Legal
Privacy policy
Effective date: August 6, 2026
1. Data ClearLot stores
ClearLot receives vehicle impound records submitted by tow operators at the time of intake. Each record contains information about the towed vehicle and the impound facility. The fields stored include:
- License plate number and issuing state
- Vehicle Identification Number (VIN)
- Make, model, year, and color
- Date and time of tow
- Address where the vehicle was towed from
- Impound lot name, address, and phone number
- Release fee and release instructions (when provided by the operator)
- Pickup status and pickup confirmation date
- Vehicle registrant date of birth (stored internally; never returned in any response)
- Vehicle registrant address from registration (stored internally; never returned in any response)
Registrant date of birth and registrant address are stored solely for identity verification purposes. They are never included in any API response or search result.
2. Who can access vehicle records
ClearLot operates two access tiers. No vehicle record data is returned to unauthenticated or unverified requests.
B2B subscribers
Tow companies, insurers, fleet operators, and other businesses with a documented permissible purpose under the Driver's Privacy Protection Act (DPPA, 18 U.S.C. §§ 2721(b)).
Access requires: business verification (EIN or business license), a signed permissible-purpose attestation naming the specific DPPA-enumerated use, per-request API authentication, and multi-factor authentication on account login.
B2B subscribers receive the full vehicle record, excluding registrant date of birth and registrant address, which are never returned to any outside party.
Vehicle owners (self-lookup)
The registered vehicle owner may look up their own record at no charge. Identity verification is required before any results are returned. To verify, the requester must supply their license plate number, state, and date of birth. Both must match the stored record.
On a verified match, the owner receives: vehicle make, model, year, color, tow date and time, impound lot name, address, and phone number, release fee and instructions, and pickup status.
License plate number, VIN, and the pickup address are not returned to the consumer tier. Three failed identity-verification attempts within one hour locks the session for 24 hours. No information about whether a record exists for a given plate is disclosed on a failed match.
3. Audit log
Every search generates an audit log entry regardless of access tier or result. Audit logs are write-once and immutable.
Each log entry records: a timestamp, a hashed IP address (never the raw IP), the access tier used, a hash of the search input (never the raw plate or VIN), the number of records returned, and, for B2B searches, the permissible-purpose attestation reference.
Audit logs contain no raw personal information. All search inputs are stored as SHA-256 hashes only. Audit logs are retained for a minimum of two years and operationally for three years. They are not deleted in response to vehicle record deletion requests; the audit record is a compliance document, not a vehicle record.
4. Data retention periods
| Condition | Retention period |
|---|---|
| Vehicle retrieved (pickup confirmed) | 90 days from pickup confirmation date |
| Pickup not confirmed | 180 days from tow date |
| Deletion request (verified) | Purged within 30 days of verification |
| Active legal hold | Suspended until hold is lifted |
Audit log entries are retained for a minimum of two years. The default operational policy retains them for three years.
5. Deletion requests
Registered vehicle owners may request deletion of their record by emailing privacy@clearlot.sogood.business.
The process:
- 1Request received. ClearLot generates a deletion ticket and confirms receipt within 48 hours.
- 2Identity verification required before deletion: the requester must supply their license plate number, state, date of birth, and last four digits of their Social Security number via a secure web form.
- 3Upon verification, the vehicle record is purged from the database within 30 days.
- 4Audit log entries referencing the deleted record are not purged. The audit log is a compliance record and contains only hashed values.
- 5The requester receives written confirmation of deletion.
6. Contact
For privacy inquiries, data requests, or deletion requests, contact: privacy@clearlot.sogood.business