Privacy Policy

Effective 14 August 2026 · Version 2.0. This Privacy Policy explains what personal information Exhaust IQ collects, why we collect it, who we share it with, and the choices You have. It forms part of our Terms and Conditions at exhaustiq.com/terms-conditions, and capitalized words have the meanings given there and in section 2 below.

This English version is the official text of this Privacy Policy. The French and Spanish versions are provided for convenience only; in the event of any discrepancy, the English version governs.

Website: www.exhaustiq.com · Email: info@exhaustiq.com

1. Who We Are

Exhaust IQ (“We”, “Us”, “Our”) operates the Website at https://www.exhaustiq.com and sells the Products described there. We are responsible for the personal information handled under this Policy — in some jurisdictions this makes us the “data controller” or the organization accountable for Your information.

We operate online only and do not maintain a public business address. The fastest way to reach Us about privacy is by email: info@exhaustiq.com.

2. Definitions

The definitions in our Terms and Conditions apply to this Policy. In addition:

  • Personal Information: information that identifies You or that can reasonably be linked to You, whether directly or in combination with other information.
  • User Content: as defined in the Terms — any image, photo, video, sample result or related information You upload or send to Us, including a photograph of a test vial submitted for a Report.
  • Report: the optional automated analysis available through the Website.
  • Products, Terms, Website, You: as defined in the Terms and Conditions.

3. Information We Collect

3.1 Information You give Us

  • Order information: Your name, email address, shipping and billing address, telephone number where provided, the items ordered, and the order total.
  • Payment information: payment card and transaction details are collected and processed by our payment providers, Stripe and PayPal. Apple Pay and Google Pay payments are processed through those same providers. We do not receive or store full payment card numbers. We receive confirmation of payment, the payment method type, and limited details such as the last four digits and the billing postal code.
  • User Content submitted for a Report: the photograph of the test vial and any vehicle or test details You choose to provide. See section 4.
  • Correspondence: the content of emails and support enquiries You send Us, including any attachments.
  • Optional submissions: anything else You choose to send Us, such as a product review or a Safety Data Sheet request.

3.2 Information collected automatically

  • Device and connection data: IP address, browser type and version, operating system, device type, language setting, and the referring page.
  • Usage data: pages viewed, time spent, links clicked, and the approximate general location derived from Your IP address (typically city or region level, not a precise position).
  • Cookie and tracking data: as described in section 7.

3.3 Information we do not intentionally collect

We do not ask for and do not want sensitive personal information — for example health, biometric, financial account, or government identifier data. Please do not send it to Us. As set out in the Terms, please also avoid capturing licence plates, vehicle identification numbers, faces or other identifying details in photographs You send Us. If You send Us such information anyway, we will delete it when we become aware of it, unless we are required to keep it.

4. Test Vial Photographs, Reports and Sample Data

This section explains how we handle the User Content You submit for a Report. It reflects the licence You grant Us under the section “Your Content and Sample Data” of the Terms.

You keep ownership of Your User Content. You grant Us a worldwide, royalty-free, non-exclusive licence to store, reproduce, analyse and adapt it for these purposes only:

  • to generate and deliver Your Report and provide customer support;
  • to improve, test and develop our Products, services and diagnostic models, including training our own analytical models; and
  • to create aggregated or de-identified data sets and reference material, which we may publish or share. De-identified means the material can no longer reasonably be linked to You or Your vehicle.

How the analysis is performed. The Report is generated by automated analysis that runs on our own systems — server-side code on the WordPress server we operate on a DreamHost virtual private server. Your photograph is not sent to any third-party artificial intelligence service. The image and any details You provide are stored on the hosting and database infrastructure we use (DreamHost and Supabase), which act as our service providers under contract and may not use Your User Content for their own purposes.

Automated decision-making. The Report is an estimate for informational purposes only, as stated in the Terms. It has no legal or similarly significant effect on You: it does not determine pricing, eligibility, or access to any service, and it is not a substitute for inspection by a qualified mechanic. You are free to disregard it. If You would like a human to review a Report, email info@exhaustiq.com.

If You submit a photograph without buying a Product, we still handle it under this section. We do not attempt to identify You from a photograph.

Deletion. You may ask Us to delete Your User Content at any time by emailing info@exhaustiq.com, and we will do so within a reasonable period — except for copies already incorporated into aggregated or de-identified data sets, which cannot be separated out, and copies we are required to retain by law.

Metadata in images. Photographs can carry embedded location data (EXIF GPS) and device identifiers. Please turn off location tagging in your camera before photographing a vial.

5. How We Use Your Information

We use Personal Information only for the purposes below:

  • To sell and deliver the Products — processing orders and payments, arranging shipping, handling returns, refunds and damage claims, and sending order confirmations and shipping notifications.
  • To provide the Report — as described in section 4.
  • To provide customer support — answering enquiries, sending Safety Data Sheets on request, and resolving disputes under the Terms.
  • To operate and secure the Website — hosting, maintaining, backing up, monitoring for fraud and abuse, and diagnosing technical faults.
  • To improve our Products and services — understanding how the Website is used and developing our diagnostic models.
  • To communicate with You — sending service messages about Your order or these policies, and, where You have asked for them, marketing emails. Every marketing email carries an unsubscribe link, and unsubscribing does not affect service messages about an order You have placed.
  • To comply with law — keeping tax and transaction records, responding to lawful requests, and enforcing the Terms.

We do not use Your information to make automated decisions that produce legal or similarly significant effects about You, and we do not use Your User Content to build profiles about You as an individual.

6. Legal Bases for Processing

Where the laws of the EEA, the United Kingdom, or a similar regime apply to You, we rely on the following legal bases:

  • Performance of a contract — to process and deliver Your order, provide the Report You requested, and handle returns and refunds.
  • Consent — for marketing emails, and for analytics and advertising cookies where consent is required. You may withdraw consent at any time; withdrawal does not affect processing already carried out.
  • Legitimate interests — to secure the Website, prevent fraud and abuse, improve our Products and diagnostic models, and understand how the Website is used. We balance these interests against Your rights and act only where they are not overridden.
  • Legal obligation — to keep tax, accounting and consumer-protection records, and to respond to lawful requests.

7. Cookies, Analytics and Advertising

Cookies are small files stored on Your device. We use them in three ways:

  • Strictly necessary cookies keep the Website working — remembering Your shopping cart, keeping the checkout secure, and balancing traffic. These cannot be switched off, and the Website will not function properly without them. Set by WooCommerce and our payment providers.
  • Analytics cookies tell Us how the Website is used — which pages are visited, how long visits last, and where visitors arrive from. We use Google Analytics for this.
  • Advertising cookies let Us measure the performance of our advertising and show relevant ads on other platforms. We use the Meta Pixel for this.

Your choices. You can block or delete cookies at any time in Your browser settings, and most browsers let You reject third-party cookies specifically. Blocking strictly necessary cookies will break checkout. You can also opt out of Google Analytics across all websites using the browser add-on linked below, manage Meta’s advertising settings from Your Facebook or Instagram account, or email info@exhaustiq.com and ask Us to exclude You from analytics and advertising tracking. Most browsers offer a “Do Not Track” setting; note that there is no agreed industry standard for responding to those signals.

Third-party tools. Google and Meta act as independent controllers for some of the data collected through their tools. Their own privacy policies apply: policies.google.com/privacy and facebook.com/privacy/policy. You can opt out of Google Analytics across all websites at tools.google.com/dlpage/gaoptout.

8. Who We Share Your Information With

We do not sell Your User Content or Your Personal Information for money. We share it only in the following situations:

  • Service providers who process information on our behalf under contract and confidentiality obligations, and only for the purposes we specify: website and email hosting (DreamHost), database storage (Supabase), payment processing (Stripe and PayPal), and shipping and fulfilment (ShipStation and the carriers it connects to).
  • Analytics and advertising partners as described in section 7, where You have allowed those cookies.
  • Professional advisers — lawyers, accountants and insurers, where reasonably necessary.
  • Legal and safety disclosures — where we are required to disclose information by law, court order or lawful request, or where disclosure is necessary to protect the rights, property or safety of Exhaust IQ, our customers, or the public.
  • A successor in a business transfer, as described in section 9.

A note on US state privacy laws. Although we do not sell Personal Information for money, the use of advertising cookies described in section 7 may be treated as a “sale” or as “sharing for cross-context behavioural advertising” under California and certain other US state laws. You can opt out at any time by blocking advertising cookies in Your browser as described in section 7, or by emailing info@exhaustiq.com. We do not knowingly sell or share the Personal Information of anyone under 16.

9. Business Transfer

If Exhaust IQ is sold, merged, restructured, or if all or part of its business or assets is acquired — or in the course of due diligence for any such transaction — User Content, customer records and associated data may be transferred to or shared with the other party as part of that transaction, subject to appropriate confidentiality protections. Any acquirer will be bound by these commitments in respect of that material until You are notified of, and given any choice required by law about, a change in how it is handled.

10. Where Your Information Is Stored and Sent

Exhaust IQ is based in Alberta, Canada. Your information is stored and processed primarily in the United States, where our hosting provider (DreamHost) and our database provider (Supabase) operate the servers we use. Our payment, shipping and analytics providers may also process information in the United States and in other countries where they operate.

Privacy laws in those countries may differ from those where You live, and information held there may be accessible to local courts, law enforcement and national security authorities. Where we transfer Personal Information out of the EEA or the United Kingdom, we do so under an adequacy decision or Standard Contractual Clauses, together with additional safeguards where needed. You may request a copy of the safeguards we rely on by emailing info@exhaustiq.com.

11. How Long We Keep Your Information

We keep Personal Information only as long as we need it for the purposes in section 5, then delete it or de-identify it:

  • Order and transaction records: kept for 7 years, to meet tax, accounting and consumer-protection obligations.
  • User Content submitted for a Report: kept indefinitely, so that it can continue to support our diagnostic models and reference material — or until You ask Us to delete it, whichever comes first. You can request deletion at any time by emailing info@exhaustiq.com, as described in section 4.
  • Aggregated or de-identified data sets: kept indefinitely. This material can no longer reasonably be linked to You or Your vehicle, and copies already incorporated into a data set cannot be separated out.
  • Support correspondence: kept for 3 years from the last message, or longer where it relates to a dispute or claim.
  • Website and analytics data: aggregated website statistics are kept indefinitely. Individual event-level analytics records are kept for the period configured in our analytics account, which our analytics provider limits to a maximum of 14 months.
  • Marketing contacts: kept until You unsubscribe, plus a minimal suppression record so that we do not contact You again.

Where a longer period is required to establish, exercise or defend a legal claim, or to comply with law, we keep the information for that period and no longer.

12. Security

We use reasonable technical and organizational measures to protect Personal Information, including encryption in transit (HTTPS), access controls limiting who can see customer data, and contractual confidentiality obligations on our service providers. Payment card data is handled by our payment providers under their own security standards and does not reach our systems.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach occurs that is likely to result in a risk to Your rights, we will notify You and the relevant regulator where the law requires it.

13. Your Privacy Rights

Subject to applicable law, You may ask Us to:

  • Access the Personal Information we hold about You, and receive an explanation of how it is used.
  • Correct information that is inaccurate or incomplete.
  • Delete Your Personal Information and User Content, subject to the exceptions in section 4 and any records we must keep by law.
  • Receive a copy of information You gave Us in a portable, machine-readable format, or have it sent to another organization where technically feasible.
  • Object to or restrict processing based on our legitimate interests, including profiling for advertising.
  • Withdraw consent at any time, where we rely on consent.
  • Unsubscribe from marketing at any time, using the link in any marketing email.

How to exercise a right. Email info@exhaustiq.com describing what You would like. We will respond within 30 days, or tell You within that period if we need longer and why. We may ask for information to verify Your identity — usually confirmation from the email address used for an order — and we will not ask for more than we need. Exercising a privacy right is free and will never affect the price You pay, the Products available to You, or the service You receive.

You may use an authorized agent to make a request where the law allows, and we may ask for proof of their authority.

14. Regional Rights

Canada

We handle Personal Information in accordance with Canadian federal and Alberta privacy legislation. You may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or to the Office of the Information and Privacy Commissioner of Alberta at oipc.ab.ca. We ask that You raise the matter with Us first so we can try to resolve it.

European Economic Area and United Kingdom

You have the rights in section 13 under the GDPR and UK GDPR, and the right to lodge a complaint with Your local supervisory authority.

California and other US states

You have the right to know what Personal Information is collected and how it is used and disclosed, to request deletion or correction, to opt out of “sale” or “sharing” as described in section 8, and not to be discriminated against for exercising these rights. The categories we collect, our purposes, and the categories of recipients are set out in sections 3, 5 and 8. We do not use or disclose sensitive personal information for purposes requiring a right to limit.

15. Children’s Privacy

The Products are not sold to children. As stated in the Terms, You must be at least 18 years old to purchase from Exhaust IQ, and the Website is not directed at children. We do not knowingly collect Personal Information from anyone under 18. If You believe a child has provided Us with Personal Information, email info@exhaustiq.com and we will delete it.

16. Embedded Content and Links to Other Websites

Pages on the Website may include embedded content such as videos or images hosted elsewhere. Embedded content behaves as if You had visited the other website directly: that website may collect data about You, set cookies, embed third-party tracking, and monitor Your interaction with the embedded content, including whether You are logged in to it.

The Website may also link to third-party websites and services. We do not control and are not responsible for their content, policies or practices. We encourage You to read their privacy policies before providing information to them.

17. Changes to This Policy

We may update this Policy from time to time. The current version, with its effective date and version number, is always posted at exhaustiq.com/privacy, and material changes will be highlighted there. Where the law requires it, we will notify You directly and, where consent is needed, ask for it before the change applies to information already collected.

18. Contact Us

For any question about this Policy, to exercise a privacy right, or to raise a concern about how Your information is handled:

Email: info@exhaustiq.com

If You are not satisfied with our response, You may contact the regulator in Your jurisdiction, as described in section 14.