Privacy Policy

Last updated: April 27, 2026

The short version: We only collect what we need to tow your vehicle, make you a cash offer on a car you want to sell, or list a vehicle for sale. We encrypt your contact info, we never sell your data, we don't run any tracking or advertising on the site, and you can opt out of texts anytime by replying STOP. If you sent us a sell-your-car form and we didn't end up buying it, we delete your info after 12 months automatically.

1. Your Phone Number and Text Messages

We do not sell, share, or disclose your mobile phone number or SMS opt-in data to any third parties or affiliates for marketing or promotional purposes.

Your phone number is used only to communicate about your tow or roadside service request. When you check the SMS consent box on our quote page, you agree to receive text messages from RPM's International LLC about your active service request only. This includes:

Job status updates (driver assigned, en route, arrived, completed)
Messages from your assigned driver relayed through our business number
Invoice delivery with a secure download link
Scheduling and dispatch updates

Message frequency varies — you will typically receive 3 to 8 messages per service request. Message and data rates may apply.

To stop receiving texts, reply STOP to any message. For help, reply HELP or call us at (908) 271-5474.

The only third party that handles your phone number is our SMS delivery platform (Twilio), which sends the texts on our behalf. They are not allowed to use your number for anything else.

2. What We Collect

What we collect depends on which form you use.

From the tow / roadside quote form

Your contact info: Name, phone number, and email address
Your vehicle info: Year, make, model, color, license plate number and state
Pickup and drop-off locations: Addresses and GPS coordinates
Service details: Type of service, vehicle condition, accessibility notes
Consent preferences: Whether you opted in to SMS updates and agreed to our privacy policy

From the "Sell your car to us" form

Your contact info: Name, phone number, optional email, optional best time to call
Your vehicle info: Year, make, model, mileage, color, condition (running / not running / barn find / accident / parts only), VIN if you choose to share it, optional notes
Pickup location: Address or nearest cross-streets so we can quote a free pickup
Anti-spam metadata: Your IP address and browser user-agent, captured automatically when you submit the form. We use these only to detect bot abuse and rate-limit the form, not to track you across the web.

This form does not accept photo uploads. We deliberately do not collect images of your vehicle through the website — if a picture would help us make an offer, we ask for it on the phone instead.

If you pay online

All online payments are processed by Stripe — credit/debit cards, Apple Pay, Google Pay, ACH bank transfers, and stablecoin (USDC) — on Stripe's hosted checkout page. We never see or store your card number, bank account number, or wallet address. What we receive from Stripe is limited to: the payment status, the last four digits of the funding source (for the receipt), and Stripe's internal payment identifier. See our Payment FAQ for details on how holds, charges, and receipts work, and Stripe's privacy policy for how Stripe handles your financial data.

From browsing our site

We do not run any analytics tools (no Google Analytics, no Facebook Pixel, no advertising tags, no behavioral tracking). The only cookies we set are strictly necessary for the site to function:

Session cookie (rpmi_session): keeps your form state during a quote, expires when you close the browser or after a few hours of inactivity.
CSRF token: protects forms against cross-site request forgery, stored inside the session cookie.

We do not need a cookie banner because we do not use any tracking, advertising, or analytics cookies. If you set "Do Not Track" in your browser, there is nothing for us to honor — we don't track you in the first place.

3. How We Protect Your Data

We take your privacy seriously. Here is how we protect your information:

Encryption at rest: Your name, phone number, email address, and contact notes are encrypted using AES-256-GCM (the same standard banks use) before being stored in our database. Even if someone accessed our database, they could not read your contact information without the encryption key.
Encryption in transit: All data between your browser and our servers is sent over HTTPS.
Access controls: Only authorized dispatch personnel and your assigned driver can see your information, and only for the duration of your service.
Temporary links: Invoice download links and driver portal links expire automatically and can only be used once.
Anti-abuse mechanisms: The sell-your-car form uses an invisible honeypot field, a minimum-fill-time check, and a per-IP rate limit to block automated submissions. None of this involves any third-party CAPTCHA or tracking service.
Photo handling on inventory listings: When the owner uploads a photo of a vehicle for sale, we strip all EXIF metadata (including any embedded GPS coordinates) and re-encode the image as JPEG before storing it. The original file is discarded.

4. Who Can See Your Info

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. The only people and services that access your data are:

Our dispatch team: To coordinate your service, follow up on a sell-your-car submission, or arrange a vehicle pickup.
Your assigned driver (tows / roadside only): Gets your name, phone number, and pickup/drop-off locations to complete the job.
Twilio (SMS delivery): Sends text messages on our behalf — cannot use your data for any other purpose.
Our email service: Sends email notifications (status updates, invoices) on our behalf.
Stripe (online payments): Processes all online transactions — cards, digital wallets, ACH bank transfers, and stablecoin — on its own hosted checkout page. We never handle your card, bank, or wallet details.
Our hosting provider: The server that runs this website. They can see network traffic but not the contents of encrypted database fields.

If you click through from our inventory page to a Facebook listing, you leave our site and Facebook's privacy policy applies. We are not responsible for Facebook's data practices.

5. Your Email Replies

If you reply to an email from us, your reply is automatically matched to your active job and forwarded to your assigned driver (if they have email forwarding enabled). Your email reply is stored in our system as part of the job's communication history.

6. The Sell-Your-Car Form

When you submit the "Sell your car to us" form at /car-sales/sell:

Your details land in a private dispatch inbox visible only to authorized RPM staff.
We aim to call you back within 48 business hours with a cash-offer conversation. We do not text or email marketing material as a result of submitting this form.
We may decide not to make an offer. You are not obligated to sell to us, and we are not obligated to buy.
We do not share the details you submit with anyone outside RPM. The information is used only to evaluate the vehicle and contact you about it.

7. Inventory Listings

The vehicles on our inventory page are owned by RPM. When the owner publishes a vehicle, we display a thumbnail photo, year/make/model, mileage, and the last 4 characters of the VIN. We never display the full VIN publicly — full VINs and additional photos live on the per-vehicle Facebook listing the tile links to.

If you contact us about an inventory vehicle, the conversation typically continues on Facebook and ends in person at our lot in Phillipsburg, NJ. Information shared during that off-site conversation is governed by Facebook's privacy policy and our standard handling of personal information described elsewhere in this document.

8. How Long We Keep Your Data

Tow / roadside service records: Kept for our business and tax records. Customer contact info is encrypted at rest the entire time.
Sell-your-car submissions where we did NOT buy the vehicle (status: new, contacted, offered, or declined): Automatically deleted 12 months after submission. A nightly job at our hosting provider runs this cleanup; nothing manual is needed.
Sell-your-car submissions where we DID buy the vehicle (status: closed): Kept indefinitely as a transaction record (for tax and titling purposes).
Invoice download links: Expire after 2 hours.
Driver and customer portal links: Expire after their configured time limit.
Photos of customer vehicles taken by drivers during service: Retained for 60 days, then automatically deleted.
Inventory vehicle photos: Kept while the listing is active. When a vehicle is marked sold or deleted from the inventory, the photo is removed from our storage.

9. Your Rights

Regardless of what state you live in, you have the following rights with respect to your personal information held by RPM:

Right to know what we have: Contact us and we'll tell you what personal information we hold about you and what we use it for.
Right to a copy: Request a portable copy of your personal information.
Right to correct: Tell us if anything we have on file about you is wrong, and we will fix it.
Right to delete: Ask us to delete your personal information. We will do so unless we are required to keep it for a specific legal reason (for example, a record of a vehicle we bought from you).
Right to opt out of "sale" or "sharing": We do not sell your personal information and we do not share it for cross-context behavioral advertising — but you have the right to opt out anyway, and you are automatically opted out by default.
Right to opt out of texts: Reply STOP to any message from us.
Right to non-discrimination: We will not deny you service, charge you a different price, or treat you differently because you exercised any of these rights.

To exercise any of these rights, call us at (908) 271-5474 or write to the contact below. We will verify your identity (typically by confirming details from your prior interaction with us) before acting on the request.

This policy is written to satisfy the strictest of US state privacy laws, including but not limited to the California Consumer Privacy Act (CCPA/CPRA), the Virginia Consumer Data Protection Act (CDPA), the Colorado Privacy Act (CPA), and similar laws in Connecticut, Utah, and Texas. If you are a resident of a state with additional rights not listed above, contact us and we will honor them.

10. Sensitive Personal Information

We do not collect Social Security numbers, driver's license numbers, financial account numbers, precise geolocation beyond pickup/drop-off addresses you provide, biometric data, health data, racial or ethnic origin, religious beliefs, sexual orientation, citizenship status, or contents of your private communications. The most sensitive thing we hold is your phone number, and that is encrypted at rest.

11. Children

Our services are not for anyone under 18. We do not knowingly collect information from minors. If you believe we have collected information from a minor, contact us and we will delete it.

12. Changes

If we update this policy, we will post the new version here with an updated date. Material changes (changes to what we collect, how we use it, or who we share it with) will be highlighted at the top of the page for at least 30 days.

13. Contact Us

RPM's International LLC
Phone: (908) 271-5474
Website: rpmsauto.org