MyFavi Autos LLC Privacy Policy

1. Who we are

MyFavi Autos LLC ("MyFavi," "we," "us," or "our") publishes automotive articles, practical guides, and safety information. This policy explains the personal information we handle through myfavi.com, MyFavi accounts, and the MyFavi newsletter.

2. Information we collect

Information you provide

• Account information: your email address, display name, authentication provider, email-verification status, and account creation and sign-in metadata.
• Email-and-password sign-in: your password is processed by Firebase Authentication to create and authenticate your account. MyFavi does not store or have access to your plaintext password.
• Google Sign-In: when you choose Google, we receive the basic account information Google makes available for authentication, such as your Google account identifier, email address, display name, profile image, and verification status.
• Newsletter information: your email address, consent choice, and subscription timestamps. A newsletter subscription is separate from a MyFavi account.
• Saved artifact information: when you save a blog, news article, guide, deal, recall, vehicle, or comparison, we store its type, stable identifier, title, canonical link, and save timestamp with your account. An account may keep up to 200 saved artifacts.
• Support communications: the information you include when you email us.

Information stored on your device

• Authentication state: Firebase Authentication uses persistent browser storage to keep you signed in until you sign out, clear browser data, or the session is otherwise revoked.
• Legacy saved guidance: during the transition to account-synced saves, the site may read older bookmarks from local storage and import valid items after you sign in. Successfully imported legacy bookmarks are removed from that browser.
• Consent preferences: a copy of your privacy choices is stored locally so the site can remember them.

Information collected automatically

• Security and request information: network, device, browser, IP-address, user-agent, and request data used to authenticate users, enforce same-origin controls and rate limits, detect abuse, and verify account or newsletter activity through reCAPTCHA.
• Region category: a broad region derived from trusted hosting headers so we can apply an appropriate consent experience. Geo responses are not cached by MyFavi.
• Consent records: your analytics choice, Global Privacy Control status, broad region, choice source, and timestamp.
• Analytics data, when analytics is enabled: page views, navigation and button interactions, account-flow events, outbound links, downloads, and scroll depth. MyFavi does not send passwords, authentication tokens, email addresses, or URL query strings in its analytics events.

3. How we use information

• Create, authenticate, secure, and maintain your account.
• Provide profile controls, email verification, and password reset.
• Save, replace, reopen, and remove your selected exact vehicle comparison.
• Send the newsletter you requested and manage subscription records.
• Respond to questions, account requests, and privacy requests.
• Protect the service from fraud, bots, spam, and excessive requests.
• Honor consent choices and Global Privacy Control signals.
• Measure and improve the website when analytics is enabled.
• Comply with law and protect legal rights.

We use Google Sign-In information only to authenticate you, maintain your account, display your account information to you, and secure the service. We do not use Google Sign-In information for advertising.

Where the EU GDPR, UK GDPR, or a similar law requires a legal basis, we use the following bases:

• Contract or steps you request before a contract: creating and maintaining an account, authenticating you, and providing requested account and download features.
• Consent: sending newsletter marketing and, where required by applicable law, setting or using optional analytics technologies and processing analytics events. You may withdraw consent at any time.
• Legitimate interests: securing the service, preventing fraud and abuse, maintaining basic operational records, responding to support requests, and improving non-marketing service reliability, balanced against your rights and expectations.
• Legal obligations: retaining or disclosing information when applicable law requires it and responding to valid legal process.

Account information is required if you choose to create an account. If you do not provide it, we cannot create or authenticate the account. Newsletter information is optional.

4. How we share information

We disclose information only as needed to operate the service:

• Google Cloud and Firebase: hosting, Firebase Authentication, account sessions, server operations, subscription and consent records, security, and rate limiting.
• Google Sign-In: authentication and account-provider selection when you choose to sign in with Google.
• Brevo: newsletter contact management and email delivery.
• Google Analytics: website measurement when analytics is enabled under your regional default or saved privacy choice.
• Google reCAPTCHA: bot and abuse detection for account and newsletter activity.
• Legal and safety disclosures: when required by law or reasonably necessary to protect rights, safety, and service integrity.
• Business transfers: if the business is reorganized, financed, acquired, or sold, subject to applicable law.

MyFavi accounts are not currently public profiles. We do not sell personal information for money, share it for cross-context behavioral advertising, or deploy Meta, TikTok, or other advertising pixels.

5. Retention and account deletion

Account information and saved artifacts are generally retained while your account remains open, unless you remove the artifacts sooner. You may request deletion by emailing Drive@MyFavi.com. We may retain limited information when reasonably necessary to complete deletion, protect the service, prevent fraud, resolve disputes, or meet legal obligations. Our providers may retain backup copies for the periods described in their policies.

A verified account-deletion request removes the account's private saved-artifact library and any legacy saved comparison as part of the account-data deletion procedure. Public editorial and vehicle content is not account data and is unaffected.

Newsletter and account records are separate. Deleting an account does not automatically unsubscribe an email address, and unsubscribing does not delete a MyFavi account. Legacy bookmarks that could not be imported may remain on that browser until removed or browser storage is cleared.

Consent, security, rate-limit, and support records are retained only as reasonably needed for their purposes. When information is no longer reasonably needed, we delete, anonymize, or securely dispose of it, subject to legal and operational requirements.

6. Your choices and privacy rights

• Update your display name from your profile.
• Reset your password, verify your email, or sign out.
• Manage or revoke MyFavi's Google access through your Google Account settings.
• Request account deletion by contacting us.
• Unsubscribe from newsletter emails using the link in an email.
• Change analytics consent using the Privacy preferences button.
• Use Global Privacy Control; MyFavi treats the signal as a request to keep optional analytics off.
• Request access, correction, deletion, restriction, portability, or objection where applicable law provides those rights.
• Withdraw consent without affecting processing that occurred before withdrawal.

Submit a request to Drive@MyFavi.com. We may need to verify that you control the relevant account or email address before acting on a request.

7. U.S. state privacy disclosures

During the preceding 12 months, MyFavi has collected the categories described below. The categories collected from a particular person depend on the features that person uses.

• Identifiers and contact information: email address, display name, Firebase or Google account identifiers, IP address, and similar online identifiers.
• Account and authentication information: provider, verification state, account timestamps, session information, and credentials processed by Firebase Authentication. Account login credentials may be treated as sensitive personal information under some state laws; MyFavi uses them only to provide and secure the account.
• Internet or electronic activity: page and interaction events, browser and device data, security events, and request metadata.
• Approximate location: a broad region inferred from network information for privacy controls and security. MyFavi does not intentionally collect precise geolocation.
• Profile information: a display name and profile image when supplied directly or through Google Sign-In.

We collect this information directly from you, automatically from your browser or device, and from Google when you choose Google Sign-In. We use and disclose it for the purposes and to the service providers described in Sections 3 and 4. We retain it using the criteria in Section 5.

Residents of certain U.S. states may have rights to know, access, confirm processing, correct, delete, or obtain a portable copy of personal information; opt out of sale, targeted advertising, or qualifying profiling; limit certain uses of sensitive personal information; use an authorized agent; and appeal a denied request, where applicable. We will not discriminate against you for exercising an applicable privacy right.

MyFavi does not sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or perform profiling that produces legal or similarly significant effects. We do not use sensitive personal information to infer characteristics. We honor supported Global Privacy Control signals by keeping optional analytics and advertising storage denied.

To submit a request or appeal a decision, email Drive@MyFavi.com with the subject “Privacy Request” or “Privacy Appeal.” We may verify your identity and an authorized agent's authority before responding.

8. European, UK, and Swiss privacy rights

If the EU GDPR, UK GDPR, Swiss data-protection law, or a similar law applies, MyFavi Autos LLC is the controller of the personal information described in this policy. Depending on the processing, you may have rights to access, correct, erase, restrict, or port your information; object to processing; and withdraw consent.

You may lodge a complaint with the data-protection authority where you live or work or where you believe an infringement occurred. UK users may complain to the Information Commissioner's Office. We encourage you to contact us first so we can try to resolve the issue.

9. Rights in Canada, Australia, Brazil, and other regions

Privacy laws in other countries may provide additional rights. Where applicable, you may ask whether we hold information about you, request access or correction, challenge the accuracy or lawfulness of processing, request deletion or portability, withdraw consent, or complain about how we handle information.

Canadian users may request access and correction and challenge our compliance. Australian users may request access or correction and make a privacy complaint. Brazilian users may exercise applicable LGPD rights, including confirmation, access, correction, deletion or anonymization where available, portability, and consent withdrawal. Users elsewhere may exercise the rights provided by their applicable local law.

Submit requests or complaints to Drive@MyFavi.com. We will respond within the period required by applicable law and explain any lawful reason we cannot fulfill all or part of a request. You may also contact the privacy regulator in your jurisdiction.

10. Automated processing

MyFavi does not use personal information to make solely automated decisions that produce legal or similarly significant effects. Automated security systems, including Firebase Authentication, reCAPTCHA, and rate limits, may temporarily block an account or submission that appears abusive. Contact us if you believe a legitimate request was blocked.

11. Security

We use technical and organizational safeguards appropriate to the service, including encrypted transport, Firebase Authentication, email-enumeration protection, password rules, input validation, bot verification, rate limiting, server-controlled database writes, restricted storage rules, and security headers. No online system can guarantee absolute security.

12. International processing and transfers

MyFavi and its providers may process information in the United States and the European Economic Area, as well as other countries where their infrastructure or personnel operate. Firebase Authentication is operated from the United States.

When applicable law restricts international transfers, we rely on provider contractual commitments, adequacy decisions, standard contractual clauses, or another legally recognized mechanism as appropriate. You may request information about applicable transfer safeguards by contacting us.

13. Age requirement

MyFavi is a general-audience service and is not directed to minors. You must be at least 18 years old to create an account or use account-only features. If we learn that an account was created by someone under 18, we may disable the account and delete or de-identify associated information, subject to legal and security requirements. Contact us if you believe a minor has created an account.

14. Changes to this policy

We may update this policy when our practices or legal obligations change. The active version will show its effective date, and we will provide additional notice when appropriate for a material change.

15. Contact us

Privacy, account, and deletion requests may be sent to Drive@MyFavi.com.