Privacy Policy

Last updated: April 19, 2026

The Exchange (the "Service") is operated by Obsidian River LLC ("we", "us"), based in Tuscaloosa, Alabama, USA. This Privacy Policy explains what information we collect when you use The Exchange, how we use it, who we share it with, and how you can control it.

What we collect

• Contact information you give us: first name, last name (if you provide it), mobile phone number, email address (if you provide it), preferred contact time.
• Vehicle information you give us: year, make, model, trim, mileage, VIN (if you provide it), title status, payoff status and amount, accident history, mechanical and body condition, modifications, service records, asking price, selling urgency, and your location (city, zip code, state).
• SMS conversation content: the text messages you exchange with our AI assistant Riley during your listing intake.
• Technical metadata: timestamps of messages, Twilio message identifiers, session identifiers, and — if you submit the web form — the source URL parameters that brought you to our site (for basic marketing attribution).

We do not collect Social Security numbers, bank account or credit card information, driver's license numbers, or any government-issued identification.

How we use your information

We use the information you provide for the following purposes:

• To create and manage your vehicle listing in The Exchange's system.
• To conduct the SMS conversation with you that captures the listing details (via Twilio for delivery and Anthropic's Claude API for the conversation brain).
• To share your listing with The Exchange's reseller-buyer network so they can make offers on your vehicle — see the next section for details.
• To respond to your support questions.
• To meet our legal and regulatory obligations.

How we share your information (the reseller network)

The core purpose of The Exchange is to connect private-party sellers with a network of licensed reseller-buyers (dealers, wholesalers, independent auto buyers). To do this, we share the following with resellers who access your listing:

• Your first name and phone number (so they can contact you).
• All vehicle details you provided during the intake.
• Your general location (city and zip, not street address).
• Your preferred contact time.

We only share your listing with resellers who have signed The Exchange's reseller terms, which restrict their use of your information to contacting you about your specific vehicle. Resellers may not add you to marketing lists, share your information with unrelated parties, or contact you about anything other than your vehicle.

We do not sell, rent, or share your contact information with any other third parties. We do not use your information for advertising purposes outside of the The Exchange service. We do not send you marketing messages outside of your active intake conversation.

Service providers

We use the following service providers to operate The Exchange. They process data on our behalf and are contractually bound to protect it:

• Amazon Web Services (AWS) — hosting, data storage, and application infrastructure (DynamoDB, Lambda, S3, CloudFront, Route 53, Secrets Manager, SES).
• Twilio — SMS delivery.
• Anthropic — the Claude AI model that powers the Riley conversational agent.
• Stripe — payment processing for reseller-buyer claim fees. Stripe collects payment card information directly; we never see or store card numbers.
• Google Analytics (GA4) — anonymous aggregate traffic and behavior measurement on our website. GA4 uses first-party cookies and IP addresses to report on visits, sessions, page views, and conversion events. We do not link analytics data to your listing, buyer account, or SMS conversation.

Cookies and analytics

We use a small number of first-party cookies for session management (keeping you signed in to the reseller dashboard) and for Google Analytics. You can block or delete these through your browser settings; blocking analytics cookies will not affect your ability to use the site. We do not use third-party advertising cookies.

To opt out of Google Analytics across all websites, install Google's opt-out browser add-on.

How long we keep your information

• Conversation session data: 30 days.
• Active vehicle listings: 7 days, then automatically expired.
• Seller profiles and historical listings: retained until you request deletion.
• Web-form submissions: 48 hours if the SMS conversation never starts; otherwise linked to your seller profile.

Your choices

• Opt out of SMS at any time by replying STOP, CANCEL, UNSUBSCRIBE, END, or QUIT to any of our messages. This stops all future messages immediately.
• Request access, correction, or deletion of your information by emailing hello@theexchangehq.com. We'll respond within 30 days.
• Stop your listing at any point before a reseller has claimed it. Email us and we'll withdraw it.

Security

Your information is stored in AWS with encryption at rest using AWS-managed KMS keys. Conversation messages travel between your phone and our system over the carrier's SMS infrastructure and are encrypted in transit to AWS. Secrets (API keys) are held in AWS Secrets Manager and never appear in our application code.

Children

The Exchange is not intended for use by anyone under 18. We do not knowingly collect information from children.

Changes to this policy

We may update this Privacy Policy from time to time. We'll post the new version here with a revised "Last updated" date. Material changes that affect how we use your existing data will be communicated to active users via SMS.

Contact us

For privacy questions, requests, or complaints:
Obsidian River LLC
Tuscaloosa, AL
hello@theexchangehq.com