Scope and privacy approach
This Policy describes the information RareReg currently handles through its registry, marketplace, account, claim, verification, contact, and administration features.
RareReg documents vehicles, not owners. Its current business practices do not include selling member personal information. Service providers still process information for hosting, authentication, storage, database, security, and email delivery as described below.
Information collected
Accounts and communications
Supabase Auth processes email address, password/authentication data, confirmation state, session information, and account identifiers. Profiles may contain a display name, membership tier, and administrative status. Contact inquiries include name, email, selected category, message, and a request identifier.
Vehicles and marketplace activity
RareReg may store year, taxonomy, VIN, build number, mileage, colors, engine, transmission, modifications, owner-provided history, coarse public location, sale status, asking price, verification and publication states, ownership relationship, offers, and listing-source information.
Files and reviews
Uploaded vehicle photographs, specialty documents, claim evidence, filenames, captions, visibility choices, moderation decisions, and review records may be stored. Inventory systems may retain normalized and raw source data, match results, warnings, source URLs, seller/dealer attribution, pricing, mileage, location, availability, and sync logs.
VIN and owner privacy
The full VIN is stored as a private vehicle field. Public vehicle responses display only a status such as “VIN verified” or “VIN on file”; they do not return VIN characters.
Account email, owner identity, exact location, private documents, claim evidence, and private offers are not included in public vehicle payloads. Owners are instructed to provide only a coarse region as the public location.
Public and private content
Published registry information can include vehicle specifications, history, modifications, sale status, asking price, coarse location, verification state, approved photos, and verified documents the owner designated public.
Photos are publicly delivered only after approval. Vehicle documents require both public visibility and verification before public delivery. Claim evidence remains limited to the claimant and authorized administrators. External listing source name, seller attribution when supplied, original link, price, and status may be public.
How information is used
- Operate accounts, registry records, marketplace discovery, offers, claims, verification, uploads, and moderation.
- Authenticate users, enforce access controls, prevent duplicates, investigate reports, and protect service integrity.
- Respond to inquiries and send requested or administrative emails.
- Maintain source attribution, listing status, data quality, and ingestion review records.
- Comply with legal obligations and protect users, RareReg, and third-party rights.
Service providers and disclosures
RareReg currently uses Supabase for authentication, PostgreSQL database services, and private file storage; Vercel for application hosting and delivery; and Resend for contact and business email delivery. Source sites, authorized sellers, dealers, and configured data providers supply or receive listing-related information where applicable.
Information may be disclosed to providers as needed to operate the service, to users according to selected public settings, to source or rights holders for corrections, or when reasonably necessary to comply with law, enforce policies, address fraud or security, or protect rights and safety. RareReg does not treat access to an API or feed as ownership of third-party images.
Cookies and technical data
RareReg uses technically necessary Supabase authentication/session cookies. No first-party analytics library, advertising pixel, behavioral tracking script, or advertising cookie system is currently implemented.
The contact endpoint uses a host-forwarded IP address temporarily in server memory to limit abuse. Vercel, Supabase, and Resend may process IP address, browser/device, request, diagnostic, security, and delivery data as part of operating their services. See the Cookie Policy.
Security and retention
RareReg uses measures including row-level database security, private storage buckets, server-side credential handling, authenticated ownership checks, admin authorization, media approval, and sanitized public queries. No system can guarantee absolute security.
Records are retained while needed to operate the registry and marketplace, preserve vehicle/source history, administer accounts and reviews, resolve disputes, enforce policies, or meet legal obligations. RareReg does not currently publish fixed retention periods or offer an automated self-service deletion workflow.
Access, correction, and deletion requests
To request access, correction, or deletion relating to your account or submitted information, email info@rarereg.com or use the Contact form. RareReg may need to verify identity or authority and may retain information where necessary for registry integrity, source history, disputes, security, legal obligations, or records that cannot lawfully or technically be deleted on request.
Jurisdiction-specific consumer rights and response procedures require legal review as RareReg’s entity, operating jurisdiction, and user footprint are finalized.
Children, international use, and changes
RareReg is not designed for children. Because a formal minimum account age and principal jurisdiction have not yet been confirmed, those terms require legal completion before material scale or targeted international operation.
Information may be processed where RareReg’s providers operate. RareReg has not published jurisdiction-specific international transfer terms. This Policy may be updated prospectively; the date above will identify the current version.
Privacy questions: info@rarereg.com.