Privacy Policy

Automate ("Automate," "we," "us," or "our") is a vehicle discovery experience operated by Carmax Philippines. Automate lets you browse vehicle inventory in a swipe-style interface and, if you're interested in a vehicle, connects you with a Carmax sales team over Facebook Messenger.

This Privacy Policy explains what information Automate collects, how we use and share it, and the choices you have. It applies to the public, customer-facing Automate web app at this domain. It does not apply to Carmax's internal content-management tools, which are only accessible to authorized staff.

Browsing and usage information

You can browse Automate without creating an account and without giving us your name, email, or phone number. As you use the app, we automatically collect:

• A random session identifier generated in your browser and stored in local storage, so we can tell repeat actions apart during your visit. This identifier is not linked to your name or any account.
• Interaction events, such as which vehicles you view, like, or pass on, and when you open Messenger to inquire about a vehicle.
• Technical information such as your browser's user agent, the page you're on, and a one-way cryptographic hash of your IP address. We do not store your raw IP address.

We do not use Google Analytics, Meta Pixel, advertising cookies, or other third-party ad-tracking tools in the browsing experience.

Information from Facebook Messenger

If you tap "Open Messenger" to ask about a vehicle, we generate a reference code linking your browsing session to that vehicle and open a conversation with Carmax's official Facebook Page. If you then send us a message, Meta's Messenger Platform shares certain information with us, including:

• Your Page-Scoped ID (PSID) — a Meta-generated identifier unique to you and our Facebook Page. It is not your Facebook account ID or username, and it doesn't work outside our Page.
• The content and metadata of messages you send to our Page (e.g., message text, timestamps, message ID).
• The referral information that lets us match your message to the vehicle you were asking about.

We do not request or receive your Facebook name, profile photo, friends list, or other profile information through this integration — only what Meta's Messenger Platform provides for the message itself. When we successfully match your message to a vehicle inquiry, our system may send you one short, automated acknowledgment referencing that vehicle so you know your inquiry was received.

• To operate the swipe/browse experience and show you relevant vehicles.
• To understand which vehicles and features generate interest, so we can improve inventory presentation.
• To connect your Messenger inquiry to the vehicle you were viewing, and to respond to you.
• To detect and prevent abuse, spam, and excessive automated requests (rate limiting).
• To allow authorized Carmax sales and support staff to follow up on inquiries you send us via Messenger.

We do not sell your personal information, and we do not use it for third-party advertising.

• Meta Platforms, Inc. — necessary to deliver and receive messages through Facebook Messenger when you choose to contact us that way.
• Infrastructure and hosting providers (such as our cloud hosting and image storage providers) — process data on our behalf solely to run the app and store vehicle photos; they do not use your information for their own purposes.
• Authorized Carmax Philippines staff — for customer service and sales follow-up on inquiries you initiate.

We do not share your information with data brokers or other third parties for marketing purposes.

Automate does not use tracking cookies. We use your browser's local storage to keep the session identifier described above and to remember whether you've already seen onboarding tips. Neither of these identifies you personally, and you can clear them at any time by clearing your browser's site data.

We retain browsing/session data and Messenger inquiry data for as long as reasonably necessary to fulfill the purposes described above — such as responding to your inquiry and improving the service — or until you request deletion. Data is periodically reviewed and removed when it's no longer needed.

Because most of the information we collect isn't tied to an account, we identify your records using details like your Messenger PSID, the approximate date/time you messaged us, or the vehicle you inquired about. To request access to, correction of, or deletion of your information, email us at [email protected] with whatever details you can provide (e.g., the vehicle you asked about and roughly when).

You can also stop receiving messages from us at any time by blocking or muting Carmax's Facebook Page, or by removing Automate's access under Facebook's Settings & Privacy → Business Integrations menu.

If you are in the Philippines, you also have rights under the Data Privacy Act of 2012 (Republic Act No. 10173), including the right to be informed, to access, to object, to erasure or blocking, and to file a complaint with the National Privacy Commission (NPC).

We apply reasonable technical and organizational safeguards to protect your information, including verifying that messages from Meta's webhook are authentic before processing them, hashing IP addresses rather than storing them in the clear, and limiting access to inquiry and analytics data to authorized staff. No method of transmission or storage is completely secure, but we work to protect your information appropriately.

Automate is intended for adults who are old enough to purchase or inquire about a vehicle. We do not knowingly collect personal information from children, and Automate is not directed at children.

Our hosting and content-delivery providers operate global infrastructure, so your information may be processed on servers located outside the Philippines. Wherever it is processed, we handle it in line with this Privacy Policy.

We may update this Privacy Policy from time to time. If we make material changes, we'll update the "Last updated" date above. Continued use of Automate after changes take effect means you accept the revised policy.

Questions about this Privacy Policy or how we handle your information? Email us at [email protected].