Privacy Policy

Car Show Expert ("we", "us", or "our") is a car show management platform operated by Alan Macfarlane. This Privacy Policy explains what personal information we collect, why we collect it, who we share it with, how long we keep it, and the choices and rights you have — including rights under UK/EU data protection law and US state privacy laws. Questions: privacy@carshowexpert.com.

1. Who we are and our two roles

Car Show Expert is operated by Alan Macfarlane. Contact: privacy@carshowexpert.com.

If you registered for a show and want to access, correct, or delete that data, please contact the organiser of that show first. We will help the organiser respond, and if you contact us we will pass your request on to the relevant organiser where we can identify them.

2. Information we collect

Organiser, participant and garage account data (we are the controller)

• Name, email address, and password (stored only as a salted PBKDF2-SHA-256 hash — we cannot read your password)
• Organisation or club name and subdomain; billing status and a Stripe payment reference (card numbers are held by Stripe, never by us)
• Garage members: optional phone number, home zip/postal code (used for "longest distance travelled" awards), garage name and public profile, vehicle details including optional licence plate, and vehicle photos
• Participant accounts: when you register for a show and then set a password (for example to view your dash card), we create an account from the email address you registered with and link your show entries to it, so they appear under My Entries. The details you gave when registering remain show registration data (below).
• Email preferences and consent records, and the date you accepted our Terms and this policy

Show registration data (processed for the organiser)

Depending on how the organiser configures their show, this may include:

• Name, email address, and phone number
• Vehicle details: year, make, model, colour, description, state, and licence plate, plus a vehicle photo
• Entry type, class, car number, check-in status, payment status, and responses to custom fields
• Where parking check-in is enabled: a parking photo and the GPS location where the vehicle is parked
• Judging scores and awards; volunteer, vendor, and spectator sign-up details

Show alert subscribers

• Email address, name, and zip/postal code, plus latitude and longitude derived from it to filter shows by distance
• Notification preferences

People's Choice voters

• A random voter identifier stored in your browser, and a hashed (not readable) combination of your IP address and browser type used only to limit repeat votes from one device
• If an organiser turns on location checking, your device may be asked for its location to confirm you are at the show. We store only whether the check passed, not your coordinates

Technical and usage data

Standard server logs (IP address, browser and operating system, pages requested, timestamps) for security, abuse prevention, and troubleshooting. We also keep anonymous daily page-view counts per show page: a number only, with no IP address, account, or other identifier, and no cookies. To limit abuse, counting requests are rate-limited by IP address; those records are kept briefly and are not linked to any show or page.

Sensitive information

Some data we handle is treated as "sensitive" under certain laws, notably precise geolocation (parked-vehicle GPS, optional voting location check) and account log-in credentials. We use sensitive information only to provide the Service you or the organiser requested, and not to infer characteristics about you, build advertising profiles, or for any purpose beyond what those laws permit without further consent. We do not knowingly collect health, biometric, financial-account, or government-ID information, although a licence plate is a vehicle identifier that can relate to an individual and we treat it with care.

3. What is public

Some information is visible to anyone on the internet, depending on organiser and member settings:

• A show's public page and live car list: car number, year/make/model, colour, class, and the owner's first name and last initial. Licence plates and exact owner names are not shown or sent to the public live page
• The public parked-cars map: car number and vehicle description with a map pin. It does not include owner names
• A car's public page (reached by QR code on a dash card): car details, vehicle photo, and the owner's first name and last initial
• Show results and awards, which may show award winners' full names and vehicle photos, as is usual at car shows
• Garage profiles and vehicles that a member has chosen to make public. Licence plates and private notes in a garage are not shown on the public profile

If you do not want a photo or name published, tell the organiser or email us. For JPEG, PNG, and WebP photos, embedded metadata such as GPS location is removed before the photo is stored.

4. How we use information and our legal bases

• Operate the Service and our contract with you — create accounts, run shows, process registrations, judging, results and payments (UK GDPR Art. 6(1)(b))
• Transactional email — confirmations, password resets, receipts, security notices (Art. 6(1)(b))
• Show alert and product emails — only to people who opted in; you can withdraw consent at any time (Art. 6(1)(a))
• Security, fraud and abuse prevention, image moderation, support, and improving the Service — our legitimate interests (Art. 6(1)(f))
• Legal compliance — for example tax and billing records (Art. 6(1)(c))

We do not sell personal information. We do not "share" personal information for cross-context behavioural advertising, and we do not use advertising or cross-site tracking technologies. We do not use registration data for our own marketing. We do not knowingly sell or share the personal information of anyone under 16.

5. Who we share information with

We share data only with service providers that help us run the Service, under contracts that limit their use of it:

• Supabase — database hosting (United States)
• Cloudflare — hosting and edge network, file storage (R2) for photos, logos, and documents, and email sending
• Resend — email delivery
• Stripe — payment processing, including Stripe Connect for organisers who take card payments. Stripe is an independent controller of the payment data it handles
• Sightengine — automated moderation of uploaded photos to detect explicit content
• OpenStreetMap / Nominatim — turns show addresses and subscriber zip codes into coordinates, and serves map tiles; map tile requests expose your IP address to the tile provider
• QR code image service (api.qrserver.com) — generates dash-card QR codes from a public car-page web address (no personal details beyond that address)
• Google Fonts and unpkg — fonts and map code loaded by your browser, which exposes your IP address to them

Organisers can see the registration data for their own shows, and may export it. We may also disclose information where required by law, court order, or to protect people's safety or the integrity of the Service, and in connection with a sale or reorganisation of the business (with the same protections continuing). We do not sell or rent personal information.

6. International transfers

We use infrastructure in the United States and globally. If you are in the UK or EEA, data about you may be transferred outside those regions. Where we do so we rely on appropriate safeguards, such as the UK International Data Transfer Addendum or EU Standard Contractual Clauses, or adequacy decisions where available. Contact us for details. If you are in the US, your data is generally stored and processed in the US.

7. Email

• Transactional emails are necessary to operate your account and cannot be opted out of while your account is active.
• Show alerts, digests, and product updates are sent only if you opted in. Each includes an unsubscribe link, and we honour unsubscribe requests within 10 business days (CAN-SPAM).
• Organisers may send announcements to their own entrants, volunteers, vendors, and staff through the platform. Those are sent on the organiser's behalf and the organiser is responsible for them.

8. Retention

• Account data — kept while your account is active. Account deletion is currently handled by emailing privacy@carshowexpert.com; we aim to delete personal data within 30 days, except what we must keep for legal reasons (for example billing records, up to 7 years)
• Registration data — kept as long as the organiser's account is active or as the organiser instructs. Organisers can delete individual registrations; we aim to delete data within 30 days of an organiser closing their account. Parked-vehicle GPS and parking photos are kept with the registration and are removed when the registration is deleted. When an organiser deletes a registration we keep a minimal deletion record (car number, name, email, vehicle) so the organiser can resolve later disputes such as chargebacks; it is deleted with the show, or earlier on request
• Show alert subscribers — until you unsubscribe or ask us to delete
• Server logs — kept for a limited period (we aim for no more than 90 days) for security and operations
• Voting records — kept with the show's results

9. Your rights — UK and EEA

You have the right to access, correct, erase, restrict, and port your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time. Email privacy@carshowexpert.com; we respond within one month (extendable where permitted). You may complain to the UK Information Commissioner's Office (ico.org.uk, 0303 123 1113) or your local supervisory authority.

10. Your rights — United States

Depending on where you live (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws), you may have the right to:

• Know and access the personal information we hold about you and the categories of sources and recipients
• Correct inaccurate information, and delete your information
• Obtain a portable copy of your data
• Opt out of the sale or sharing of personal information, targeted advertising, and profiling in furtherance of significant decisions — we do none of these, so there is nothing to opt out of
• Limit the use of sensitive personal information — we use it only to provide the Service (see section 2)
• Not be discriminated against for exercising these rights

How to exercise them: email privacy@carshowexpert.com with the subject "Privacy Request". We will verify your identity by matching details you provide to what we hold, and respond within 45 days (we will tell you if we need up to 45 more). You can use an authorised agent, and we may ask for proof of their authority. If we decline your request you may appeal by replying to our response; if you are still dissatisfied you can contact your state attorney general. Requests about registration data should be directed to the show organiser, who is the business responsible for that data.

California categories (past 12 months). We collect: identifiers (name, email, IP address, account ID); customer records (phone, zip code); commercial information (entries, purchases, payment status); internet activity (server logs, anonymous page counts); precise geolocation (parked-vehicle GPS); audio/visual information (photos you upload); and we do not draw inferences about you. We disclose these only to the service providers listed in section 5 for business purposes. We have not sold or shared personal information in the past 12 months.

California Shine the Light. We do not disclose personal information to third parties for their direct marketing purposes.

Do Not Track and Global Privacy Control. Because we do not sell or share personal information or engage in cross-site tracking, there is nothing for these signals to switch off; we treat a GPC signal as a valid opt-out request regardless.

11. Cookies and similar technologies

• Session cookie — keeps you signed in
• CSRF token — protects against forged requests
• Browser storage — an anonymous voter identifier and short-lived markers (for example, to avoid double-counting a page refresh) held in your browser; not used for advertising

We do not use advertising or cross-site tracking cookies.

12. Security

• Connections use HTTPS (TLS); passwords are hashed with PBKDF2-SHA-256
• Access to production systems is restricted, and database tables are protected with row-level security
• JPEG, PNG, and WebP photos have location metadata removed before storage
• Our edge provider offers DDoS and network protection

No system is perfectly secure. To report a vulnerability or suspected incident, email security@carshowexpert.com. If a breach affects your personal data we will notify you and regulators as required by law, including the UK ICO within 72 hours where required and US state breach-notification laws.

13. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them (consistent with the US Children's Online Privacy Protection Act). Show registration forms may be submitted by or for entrants of any age; for those, the organiser is responsible for any parental consent that applies. If you believe a child's information was submitted to us improperly, email privacy@carshowexpert.com and we will delete it promptly.

14. Links to other sites

The Service links to third-party websites (for example Google Maps for directions and sponsor or vendor sites). We are not responsible for their privacy practices.

15. Changes to this policy

We may update this policy. For material changes we will email account holders before they take effect, and we update the "Last updated" date above. Where the law requires your consent to a change, we will ask for it.

16. Contact and complaints

• Email: privacy@carshowexpert.com
• Car Show Expert is operated by Alan Macfarlane

UK complaints: Information Commissioner's Office, ico.org.uk, 0303 123 1113. US residents may also contact their state attorney general.