Privacy Policy
What we collect about you and your vehicle, what we do with it, who sees it, and what stays private.
Draft notice. This document is a working draft prepared before counsel review. Bracketed items are open points. It will be replaced by a reviewed version before launch.
1. Scope
This policy covers gotohammer.com and its related domains, your account, the valuation service, and the shop services. It is written for sellers. Auction bidders who visit a public verification page are covered by Section 7.
Go to Hammer is operated from Northeast Ohio in the United States. Data is stored and processed in the United States.
2. What we collect
Account. Name, email address, phone number, password (stored as a salted hash, never in clear text), and your role.
Payment. A payment card is required before a valuation. Card details are entered on a form served by Stripe and stored by Stripe. We keep only the card brand, last four digits, expiry, and Stripe's customer and payment-method identifiers, so we can show you which card is on file and charge amounts you have authorized.
Vehicle. VIN, decoded specifications, mileage, title status, ownership and service history, known issues, modifications, and the photos you upload. Photos may contain metadata (for example, capture time and, if your phone adds it, location). We strip location metadata on upload; we keep capture time.
Shop records. If you send us the vehicle: intake photos, inspection notes and findings, estimates and your per-line decisions, job progress and photos, and the certification.
Communications. Messages you send through the contact form or by email, and emails we send you.
Technical. Server logs (IP address, browser, pages requested, timing) kept for security and debugging. We do not run advertising trackers or third-party analytics scripts.
Cookies. Three first-party cookies, all essential: a session cookie so you stay logged in, a CSRF token that protects forms, and a short-lived cookie that carries one-time messages between pages. No advertising or cross-site cookies.
3. How we use it
- To run your account and charge the amounts you authorize.
- To decode the VIN and produce your valuation, including sending the VIN decode, your vehicle details, and your photos to the AI provider (Section 5).
- To coach you on which photos are still needed.
- To inspect, estimate, perform, and document work on your vehicle, and to issue a certification.
- To arrange transport, where you ask us to, by sharing pickup and vehicle details with the carrier.
- To improve our valuations, using data that has been separated from your name and contact details (for example, model, year, mileage band, condition read, prep performed, and eventual hammer price where you tell us or it is public).
- To send you service email about your account, valuation, estimate, job, and certification. We do not send marketing email without a separate opt-in.
- To keep the Site secure and to comply with law.
4. Who we share it with
We share personal information only with providers that help us deliver the service, each under terms that restrict use to that purpose:
| Provider | What | Why |
|---|---|---|
| Stripe | Card details (entered directly with Stripe), charge amounts, email | Payments |
| Amazon Web Services | Everything we store and send | Hosting, storage, email delivery |
| Anthropic | VIN decode, vehicle details, photos, our prompts | AI valuation and drafting (Section 5) |
| NHTSA vPIC | The VIN | Public VIN decode; a US government service |
| Transport carriers | Vehicle, pickup and delivery details, your phone number | Only when you ask us to arrange transport |
| Subcontracted shops | Vehicle and the approved work lines | Only for lines you approved |
We do not sell personal information and we do not share it with data brokers or advertisers. We disclose information when the law requires it, to enforce our terms, or to protect someone's safety.
5. AI processing
Your valuation is produced by a large language model operated by Anthropic. We send it the VIN decode, the details you entered, and your photos, together with our own instructions and comparable-sale data. We use Anthropic's commercial API, whose terms state that customer inputs are not used to train their models. [Counsel: confirm current Anthropic commercial terms and data-retention window at launch and cite the version.] A person at Go to Hammer reads the AI's draft of any estimate or certification before it goes out; the AI does not make decisions about your vehicle on its own.
6. Photos and data you own
You own the photos and information you provide. Our license to use them is described in the Terms of Service. You can download the photos you uploaded from your account at any time. Inspection photos and job photos taken by our staff are our work product; you may use the ones included in your certification and estimate as those documents allow.
7. Public verification pages
Each released certification has a public verification page at a link like
gotohammer.com/verify/XXXXXXXXXX. It shows the vehicle's year, make, model, trim, and VIN
(or a partial VIN), the mileage at release, the condition grade and summary, the work
performed, the items not addressed, the release date, and the certification status. It does
not show your name, contact details, or the price of any work. Anyone with the link or the
code can view it; that is the point. Verification pages are retained for as long as the
certification is valid and for [7] years after.
8. Retention
- Account and vehicle records: while your account is open and for [7] years after the last transaction, to meet tax, lien, and dispute obligations.
- Photos you uploaded for a valuation that never went to intake: [24] months, then deleted, unless you delete them sooner.
- Server logs: [90] days.
- Anonymized valuation data: indefinitely.
You can ask us to delete your account. We will delete or anonymize personal information that we are not required to keep and confirm by email.
9. Security
Passwords are hashed with argon2id. Traffic is encrypted in transit. Photos are stored in private storage and served through signed or scoped links. Staff access is role-based and logged. No system is perfectly secure; if we learn of a breach affecting your data we will tell you without undue delay.
10. Your choices and rights
You can view and correct your account and vehicle information in your account. You can ask us for a copy of the personal information we hold, ask us to correct or delete it, or object to a use, by writing to hello@gotohammer.com. We will respond within 30 days. We do not discriminate against anyone for exercising a privacy right. Residents of states with specific privacy laws have the rights those laws provide. [Counsel: confirm whether any state law thresholds apply at launch scale.]
11. Children
The Site is for adults. We do not knowingly collect information from anyone under 18.
12. Changes
Each version of this policy has a number and effective date at the top. Material changes are announced by email to account holders before they take effect.
13. Contact
Privacy questions: contact form or hello@gotohammer.com. [Postal address to be inserted on formation.]