Car Crash Desk (“Company,” “we,” “us,” or “our”) is a legal referral and connection service. This Privacy Policy (“Policy”) governs how we collect, use, disclose, sell, and otherwise process Personal Information (defined below) from individuals (“you,” “your,” or “User”) who visit www.carcrashdesk.com (the “Website”), interact with our online advertisements, or submit inquiries through our platform seeking to be connected with legal service providers (collectively, the “Services”).

By accessing, browsing, submitting information to, or otherwise using the Website or Services, you expressly acknowledge that you have read, understood, and voluntarily consent to each and every data practice disclosed in this Policy. This Policy is a legally binding agreement and forms an integral part of our Terms of Service. If you do not agree to any provision of this Policy, your sole and exclusive remedy is to immediately cease all use of the Website and Services.

1. Our Commitment to Privacy and Confidentiality

Car Crash Desk is a referral and connection platform, not a law firm. We do not provide legal advice, legal representation, or legal services of any kind. No attorney-client relationship is formed between you and Car Crash Desk.

Our core business is connecting individuals who have expressed interest in legal representation with third-party attorneys and law firms who are part of our network (“Attorneys” or “Attorney Network”). When you submit your information to us, you are expressly requesting to be connected with an Attorney who may evaluate your potential legal matter. We facilitate this connection by transferring your information to one or more Attorneys in exchange for monetary compensation. This activity constitutes a “sale” of Personal Information under certain state privacy laws, including the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA). We transparently disclose this practice throughout this Policy.

We are committed to safeguarding the privacy, confidentiality, and security of Personal Information. We adhere to all applicable federal, state, and international privacy and data protection laws, including but not limited to the Telephone Consumer Protection Act (TCPA), the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), the Utah Consumer Privacy Act (UCPA), the Nevada Privacy of Information Collected on the Internet from Consumers Act (NRS 603A), the Florida Digital Bill of Rights (FDBR), applicable sections of the European Union General Data Protection Regulation (GDPR) where relevant, the CAN-SPAM Act, and all other applicable state and federal laws governing data privacy, electronic communications, and consumer protection.

2. Definitions of Key Terms

For purposes of this Policy, the following definitions apply:

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household. This includes identifiers such as a real name, postal address, online identifier, Internet Protocol (IP) address, email address, telephone number, or other similar identifiers, as well as commercial information such as records of your inquiry regarding a personal injury, motor vehicle accident, or other legal matter.

“Sensitive Personal Information” means Personal Information that reveals a consumer’s social security number, driver’s license number, state identification card number, passport number, account log-in credentials, precise geolocation data, racial or ethnic origin, religious or philosophical beliefs, union membership, the contents of a consumer’s mail, email, and text messages unless the business is the intended recipient, genetic data, biometric information, or information concerning a consumer’s health, sex life, or sexual orientation. We do not intentionally collect Sensitive Personal Information unless you voluntarily provide health-related details within a free-form case description field.

“Sale” or “Sell” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating a consumer’s Personal Information by the business to a third party for monetary or other valuable consideration. Car Crash Desk Sells Personal Information to our Attorney Network as disclosed herein.

“Share” or “Sharing” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating a consumer’s Personal Information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration.

“Processing” means any operation or set of operations performed on Personal Information, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction.

“Service Provider” means a person or entity that processes Personal Information on behalf of Car Crash Desk and is bound by a written contract with strict confidentiality, data protection, and data use limitations.

“Third Party” means a person or entity that is not the User, Car Crash Desk, or an entity that is a Service Provider or contractor of Car Crash Desk. Attorneys in our Network are Third Parties for purposes of this Policy.

3. Categories of Personal Information We Collect

We collect information about you from multiple sources. Over the preceding twelve (12) months, we have collected, and continue to collect, the following categories of Personal Information:

a. Identifiers You Voluntarily Provide Directly to Us

When you complete an intake form, interact with a chatbot, send an email, communicate with us via telephone or SMS, or otherwise submit an inquiry, we collect: full legal name (first and last name); primary telephone number and any alternate telephone numbers; email address; postal or residential zip code; state and county of residence; details regarding your legal matter, case type, accident type, or personal injury (including but not limited to motor vehicle accidents, car crashes, trucking accidents, motorcycle accidents, pedestrian accidents, bicycle accidents, wrongful death, slip and fall, premises liability, product liability, medical malpractice, nursing home abuse, workplace injuries, and any other incident description); a free-form narrative description of your legal matter, which may contain health-related or other sensitive details you choose to voluntarily disclose; confirmation that you are at least eighteen (18) years of age; and any other information, details, or identifiers you voluntarily provide through correspondence, attachments, or communications with us.

b. Technical and Automatically Collected Information

When you navigate, browse, or interact with the Website, our servers, and authorized third-party Service Providers automatically log, collect, and store certain technical information, including: Internet Protocol (IP) address and derived approximate geographic location (city, state/region, country); browser type, browser version, and browser language settings; operating system type, version, and platform; device type, device model, hardware model, and unique device identifiers (including mobile advertising identifiers); Internet Service Provider (ISP) or mobile carrier name; referring URL, source website, exit pages, and clickstream data; date and time stamps of access, pages visited, duration of visit on each page, and total session duration; and information collected via Cookies, Web Beacons, Pixels, Tags, and similar tracking technologies (see Section 10, Cookie Policy and Tracking Technologies).

c. Consent and Verification Data via TrustedForm

To maintain a legally verifiable record of your express written consent to be contacted, we utilize TrustedForm, a consent verification technology provided by ActiveProspect, Inc. When you submit information on our Website, a unique TrustedForm certificate is generated that captures: the exact date and time stamp of your submission; the specific URL of the page on which you provided consent; a replayable session recording documenting your complete interaction with the form, including text entered, checkboxes clicked, and all other actions leading up to and including the moment of consent submission; and browser metadata, device metadata, and other contextual technical data. This data serves as verifiable proof of your affirmative express written consent under the TCPA and other applicable legal requirements. ActiveProspect acts as our Service Provider and is contractually bound to process this data exclusively on our behalf. For more information, please see ActiveProspect’s Privacy Policy at https://activeprospect.com/privacy-policy/.

d. Third-Party and Publicly Available Information

We may receive, collect, or supplement your Personal Information from the following additional sources: referral partners and marketing affiliates (third-party partners, publishers, affiliate marketers, and referral aggregators who display our advertisements, landing pages, or intake forms may forward the information you submit to us for matching and connection with an Attorney); data enhancement and validation providers (we may use third-party services to validate, verify, correct, or supplement the information you provide, including confirming zip code accuracy, verifying phone number validity, and appending demographic or other data attributes); publicly available sources (for purposes of compliance, verification, fraud prevention, and identity validation, we may consult public records, government databases, court filings, professional licensing databases, and other legally accessible data sources); and social media and advertising platforms (if you interact with our pages, advertisements, or sponsored content on platforms such as Meta, Google, Microsoft, LinkedIn, TikTok, or others, we may receive aggregated analytics, conversion data, and certain contact information or identifiers).

4. Purposes for Collection and Legal Bases for Processing

Your Personal Information is collected, processed, sold, and shared for the following explicit business and commercial purposes, grounded in the following legal bases where applicable:

To connect you with and transfer your Personal Information to one or more Attorneys or law firms from our Attorney Network based on your case details, geographic location, and practice area needs in exchange for monetary compensation. Legal Basis: Performance of a contract or steps taken at your request prior to entering a contract; Consent; Legitimate Interest (core business operations).

To verify your identity, confirm you are at least eighteen (18) years of age, validate the authenticity of your submission, and prevent fraudulent, duplicative, or unauthorized inquiries. Legal Basis: Legitimate Interest (fraud prevention, data integrity); Legal Obligation.

To facilitate communications, including responding to your inquiries, confirming submission receipt, providing status updates, and delivering follow-up messages via telephone, SMS, email, or other electronic means. Legal Basis: Performance of a contract; Consent.

To provide your Personal Information to Third-Party Service Providers who perform essential business functions on our behalf (e.g., web hosting, data storage, analytics, session recording, SMS/email delivery, customer relationship management). Legal Basis: Legitimate Interest (operational efficiency); Consent, where required.

To serve targeted advertising and content, engage in cross-context behavioral advertising, and measure, optimize, and report on the effectiveness of our marketing campaigns and referral activities. Legal Basis: Consent, for cookies and trackers; Legitimate Interest (marketing and business development).

To use session recording technologies (such as TrustedForm) to document and preserve user interactions as legally verifiable proof of consent for TCPA and other regulatory compliance. Legal Basis: Legal Obligation (TCPA compliance); Legitimate Interest (consent proof); Consent, where required.

To analyze Website traffic, usage patterns, user behavior, and conversion metrics to enhance functionality, content relevancy, security, and overall performance of our Services. Legal Basis: Legitimate Interest (business improvement, analytics).

To comply with all applicable legal obligations, including responding to court orders, subpoenas, civil investigative demands, regulatory inquiries, government audits, and enforcing our Terms of Service and other contractual agreements. Legal Basis: Legal Obligation; Legitimate Interest (rights enforcement).

To prevent, detect, investigate, and respond to fraud, security incidents, data breaches, unauthorized access, illegal activities, or any other potentially prohibited or harmful conduct. Legal Basis: Legal Obligation; Legitimate Interest (security, integrity).

In connection with a corporate transaction, including a merger, acquisition, reorganization, sale of all or substantially all assets, financing, due diligence, or similar event, where your Personal Information may be among the assets transferred or disclosed. Legal Basis: Legitimate Interest (business continuity, corporate restructuring); Consent/Notice as required by law.

5. Disclosures and Sales of Personal Information

Car Crash Desk Sells Personal Information to third-party Attorneys and law firms as part of our core referral and connection business. We also disclose Personal Information to Service Providers and other Third Parties as described below.

a. Sale of Personal Information to Attorney Network

When you submit your information and request to be connected with legal representation, we transfer your Personal Information to one or more Attorneys in our Network in exchange for monetary compensation. The Attorneys compensate us for this connection and the opportunity to evaluate your potential legal matter. This transaction is a “Sale” as defined by applicable state privacy laws. The categories of Personal Information we have sold in the preceding twelve (12) months include: identifiers (name, telephone number, email address, zip code); commercial information (case type, accident details, description of legal matter); and inferences drawn from your inquiry to match you with relevant practice areas. These sales are made to Attorneys, law firms, and legal marketing entities. We do not have actual knowledge that we sell the Personal Information of consumers under sixteen (16) years of age.

b. Disclosures to Service Providers

We disclose Personal Information to trusted Third-Party Service Providers and contractors who perform essential business, operational, and technical functions on our behalf. These Service Providers are contractually bound to process Personal Information only for the specific purposes we authorize and are prohibited from retaining, using, or disclosing your Personal Information for any other purpose. Categories of Service Providers include: hosting and infrastructure providers; analytics and session recording providers (e.g., ActiveProspect/TrustedForm, Google Analytics); communication and CRM providers; marketing, advertising, and ad-tech providers; data validation, enhancement, and anti-fraud providers; and professional service providers (attorneys, accountants, auditors, and legal advisors).

c. Disclosures for Legal and Safety Purposes

We may disclose Personal Information to government authorities, law enforcement agencies, regulatory bodies, courts, or other third parties if we have a good-faith belief that such disclosure is reasonably necessary to: comply with a valid legal process, including a court order, subpoena, civil investigative demand, or search warrant; enforce our Terms of Service, this Privacy Policy, or other applicable agreements and policies; respond to claims that any content, submission, or activity violates the rights of any third party; protect the rights, property, or personal safety of Car Crash Desk, its employees, Users, Attorneys, or the general public; detect, prevent, investigate, or otherwise address fraud, security breaches, illegal activity, or technical issues; or respond to an emergency involving a threat to life or physical safety.

d. Disclosures in Corporate Transactions

In the event Car Crash Desk is involved in a merger, acquisition, reorganization, sale of all or substantially all of its assets, financing, due diligence, or similar corporate transaction, your Personal Information may be disclosed, transferred, or sold as part of that transaction. You will be notified via a prominent notice on our Website and/or by email of any such change in ownership or control and any choices you may have regarding your Personal Information.

6. Data Security

We implement and maintain administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of your Personal Information. These measures include encryption of Personal Information in transit and at rest, role-based access controls, regular security monitoring, and mandatory data privacy and security training for all employees and contractors with access to Personal Information. Despite these measures, no method of transmission over the Internet or electronic storage is completely secure. We cannot and do not guarantee the absolute security of your Personal Information. In the event that your Personal Information is compromised as a result of a confirmed security breach, we will promptly notify you and relevant authorities as required by applicable laws.

7. Data Retention

Car Crash Desk retains Personal Information for as long as is reasonably necessary to fulfill the legitimate business and commercial purposes for which it was collected, or as required by applicable law, regulation, or contractual obligation, whichever is longer. Our specific retention criteria and determinations are based on factors including: the nature and sensitivity of the Personal Information; the purposes of the processing; the duration necessary to provide our Services and fulfill your request to be connected with Attorneys; whether the data is subject to a legal hold, litigation hold, regulatory investigation, or other preservation obligation; statutory and regulatory record-keeping requirements, including those under the TCPA and the CAN-SPAM Act, which generally require retention for a minimum of four (4) to seven (7) years from the date of the last interaction or transaction; and TrustedForm session recordings, which are retained for the period mandated by our TCPA compliance obligations and our contractual agreement with ActiveProspect. Upon the expiration of the applicable retention period, we will securely delete, destroy, de-identify, or anonymize your Personal Information.

8. Your Rights Under Applicable State and International Privacy Laws

Depending on your state or country of residence, you may have certain rights regarding your Personal Information. Car Crash Desk is committed to honoring all verifiable consumer requests in accordance with applicable law.

a. For Residents of California (CCPA/CPRA Rights)

If you are a California resident, the CCPA/CPRA grants you the following specific rights:

Right to Know/Access: You have the right to request that we disclose to you: (i) the categories of Personal Information we have collected about you; (ii) the categories of sources from which the Personal Information was collected; (iii) the business or commercial purpose for collecting, selling, or sharing Personal Information; (iv) the categories of Third Parties to whom we disclose Personal Information; (v) the specific pieces of Personal Information we have collected about you; and (vi) the categories of Personal Information we have sold or shared and the categories of Third Parties to whom it was sold or shared.

Right to Delete: You have the right to request the deletion of Personal Information we have collected from you, subject to certain statutory exceptions (including, but not limited to, completing a transaction, detecting and preventing security incidents, debugging to identify and repair errors, exercising free speech rights, complying with a legal obligation, and other internal uses aligned with your expectations).

Right to Correct: You have the right to request the correction of inaccurate Personal Information we maintain about you.

Right to Opt-Out of Sale and Sharing: You have the absolute right to direct us to stop selling your Personal Information to Attorneys and to stop sharing your Personal Information for cross-context behavioral advertising. You may exercise this right by sending an email to this address privacy@carcrashdesk.com. We will honor your request and will not sell or share your data going forward.

Right to Limit Use and Disclosure of Sensitive Personal Information: As stated in Section 2, we do not intentionally collect Sensitive Personal Information, and we do not use or disclose any Sensitive Personal Information for purposes beyond those authorized by the CCPA/CPRA that would give rise to this right.

Right to Non-Discrimination: We will not discriminate or retaliate against you for exercising any of your CCPA/CPRA rights. This means we will not deny you goods or services, charge you different prices or rates, provide a different level or quality of goods or services, or suggest that you will receive a different price or rate.

b. For Residents of Virginia, Colorado, Connecticut, Utah, and Florida

If you are a resident of Virginia, Colorado, Connecticut, Utah, or Florida, you have rights that may include: the right to confirm whether we process your Personal Information and to access it; the right to correct inaccuracies; the right to delete your Personal Information; the right to obtain a portable copy of your data; and the right to opt out of the sale of Personal Information, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects. Car Crash Desk sells Personal Information and engages in targeted advertising. You may opt out by using the mechanisms described below.

c. For Residents of Nevada (NRS 603A)

Nevada residents have the right to opt out of the sale of certain “covered information.” Car Crash Desk sells covered information as part of our referral and connection business. To exercise your right to opt out, please submit a request as described in Section 9.

9. Exercising Your Rights: Verification Process, Appeals, and Timing

To exercise any of the privacy rights described in this Policy, you or an authorized agent legally empowered to act on your behalf must submit a verifiable consumer request using one of the following dedicated methods:

Opt-Out of Sale/Sharing: Send an email to privacy@carcrashdesk.com to opt-out.

Verification Process: To protect the security and privacy of your Personal Information, we must verify your identity before fulfilling any access, deletion, or correction request. The verification process will vary depending on the nature and sensitivity of the request. Typically, we will match the identifying information you provide in your request (e.g., name, email address, telephone number) against the data we currently maintain in our systems. For certain sensitive requests, we may require additional verification. An authorized agent must provide a valid power of attorney or written, signed authorization from you and must independently verify their own identity with us.

Response Timing: We will acknowledge receipt of your request within ten (10) business days and will endeavor to respond substantively within forty-five (45) calendar days. If we require additional time (up to an additional forty-five (45) days), we will notify you in writing of the reason for the extension. Opt-out requests for the sale or sharing of data will be processed within fifteen (15) business days.

Appeals Process: If you are a resident of Virginia, Colorado, Connecticut, or Florida and we decline to take action on your rights request, we will inform you of the reasons for our denial. You may submit an appeal within sixty (60) days of receiving our decision by emailing privacy@carcrashdesk.com with the subject line “Appeal of Consumer Rights Request.” We will provide a written response to your appeal within sixty (60) days, explaining the reasons for our decision and, if denying the appeal, informing you of how to submit a complaint to the appropriate state Attorney General.

10. Cookie Policy and Tracking Technologies

This Section constitutes our complete Cookie Policy and is integrated within this Privacy Policy.

a. What Are Cookies and Similar Technologies?

“Cookies” are small text files that a website saves on your computer, mobile device, or tablet when you visit the site. Cookies are widely used to make websites function efficiently, remember user preferences, and provide analytical information to website operators. “Web Beacons” (also known as pixel tags, clear GIFs, or tracking pixels) are tiny graphic files embedded in web pages or emails that allow us and our partners to monitor user activity. “Scripts” and “Tags” are pieces of code that execute specific functions. We collectively refer to all of these as “Cookies” in this section.

b. Categories of Cookies We Use

We classify all Cookies used on our Website into four distinct categories:

Strictly Necessary Cookies (Always Active): These Cookies are essential and non-negotiable. They are required for the Website to function, for you to navigate the site, and for us to provide core security features. You cannot opt out of these Cookies; the Website cannot function without them.

Performance and Analytics Cookies: These Cookies collect anonymous, aggregated, and pseudonymized information about how visitors use our Website. They allow us to count visits, identify traffic sources, measure page popularity, and understand user navigation patterns so we can measure and improve site performance. We use services such as Google Analytics for this purpose. These Cookies are only deployed with your affirmative consent.

Functional Cookies: These Cookies enable the Website to provide enhanced functionality, personalization, and customized features. They may be set by us or by third-party providers whose services we have added to our pages (e.g., chat widgets, video players). If you disable these Cookies, some or all of these enhanced services may not function properly or may be unavailable.

Targeting and Advertising Cookies: These Cookies are set through our Website by us and our advertising partners (e.g., Meta, Google, Microsoft). They may be used to build a profile of your interests, serve relevant advertisements to you on other websites, and measure the effectiveness of our advertising campaigns. If you disable these Cookies, you will still see advertisements, but they will be less relevant and less targeted. These Cookies are only deployed with your affirmative consent.

c. Your Choices and Control

Upon your first visit to our Website, a prominent Cookie Consent Banner will be displayed. This banner provides you with clear, unambiguous options:

Accept All Cookies: By clicking this button, you grant your affirmative consent to the placement and use of all categories of Cookies described above.

Reject All Non-Essential Cookies: By clicking this button, you decline all cookies except those classified as Strictly Necessary. Only essential cookies will be placed on your device.

Customize Settings: By clicking this button, a detailed Preference Center panel will open, allowing you to toggle each category of non-essential cookies on or off according to your granular preferences.

You have the right to withdraw or modify your consent at any time. You can send an email to privacy@carcrashdesk.com for these updates or to opt-out.

d. Third-Party Cookies

Some Cookies on our Website are placed by third-party services we partner with. These may include: ActiveProspect (TrustedForm) for recording and verifying your consent as described in Section 3(c) (ActiveProspect’s Privacy Policy is available at https://activeprospect.com/privacy-policy/); Google Analytics for tracking and reporting on Website traffic and user behavior (Google’s Privacy Policy is available at https://policies.google.com/privacy); and Meta Pixel (Facebook) for tracking conversions from our Meta (Facebook/Instagram) advertising campaigns and enabling retargeting.

e. “Do Not Track” Signals and Global Privacy Control (GPC)

Our Website currently does not respond to browser-based “Do Not Track” (DNT) signals due to a lack of uniform industry standard. However, we do recognize and process the Global Privacy Control (GPC) signal as a valid opt-out of the sale and sharing of Personal Information for users in applicable jurisdictions. If your browser is configured with GPC, we will automatically treat your visit as an opt-out of sales and sharing for that browser and device.

11. Third-Party Links and Services Disclaimer

The Website may contain hyperlinks, banners, or other references to third-party websites, landing pages, or services that are not owned, operated, or controlled by Car Crash Desk. This includes, without limitation, links to Attorneys’ own websites, legal directories, and other external resources. We provide these links solely for your convenience and informational purposes. Car Crash Desk does not control, is not responsible for, and assumes no liability for the content, accuracy, privacy policies, data collection practices, security, or any other aspect of any third-party website or service. The inclusion of any link does not constitute or imply our endorsement, sponsorship, or recommendation. We strongly encourage you to carefully review the privacy policy and terms of service of every website you visit before disclosing any Personal Information. You access and interact with all third-party links, sites, and services entirely at your own risk.

12. International Data Transfers

Our Website is operated from and intended for users located in the United States of America. If you are accessing the Website from outside the United States, including from the European Economic Area, the United Kingdom, Canada, or any other jurisdiction, please be aware that your Personal Information will be transferred to, stored, and processed in the United States. The data protection laws of the United States may not be as comprehensive or protective as those in your country of residence. By using the Website and providing your Personal Information, you explicitly consent to the transfer of your information to the United States and the processing of it in accordance with this Privacy Policy.

13. Modifications and Updates to this Privacy Policy

We reserve the right, in our sole and absolute discretion, to update, modify, supplement, amend, or replace any and all parts of this Privacy Policy at any time and for any reason without prior notice to you. The most current version of the Policy will always be posted on the Website.

It is your sole and ongoing responsibility to review this Policy periodically for any updates or modifications. Your continued access to or use of the Website following the posting of any revised Policy constitutes your unconditional, binding acceptance of and consent to the changes. If we make material changes to this Policy, we will provide a more prominent notice, such as a banner on the Website homepage or a direct notification sent to the email address we have on file for you, as required by applicable law.

14. Severability

If any provision of this Privacy Policy is held by a court, arbitrator, or other tribunal of competent jurisdiction to be invalid, illegal, unenforceable, or void for any reason, such provision shall be deemed modified to the minimum extent necessary to make it valid, legal, and enforceable while preserving its original intent, or, if such modification is not possible, shall be severed from this Policy. The invalidity of any such provision shall not affect the validity and enforceability of the remaining provisions, which shall continue in full force and effect to the fullest extent permitted by law.

15. Contact Information

For any questions, concerns, complaints, or to exercise any of your rights as set forth in this Privacy Policy, please contact us at:

Car Crash Desk

Email: privacy@carcrashdesk.com