Pilot Privacy Notice

This Privacy Notice explains how Aim High Advising, as operator of Camber, handles information in the website, marketplace, dealership workspace, pilot messaging intake, and related support.

A dealership or lender may have its own privacy duties and notice when it receives your information. Their notice applies to their separate use. This notice does not cover a site we merely link to.

Account and business information: name, email, phone, password hash, role, dealership name, business address, website, plan, team role, and account status.

Vehicle and seller information: VIN, vehicle facts, price, location, title and condition disclosures, descriptions, photos, listing status, seller or dealership association, offers, bids, watches, and saved searches.

Lead information: contact details, vehicle interest, question, test-drive request, trade interest, offer, or financing-interest message. Pilot forms are not full credit applications.

Messages and media: sender and recipient numbers, message body, provider identifiers, timestamps, content type, uploaded photos, delivery state, and the account or vehicle used to route the media.

Usage and device information: pages viewed, searches, filters, gallery actions, approximate time on a page, referral context, feature actions, IP address used for security and rate limiting, user agent, and a pseudonymous browser or daily visitor identifier.

Billing information: plan, ledger entries, fee status, and payment-provider customer or transaction identifiers after billing is activated. Payment-card details should be collected by the payment provider, not stored in Camber D1 records.

We receive information from you, your dealership team, buyers who contact a listing, a paired messaging provider, the device and browser used to access the service, and approved service providers.

Vehicle specifications or recall information may come from public government sources. A future history, identity, payment, lender, or image-processing provider may provide results after that integration is separately activated.

• Create and secure accounts, sessions, roles, dealership workspaces, and storefronts.
• Receive, organize, attach, process, and display vehicle photos and listing information.
• Route a buyer's question, offer, test-drive request, trade interest, or financing interest to the selected seller or dealership.
• Operate timed bidding, watchlists, searches, inventory sharing, fee ledgers, moderation, support, and audit trails where enabled.
• Measure listing attention, marketplace demand, conversion steps, reliability, abuse, and product performance.
• Create aggregated vehicle-market statistics only when sample size, quality, privacy, source rights, and product-review gates are met.
• Comply with law, enforce terms, investigate fraud, protect people and property, and establish or defend legal claims.

The pilot financing action is a contact request, not a full application. Do not submit a Social Security number, bank account, date of birth, driver-license image, pay stub, tax return, or other sensitive credit data in a pilot lead field.

Before full financing intake is enabled, the responsible dealer or lender must be identified and a separate approved flow must address privacy notices, permissible use, consent, encryption, access control, retention, service-provider oversight, adverse-action duties, and the FTC Safeguards and Privacy Rules where applicable.

• To the dealership or private seller you choose to contact, including the vehicle and request connected to your submission.
• To dealership owners and authorized staff for their account, inventory, leads, analytics, billing, and compliance work.
• To hosting, storage, messaging, payment, security, support, image, VIN, recall, and other approved service providers that need the information to perform contracted work.
• To a receiving dealership when both sides use an inventory-sharing workflow and the sharing status allows access.
• To government, law enforcement, courts, or other parties when required by law or reasonably necessary to protect rights, safety, service integrity, or a transaction.
• In a merger, financing, reorganization, sale, or transfer, subject to appropriate confidentiality and applicable notice requirements.

During the pilot, we do not sell personal information for money or share it for cross-context behavioral advertising. If that practice changes, this notice and any required choice mechanism must change before the practice begins.

Published vehicle pages and storefronts can be viewed, indexed, linked, captured, and shared by anyone. They may show vehicle facts, photos, general location, dealer identity, business contact information, seller type, price, disclosures, and listing activity.

Do not put a home address, private document, face, license plate you want withheld, access code, financial record, or unrelated person's information in a public photo or description. Sellers control the content they publish and should review every image.

Inbound messages are processed through the configured messaging provider. We use message metadata and media to validate the request, match a permitted sender, store the upload, prevent duplicates or abuse, and create or update a draft.

Operational replies may confirm receipt, request pairing, identify an error, or provide the next step. Marketing messages require a separate consent record. Standard carrier rates may apply. Messaging providers and carriers may retain message data under their own policies.

An essential HttpOnly cookie keeps you signed in. A browser identifier may be stored locally to distinguish repeat activity without placing your name in every event. Server records may use an IP address, user agent, and date to create a short pseudonymous security or analytics identifier.

Vehicle views, searches, filters, gallery actions, dwell time, leads, offers, watches, bids, shares, and publication events may be recorded. Dealers see analytics about their dealership and inventory. We should use aggregation or minimum sample rules before exposing market statistics.

We keep information only as long as reasonably needed for the service, account relationship, listing and transaction record, security, dispute, legal, tax, backup, and audit purposes. Different records need different schedules.

Before public launch, a written retention schedule must cover accounts, sessions, draft and sold listings, inbound media, leads, financing interest, bids, events, security logs, billing records, deleted content, and backups. A deletion request may not remove information we must keep or information another party independently controls.

We use measures intended to protect information, including password hashing, secure session cookies, role checks, request validation, rate limits, bound database parameters, media access controls, and provider signature checks where implemented. No system can promise perfect security.

Full consumer financial information must not be stored in the general lead database. Any future system that handles covered dealer customer information requires a written information-security program, risk assessment, access controls, encryption, monitoring, incident response, service-provider oversight, and other applicable safeguards.

You can update many account, dealership, listing, team, and communication settings in the product. You may unpublish or archive a listing subject to record-retention needs. Where supported, use STOP for text opt-out.

Depending on where you live, you may have rights to request access, correction, deletion, portability, or information about disclosures, and to appeal a decision. We must verify the request and may apply legal exceptions. Authorized-agent requests require proof of authority.

Submit a privacy request by email to info@aimhighadvising.us. A dedicated privacy contact and verified mailing address must be published before paid public launch.

Camber is for adults and is not directed to children under 13. Accounts, listings, financing interest, offers, and bids require users who are at least 18.

The pilot is operated for the United States. Do not submit personal information from another jurisdiction unless the service says that jurisdiction is supported. Cross-border launch requires transfer, localization, representative, consent, and data-rights review as applicable.

We may update this notice as the product and law change. A new effective date will be posted. Material changes will receive additional notice or consent when required.