Effective date: September 28, 2026. Notice version 3.0. This notice replaces all earlier versions.
Who we are
Good Car Bad Car (www.goodcarbadcar.net) is published by Leetone Enterprises LLC, 6312 S Fiddlers Green Cir, Suite 300E, PMB 5307, Greenwood Village, CO 80111, USA. Leetone Enterprises LLC is the data controller for the personal data described in this notice. Questions and requests: [email protected].
The short version
- Reading the site is free and does not require an account. Your browser sends us technical data, such as your IP address and the pages you visit, which we use to run, secure and measure the site.
- If you subscribe to a newsletter, become a member, comment or fill in a form, we collect what you give us and use it for that purpose.
- Free visitors see ads served by Raptive. Advertising partners use cookies and similar identifiers to show and measure ads. You can manage this through the consent and ad preferences tools on the site and the opt-outs listed below. Members do not see ads.
- We do not sell your name or email address. Under California law, some advertising data sharing counts as a “sale” or “sharing” of personal information, and you can opt out.
What we collect and why
Visiting the site
Our servers, Cloudflare and our security tools record your IP address, browser and device type, the pages you request, the referring page and the time of each request. We use this to deliver pages, to detect and block abuse and attacks, and to fix errors. Server logs are kept for about 30 days. We also derive your approximate location (country or region) from your IP address, using an IP geolocation service, to serve the right content and to report where our readers are.
We use Google Analytics to understand how the site is used: pages viewed, traffic sources, approximate location and device type. Google’s handling of this data is described at policies.google.com/technologies/partner-sites, and you can opt out with the Google Analytics opt-out browser add-on.
Newsletters
When you sign up for a GCBC email, we collect your email address, and your name if you give it. Emails are sent through SendGrid (Twilio) and contain standard open and click tracking so we know which content is useful. Every email has an unsubscribe link, and unsubscribing stops the emails immediately.
Membership
Memberships are handled by Memberful. When you join, Memberful collects your name, email address and payment details, and payments are processed by Stripe. We never see your full card number. Sign-in uses a link sent to your email or a password you set in your Memberful account. We use your membership record to give you member access, to send you the member newsletter and service messages about your account, and to meet our tax and accounting obligations. You can update your details or cancel at any time from your account page.
Forms, comments and correspondence
Contact forms collect your name, email address and message so we can reply. Comments collect your name, email address, the comment itself and your IP address, and are checked for spam by Akismet (Automattic). If you email us, we keep the correspondence for as long as needed to deal with it.
Advertising
CMI Marketing, Inc., d/b/a Raptive (“Raptive”) is a service provider of this Site for the purposes of placing advertising on the Site, and Raptive will collect and use certain data for advertising purposes. To learn more about Raptive’s data usage, click here: https://raptive.com/creator-advertising-privacy-statement
Raptive and its advertising partners, including Google, use cookies, device identifiers and similar technologies to show ads, limit how often you see them, measure their performance and, where you have allowed it, tailor them to your interests. In the European Economic Area, the United Kingdom and other regions that require it, you are asked for consent before advertising cookies are set, and you can change your choices at any time through the privacy or ad preferences link that appears in the site footer for visitors in those regions.
The site also includes the Meta Pixel, which lets us measure the results of advertising we run on Facebook and Instagram and show our ads to people who have visited the site. Meta’s privacy policy is at facebook.com/privacy/policy, and you can control ad personalization in your Facebook ad settings. To opt out of interest-based advertising more broadly, use optout.aboutads.info, thenai.org/how-to-opt-out or, in Europe, youronlinechoices.eu.
Cookies
Cookies are small files stored by your browser. We use:
- Necessary cookies to keep you signed in as a member, remember your consent choices and protect the site from abuse.
- Analytics cookies (Google Analytics) to measure how the site is used.
- Advertising cookies set by Raptive and its partners, and the Meta Pixel, as described above. These are the only cookies on the site that follow you to other websites.
You can delete or block cookies in your browser settings. Blocking necessary cookies may stop member sign-in from working.
Legal bases (EEA and UK)
We process membership data to perform our contract with you. We rely on your consent for newsletters and for advertising and analytics cookies where the law requires it, and you can withdraw consent at any time. We rely on our legitimate interests in running, securing, measuring and funding a free publication for server logs, security, basic analytics and non-personalized advertising. We process data where we must in order to comply with the law.
Who we share data with
We share personal data only with the providers that run the site on our behalf, and only for the purposes above: Hetzner and RunCloud (hosting and server management), Cloudflare (content delivery, DNS and security), Google (analytics), Raptive and its advertising partners (advertising), Memberful and Stripe (memberships and payments), SendGrid/Twilio (email delivery), Automattic (Akismet spam filtering), Amazon Web Services (off-site backups), an IP geolocation service (approximate location) and Meta (the Meta Pixel). These providers process data under their own privacy policies and their contracts with us. We do not sell your name or email address to anyone. We will disclose data if the law requires it, to protect our rights or someone’s safety, or as part of a sale or transfer of the business, in which case this notice continues to apply to that data.
How long we keep data
Server and security logs: about 30 days. Analytics data: up to 14 months in Google Analytics. Newsletter subscriptions: until you unsubscribe, plus a suppression record so we do not email you again. Membership records: for the life of your account and for the period required for tax and accounting. Form submissions and correspondence: as long as needed to deal with your request. Backups are kept for a limited period and then overwritten.
Your rights and choices
Depending on where you live, you may have the right to know what personal data we hold about you, to receive a copy of it, to correct it, to delete it, to restrict or object to its processing, to withdraw consent, and to opt out of the sale or sharing of personal data and of targeted advertising. This includes rights under the GDPR and UK GDPR, the California Consumer Privacy Act, the Colorado Privacy Act and other US state privacy laws. We do not discriminate against you for exercising these rights.
- Advertising opt-outs: use the privacy or ad preferences link in the site footer (shown to visitors in regions that provide these rights, including the “Do Not Sell or Share My Personal Information” choice for California), the opt-out links above, or a browser signal such as Global Privacy Control, which we treat as an opt-out request where the law requires.
- Newsletter: use the unsubscribe link in any email.
- Membership data: update it in your account or email us.
- Everything else: email [email protected]. We may ask you to confirm your identity, usually by replying from the email address on record, and an authorized agent may act for you with your written permission. We respond within the time the applicable law allows, normally within 30 days (45 days for California requests).
If you live in the EEA or UK and believe we have not handled your data lawfully, you may complain to your local data protection authority.
International transfers
We are based in the United States and our servers are in the United States. If you visit from the EEA, the UK or elsewhere, your data is processed in the United States. Our providers that handle EEA and UK data rely on recognized transfer mechanisms such as the EU-US Data Privacy Framework, its UK Extension, or standard contractual clauses.
Children
The site is not directed to children under 16 and we do not knowingly collect personal data from them. If you believe a child has given us personal data, email us and we will delete it.
Security
We protect the site and its data with industry-standard measures, including encrypted connections (HTTPS), access controls, monitoring and regular backups. Payment details are handled entirely by Memberful and Stripe. No system is perfectly secure, so keep your sign-in links and passwords private.
Links to other sites
We link to manufacturers, industry bodies and other sources. Their sites have their own privacy practices, which we do not control.
Changes to this notice
When we change this notice we post the new version here with a new effective date. If a change materially affects how we use members’ personal data, we also email members.
Contact
Leetone Enterprises LLC, 6312 S Fiddlers Green Cir, Suite 300E, PMB 5307, Greenwood Village, CO 80111, USA. Email: [email protected].