 30 days. If we need to confirm it is really you, we will ask you to reply from the address on file or to confirm a recent Stripe payment — we will not ask for government ID. If we refuse a request in whole or in part we will tell you why in writing, and tell you how to complain to the Office of the Privacy Commissioner of Canada.
Cancelling stops future billing; it does not delete the record. Every alert email also carries a one-click unsubscribe link, which stops the mail without ending the service.
Dealer lots we suggest
When you paste a competitor’s AutoTrader lot, we suggest other lots near it by distance. Those suggestions are shown without a business name — “a dealer in Mississauga, 62 units” — and we do not contact the dealers we suggest. The list of lots we can rank stays on our servers; a browser never receives the names, dealer ids or coordinates behind a suggestion.
If you operate an Ontario lot and do not want it to appear in those suggestions at all, email privacy@dropwatch.ca and we will remove it within five business days.
Security and breach notification
Access to a dashboard or a dealer hub is by a private link. Treat that link like a password: anyone who has it can see the watch or the hub. Data in transit is encrypted, and the database is managed by Neon with encryption at rest.
If a breach of security safeguards creates a real risk of significant harm to you, we will report it to the Privacy Commissioner of Canada and notify you by email as soon as feasible, as PIPEDA requires.
Cookies and analytics
We do not use advertising or analytics cookies and we do not embed third-party trackers. The only browser state Dropwatch relies on is what Next.js needs to serve the page.
Contact
Questions, access requests and deletion requests: privacy@dropwatch.ca. Service and billing: support@dropwatch.ca. Mail: Allen Hormoz, sole proprietor, 4 Aveena Road, Brampton, ON L6P 0Z5, Canada.