Privacy Policy

Shortlist EV
Version: 1.3.8
Effective: 27 September 2026
Applies to: shortlistev.com.au and shortlistev.com

This policy describes how Shortlist EV handles information. It is written for the current product: a shortlisting and education site with no customer account. You can use Find without giving an email. If you choose to, you may email yourself a shortlist and, separately, opt in to marketing emails when we offer that option.

1. Who we are

Shortlist EV operates this site (registered business name).

ABN: 35 907 390 991
Privacy contact: privacy@shortlistev.com.au

The product interface may also use the brand ShortlistEV.

2. How we approach privacy

We handle personal information in a way that is consistent with the Australian Privacy Principles in the Privacy Act 1988 (Cth), whether or not every part of that Act applies to us as a small business.

This policy covers:

• what we collect
• how we collect it
• why we use it
• who we disclose it to
• overseas processing
• access and correction
• complaints (including the OAIC)

3. What we collect today

We do not currently:

• create user accounts
• require your name, email, or phone number to use Find or Learn
• require an email address to use Find
• sell personal information
• use analytics to sell your data to advertisers or data brokers
• show a GDPR-style cookie-consent banner — Australian law does not require one for this kind of analytics setup

We may collect or process:

Find answers, progress, and saved shortlists (in your browser)

If you use Find, you may answer questions such as where you are up to, budget, how flexible that number is, state, body style, seats, distance you drive, charging situation, must-haves, how you want the car to drive, and brands to leave off.

We store some of that information in your browser on this device only (using localStorage or a similar durable browser store). There is no Find account, and we do not use this to sync across devices, match you by IP, or fingerprint your device.

We keep three kinds of storage separate:

1. Unfinished Find draft If you leave Find part-way through, we may keep your answers, current step/progress, and limited attempt metadata (for example an attempt id, original start time, flow version, and milestone markers) so you can Continue on the same browser.

• Kept for: up to 168 hours (7 days) from when that Find attempt originally started.
• Coming back or choosing Continue does not extend that deadline.
• After 168 hours the draft is ignored and removed when the site next runs — you cannot complete an expired draft late.
• Start again clears the unfinished draft and begins a new attempt (it does not by itself delete a separately saved completed shortlist).

2. Completed shortlist (saved results) When Find successfully shows results (including zero matches), we may keep a saved shortlist in the same browser so you can View it later — for example vehicle ids and a compact snapshot of what was shown, plus the minimum structured answers needed if you choose Update my shortlist.

• Kept for: up to 168 hours (7 days) from when those results were first successfully shown.
• Reopening or viewing the saved shortlist does not extend that deadline.
• This clock is independent of the unfinished-draft clock and of analytics attribution (analytics eligibility is measured from the original attempt start and is handled under Analytics).
• You can use Delete saved shortlist in the site UI. Expiry also clears it when the site next runs.
• Saving or viewing a completed shortlist is a functional site feature — it does not depend on Google Analytics loading or on analytics consent.

3. Analytics storage (separate) Analytics tools (GA4, Vercel Analytics, Speed Insights) use their own cookies or storage, separate from your Find draft and saved shortlist. Clearing a local saved shortlist or draft does not erase analytics data those tools already collected. Analytics payloads do not include your Find answers (see Analytics below).

Shared or borrowed devices: Anyone using this same browser on this device can see a saved draft or shortlist until it expires or is deleted. Clear site data, use Delete saved shortlist / Start again, or use a private window if you do not want that.

When you view fresh results: Your answers are sent to our server so we can match cars (a getShortlist request). We do not currently turn them into a standing customer account on our servers. Hosting (currently Vercel) processes that request to return a result. Short-lived server or access logs may still exist.

Analytics: We do not send your Find answers to Google Analytics 4 (no budget figures, distances, brand lists, preferences, or free text in GA payloads). GA4 may receive step ids/indices and coarse funnel parameters only. Limited events may include Australian state if you chose one — as described under Analytics below.

Contact form

If you use our contact form, we collect your name, email address, and the message you send. We use that only to respond to you and keep a record of the conversation. We don’t sell it or use this form to send marketing email.

We do not publish the operational inbox that receives form submissions. For privacy questions, access, correction, or complaints, email privacy@shortlistev.com.au.

Emailing your shortlist (optional)

If you choose Email my shortlist, we collect the email address you enter so we can send the shortlist you requested. We do not require a name, phone number, or account.

To fulfil that request we may also process:

• a copy of your Find answers / result summary needed to build the email;
• a remote snapshot of that result (vehicle identifiers and a compact display snapshot) so a read-only link in the email can open the same shortlist on another device; and
• delivery metadata (for example send time, delivery status, and technical logs).

Remote snapshot rules

• A remote snapshot is created only when you request an email (ordinary anonymous Find use can stay browser-only).
• The view link uses a high-entropy token. Anyone with the link can see that snapshot. The snapshot can include reasons based on your answers — for example your state, how a car compares with your budget, brands you prefer, and how you want the car to drive — so anyone you share the link with will see them too. We do not put your email address in the URL.
• The remote snapshot expires 168 hours (7 days) after the shortlist email is sent. Opening the link again does not extend that deadline. After expiry the link stops working and we permanently delete the stored snapshot, normally within a day and no later than 48 hours after expiry.
• You can use a protected Delete emailed shortlist control (not a simple link that email scanners might prefetch). Deleting the remote snapshot revokes the link and permanently deletes the stored snapshot; it cannot unsend an email already delivered, and it does not change marketing consent.
• Clearing browser data does not delete a remote snapshot — and deleting a remote snapshot does not clear your browser draft/saved shortlist.

The shortlist email is a dated snapshot. Later catalogue changes do not silently rewrite an email already sent.

Marketing emails and e-newsletter (optional, separate)

Marketing is separate from emailing your shortlist.

When we offer the marketing checkbox and you tick it (it is unchecked by default and is not required to send a shortlist), we will start a double opt-in process: we send a confirmation email and only add you to our marketing list after you confirm. Until you confirm, you are not an active marketing subscriber.
If you do not confirm, we delete the pending request within 30 days.

Marketing emails may include the ShortlistEV e-newsletter (EV news and buying guides) and related ShortlistEV updates. Every marketing email identifies us and includes an unsubscribe mechanism.

We will not:

• treat requesting a shortlist alone as marketing consent;
• pre-tick the marketing box;
• import contact-form users, shortlist recipients, or browser-only users into marketing without their own consent; or
• silently reactivate an address that previously unsubscribed.

We keep a consent record (address, time, consent-copy version, form/source, and confirmation status/time). Questionnaire answers and vehicle snapshots are not stored in the newsletter audience tools.

Unsubscribing from marketing does not delete an emailed shortlist snapshot. Deleting an emailed shortlist does not unsubscribe you from marketing.

Technical information

Like most websites, our hosting provider may record technical data such as IP address, browser type, device type, pages viewed, and approximate location derived from IP. We use this to operate, secure, and debug the site.

Analytics

We use analytics to understand how the site is used — for example traffic volume, which pages are viewed, roughly how many users visit, and where traffic comes from (such as search or a referring link). We use this to improve Shortlist EV. We do not use analytics to sell your personal information or to send you marketing email.

Vercel Analytics and Speed Insights

We use Vercel Web Analytics and Vercel Speed Insights on our hosting platform.

Vercel describes Web Analytics as cookieless. It uses aggregated, anonymised measures of page views. Speed Insights measures site performance (for example how quickly pages load). These tools are not designed to build a cross-site advertising profile of you.

Google Analytics 4 (GA4)

We also use Google Analytics 4, provided by Google.

GA4 typically sets cookies or similar identifiers on your device and collects information such as:

• pages you view and how you move through the site
• approximate location derived from IP address
• device and browser information
• traffic source (for example search or a referring site)

We configure GA4 for site analytics only (traffic, sources, pageviews, users). We do not use it to sell your data.

We may send limited event data to GA4 — for example that someone completed Find (find_complete). That event may include Australian state (if you chose one in Find). It does not include your full Find answers, name, or email.

Where Google provides the option, we turn on IP anonymisation / IP masking for Analytics so Google truncates IP addresses before storage where that feature applies.

Google may process Analytics data on servers outside Australia, including in the United States. Google’s own privacy terms also apply to its processing as a provider.

You can limit Google Analytics cookies through your browser settings, and Google provides tools such as the Google Analytics Opt-out Browser Add-on where available.

Cookies and similar technology

Vercel Analytics and Speed Insights are used for traffic and performance measurement on our hosting platform (Vercel describes Web Analytics as cookieless for its core pageview measurement).

Google Analytics 4 uses cookies or similar technology.

Find answers, progress, unfinished drafts, completed saved shortlists, and related attempt metadata are stored in your browser using `localStorage` (or similar) so you can continue on the same device. An unfinished draft is kept for up to 168 hours from the original attempt start, and a completed saved shortlist for up to 168 hours from completion (see Find answers, progress, and saved shortlists above, and section 8). Clearing site data, waiting for expiry, choosing Start again, using Delete saved shortlist, or deleting an emailed shortlist from this browser clears the relevant data on this device.

We do not currently use advertising or retargeting cookies (for example Meta Pixel or Google Ads remarketing). If that changes, we will update this policy.

Australian law does not require a GDPR-style cookie banner for this setup. This Privacy Policy is how we tell you what we use.

Information you choose to send

If you email us at privacy@shortlistev.com.au (or otherwise contact us), we will have the content of that message and your email address, so we can reply.

4. What we do not collect yet (and will update if we do)

We do not currently collect:

• account credentials
• payment details (we do not take payments on this site)
• identity documents

If we add any of those, we will update this policy first and, for commercial email, comply with the Spam Act 2003 (consent, identify the sender, working unsubscribe).

5. Why we use information

We use information to:

• generate your shortlist and show relevant education
• operate, secure, and improve the site
• understand site traffic and performance (analytics)
• reply if you contact us
• meet legal obligations if they apply

We do not use Find answers to make a legally binding decision about you. A shortlist is information for you to consider, not an approval, refusal, or credit decision.

6. Who we disclose information to

We disclose information only as needed to run the site, including:

• hosting and infrastructure — Vercel (including Vercel Analytics and Speed Insights)
• analytics providers — Google (Google Analytics 4)
• transactional email — our transactional email provider, when you request a shortlist by email, or to send the confirmation email if you tick the marketing box (processes your address and the message content to deliver it)
• marketing email — beehiiv (or our nominated newsletter platform), only if you opt in and confirm (receives your address and necessary consent/source fields — not your full Find answers or vehicle snapshots)
• professional advisers or authorities if the law requires it, or to protect the site and our legal rights

We do not currently disclose your Find answers to car dealers or manufacturers as a lead.

If you follow a link to a manufacturer site, that site’s privacy policy applies to what they collect.

7. Overseas processing

Our hosting, analytics, and email providers may process information on servers outside Australia, including in the United States (for example Vercel, Google, and beehiiv / our transactional email provider).

We do not currently rely on a prescribed “whitelist” of overseas privacy laws. We take reasonable steps available to us as a small operator (provider choice, limited collection, no customer accounts, analytics used for site improvement rather than selling data).

8. How long we keep information

• Unfinished Find draft: kept in your browser for up to 168 hours from the original attempt start (not extended on return); cleared on Start again, expiry, or clearing site data.
• Completed saved shortlist (and the minimum answers kept with it for Update my shortlist): kept in your browser for up to 168 hours from completion; cleared on Delete saved shortlist, expiry, or clearing site data. Independent of the draft clock.
• Emailed shortlist / remote snapshot: the view link works until 168 hours after the shortlist email is sent, or until the emailed shortlist is deleted. The stored snapshot is then permanently deleted, normally within a day and no later than 48 hours after expiry. Delivery logs and backups may be kept longer for security and operations (see below).
• Unconfirmed marketing sign-ups: deleted within 30 days if not confirmed.
• Abuse-prevention records: short-lived rate-limit records, which may include a keyed hash of your email address (not the address itself), deleted within 4 days.
• Marketing subscription: kept while you remain subscribed, then handled under ordinary suppression/unsubscribe records so we can honour opt-outs.
• Consent evidence (marketing): kept as long as needed to show what you agreed to and when.
• Transactional delivery logs: kept for a limited operational period for abuse prevention, debugging, and compliance, then deleted or aggregated where practical.
• Analytics storage: retained by analytics providers under their own settings; separate from Find draft/saved shortlist. Deleting local Find data does not erase previously collected analytics.
• Server shortlist requests: answers sent only to generate results when you run Find; not kept as a customer account. Residual server logs, if any, are kept only as long as needed to operate and secure the site.
• Emails / contact form messages: kept as long as needed to handle your request and our records.
• Technical logs: kept for a short operational period, then deleted or aggregated where practical.

9. Security

We take reasonable steps to protect information we hold, including using reputable hosting and limiting how much we collect. No website is completely secure. If we become aware of a serious incident involving personal information, we will handle it promptly and notify people or the OAIC where required.

10. Access and correction

You can ask us what personal information we hold about you, and ask us to correct it.

Email privacy@shortlistev.com.au. We will respond within a reasonable time. Because we do not currently keep customer accounts, we may hold little or nothing identifiable about a visit other than an email you sent us, limited technical logs, or analytics that we cannot reasonably re-identify.

11. Complaints

If you have a privacy complaint, email privacy@shortlistev.com.au first and we will try to resolve it.

You can also contact the Office of the Australian Information Commissioner:

• oaic.gov.au
• 1300 363 992

12. Children

This site is aimed at adults considering an Australian vehicle purchase. It is not directed at children.

13. Changes

We may update this policy. The version on this page is the current one. Material changes (including new trackers or marketing email) will be reflected here when they take effect.

14. Contact

Privacy questions: privacy@shortlistev.com.au

Effective 27 September 2026. Version 1.3.8 (tidy: what a shared shortlist link shows; wording fixes). Previous: 1.3.7 (shortlist email; remote snapshots expire 168h after the email is sent and are permanently deleted within 48h; marketing double opt-in; processors; retention/deletion).