Privacy Policy

GrailGarage ("GrailGarage," "we," "us"), operated by Thomas Capital Holdings, helps enthusiasts find hard-to-find, allocation-only vehicles and reach the dealers most likely to have them. This policy explains what information we collect, how we use it, and the choices you have. By using grailgarage.co (the "Service"), you agree to this policy.

1. Information we collect

Information you give us:

• Email address and alert preferences — when you set an auto-alert or start a subscription, so we can notify you when a matching car appears and manage your account.
• Concierge and contact requests — if you submit the done-for-you concierge form, we receive the name and contact details and request details you provide.
• Crowdsourced pricing — if you report what you paid, we store the dealer, location, and price you enter. These reports are submitted anonymously and are not linked to your identity.

Information stored only on your device (not sent to us):

• Your buyer profile (such as name, email, phone, city, and preferences), your saved dealers and drafted emails, and your "My Hunt" tracker are stored in your browser's local storage on your device. They remain there unless you clear your browser, and are only transmitted if you choose to set an alert, subscribe, or submit a form.

Payment information:

• Subscriptions are processed by Stripe. Your card details are entered on Stripe's secure checkout and handled by Stripe — we never see or store your full card number. We receive limited billing status (for example, that your subscription is active or canceled) so we can turn your alerts on or off.

Information collected automatically:

• Standard technical data (such as IP address and basic request logs) may be processed by our hosting and infrastructure providers to operate and secure the Service.
• Anonymous usage analytics. We log first-party, non-identifying events about how the Service is used — for example, which brand or car was selected, or that an alert was set — tied only to a random device identifier stored in your browser, never to your name or email. We use this to understand what's working and improve the Service. We do not use third-party advertising or cross-site tracking cookies.

2. How we use your information

• To send the alerts you ask for and operate the auto-notification service.
• To create, manage, and bill your subscription, and to provide access to paid features.
• To respond to concierge or contact requests you submit.
• To operate, maintain, secure, and improve the Service.
• To comply with legal obligations and enforce our terms.

3. Service providers we share data with

We share only what's needed with vendors that process data on our behalf. We do not sell your personal information. These providers include:

• Supabase — database and backend hosting (stores your alert email, subscription status, and anonymous quote reports).
• Stripe — payment processing and subscription management.
• Resend — delivery of alert and confirmation emails.
• Auto.dev — live dealer-inventory lookups. We send vehicle search criteria (make/model/trim/location); we do not send your personal information to Auto.dev.
• Netlify — website hosting and, if you use the concierge form, form submissions.

We may also disclose information if required by law, to protect our rights or users' safety, or in connection with a business transfer.

4. Cookies and local storage

We use your browser's local storage to remember your profile, saved dealers, hunt tracker, and preferences on your device, and a service worker to let the site load quickly and work offline. Our payment and infrastructure providers may set their own necessary cookies during checkout. We do not use advertising cookies.

5. Email communications

If you set an alert or subscribe, we'll email you about matching vehicles and your account. You can stop alert emails at any time by replying STOP to any alert email or by canceling in the customer portal. We may still send essential account or transactional messages (for example, billing notices).

6. Data retention

We keep your alert and subscription information for as long as your alert or subscription is active, and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. You can ask us to delete your information at any time (see below).

7. Your choices and rights

You can request to access, correct, or delete the personal information we hold about you, and you can unsubscribe from alert emails at any time. Depending on where you live (for example, California or the EU/UK), you may have additional rights, such as the right to know what we collect, to request deletion, to opt out of the "sale" or "sharing" of personal information (we do not sell or share it for advertising), and to not be discriminated against for exercising your rights. To make a request, contact us using the details below. Because much of your data lives only in your browser, you can also clear it yourself by clearing your browser's site data for grailgarage.co.

8. Children

The Service is intended for adults and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

9. Security

We use reasonable technical and organizational measures to protect your information, including handling payments through a PCI-compliant processor (Stripe) and keeping secret keys server-side. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

10. Third-party sites

The Service links to dealer websites and other third-party pages. We are not responsible for their content or privacy practices; their policies govern your use of those sites.

11. Changes to this policy

We may update this policy from time to time. When we do, we'll revise the "Last updated" date above. Material changes will be reflected on this page.

12. Contact us

Questions or requests about this policy or your information? Email spencer@tcapitalholdings.com.