Privacy Policy

This Privacy Policy explains how AutoDealer.io LLC (“AutoDealer.io,” “we,” “us,” or “our”) collects, uses, discloses, and protects information when people use autodealer.io, our dealer app, our hosted dealer website features, public shopper chat, lead forms, support channels, and related services (collectively, the “Service”).

Who this policy covers

This policy covers information we process for our own business purposes, such as account management, billing, security, product analytics, support, and marketing. When a dealership uses the Service to manage its own customers, leads, deals, documents, or hosted website visitors, that dealership is usually responsible for its own legal notices, consumer privacy choices, financing disclosures, and retention duties. We process that dealership-controlled data as a service provider or processor under our customer agreement, these customer data processing terms, and our Terms. We do not decide what information a dealership may collect, what notices it must provide, how long it must keep records, or whether its use of the Service satisfies laws that apply to its business.

Customer data processing terms

For Customer Data entered into the Service, the dealership is the controller, business, financial institution, or equivalent decision-maker. AutoDealer.io processes Customer Data as a processor, service provider, or vendor on the dealership's behalf, except where we process information for our own business purposes described in this policy. Dealerships remain solely responsible for the lawfulness, accuracy, completeness, retention, notice, consent, disclosure, export, deletion, and transaction use of Customer Data.

We process Customer Data to:

• provide, secure, maintain, support, and improve the Service;
• perform dealership configuration, integration, AI, import, export, and hosting instructions;
• comply with law, enforce agreements, prevent fraud and abuse, and protect the Service;
• perform other documented instructions agreed by the parties.

Dealership instructions must be lawful and sufficient for the intended processing. We do not determine whether dealership instructions, disclosures, consents, forms, communications, retention periods, or compliance workflows satisfy dealership legal, regulatory, lender, marketplace, or contractual obligations.

Information we collect

We collect information directly from users, from dealerships, from hosted website visitors, and from service activity.

• Account and user information: names, email addresses, dealership affiliation, role, title, authentication status, security settings, support requests, and communications with us.
• Dealership information: dealer name, legal and public business profile, EIN or tax identifiers when provided, locations, website settings, custom domains, subscription tier, billing status, team members, vendors, lienholders, compliance settings, and audit history.
• Dealer business data: inventory, vehicle details and photos, acquisition and sales records, leads, customers, deals, payments recorded in the DMS, title work, documents, form templates, notes, tasks, communications (including email received at a dealership receiving address on the Service), marketplace settings, and related metadata.
• Consumer and applicant data entered by dealerships: names, contact details, addresses, date of birth, driver license details, financing or deal information, documents, signatures, and other information a dealership chooses to enter or upload.
• Hosted website and shopper data: form submissions, public chat messages, vehicle interests, lead source, pages viewed, approximate device and browser information, and referral details.
• Billing data: subscription details, invoices, payment method brand, type, and last four digits. Card data is handled by Stripe; we do not store full payment card numbers.
• Payments to dealerships: when a buyer or borrower pays a dealership that has connected its own Stripe account, Stripe handles their card or bank account details. We send Stripe the buyer's or borrower's name and email address, to fill in the payment page and for receipts, and for a borrower who saves a payment method for automatic payments. For each payment we store the amount, its status, the type of payment method (bank account, debit card or card), the fee Stripe kept, and the Stripe payment and session identifiers. When a borrower turns on automatic payments, we also store the label Stripe gives their saved method (for example, “Visa ending 4242” or “Chase checking ending 6789”: the card brand or bank name and the last four digits) and the record of their consent: the authorization text, the time, their IP address and their browser's user agent. We never see or store a full card number or bank account number.
• Usage, device, and security data: IP address, user agent, session events, log data, diagnostic events, feature usage, authentication events, and similar records used to operate and protect the Service.
• Third-party enrichment data: data returned by configured integrations, such as VIN decoding, maps or places data, marketplace services, email delivery, billing, AI providers, and analytics tools.

How we use information

• Provide, maintain, secure, troubleshoot, and improve the Service.
• Create and administer dealer accounts, users, roles, permissions, subscriptions, and support sessions.
• Host dealer websites, inventory pages, vehicle photos, lead forms, public chat, and custom domains.
• Process subscription billing, invoices, payment method updates, and related notices.
• Deliver transactional email, product notices, security alerts, support messages, and requested marketing communications.
• Power AI features, including dealer assistants, public shopper chat, draft content, summaries, and proposed actions.
• Monitor usage, enforce our terms, prevent fraud and abuse, protect tenants from cross-dealer access, and investigate security events.
• Comply with contracts, legal obligations, subpoenas, government requests, audits, tax and accounting obligations, and dispute resolution.

How we share information

• With service providers and subprocessors: hosting, database, storage, CDN, payment, email, AI, analytics, logging, security, support, and enrichment providers that help us operate the Service. Our current list is available on the Security & Subprocessors page.
• With dealerships and their authorized users: dealer account owners and authorized users can access the dealership data available to their role.
• With integrations enabled by a dealership: marketplace, catalog, mapping, vehicle data, finance, email, or other integrations that a dealership configures or requests.
• With apps a team member connects: when an authorized user connects an AI application or other tool of their choosing under Settings → Connected apps, that application can read the dealership data available to that user's role, on that user's behalf, until the user or a dealership owner disconnects it. The application is the user's own choice and is governed by its own terms; we do not send it anything it did not request through that connection.
• With public website visitors: published dealership content, visible inventory, public vehicle photos, public pricing/status fields, and dealership contact information may be displayed on hosted dealer websites and feeds.
• For legal and safety reasons: if we believe disclosure is necessary to comply with law, enforce agreements, protect the Service, prevent fraud or abuse, or protect rights, safety, and security.
• Business transfers: in connection with a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality and data protection obligations.

We do not sell personal information for money. We do not knowingly share personal information for cross-context behavioral advertising through the core Service. Dealerships may add their own analytics or marketing tags to their hosted websites; those dealer-controlled tools are the dealership's responsibility.

Signing in with Google

Signing in with Google is optional. When you use it, Google sends us your name, email address, whether Google has verified that address, and the unique account identifier Google assigns you. We use that information only to create your AutoDealer.io account or match you to an existing one, and we store the account identifier and the email address it was linked under so we can recognize you on later sign-ins. We do not receive your Google password, and we do not request access to Gmail, Drive, Contacts, Calendar, or any other Google service. We do not share what Google sends us with third parties or use it for advertising, and you can disconnect AutoDealer.io at any time from your Google account permissions page.

Connecting a Google Business Profile

Connecting your dealership's Google Business Profile is optional. If you start the connection, Google asks you to approve access to manage that profile, and we use it only to run the Business Profile features you turn on, such as reading and updating your listing details and reading and replying to reviews. We request that access only at the moment you connect, we store the token Google issues in encrypted form so the connection keeps working, and you can revoke it at any time by disconnecting in the Service or from your Google account permissions page.

Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We do not transfer or sell Google user data to advertising platforms, data brokers, or information resellers, we do not use it to serve advertising, and we do not let people read it except with your permission, to resolve a support issue you raise with us, for security purposes, or where the law requires it.

Connecting Facebook

Connecting Facebook is optional. The Service offers two Facebook features, each with its own connection: posting cars to your dealership's Facebook Page, and, where available, Facebook Vehicle Ads, which sends your inventory to a vehicle catalog in your own Meta business account. An owner or manager makes each connection, and Facebook shows them what they are approving before anything is shared with us. Meta Platforms, Inc. handles what you do on Facebook under its own Privacy Policy. Copying a post and its photos to share on Facebook yourself sends nothing to Meta.

Posting to your Facebook Page

When you connect a Page, Facebook asks you to choose the Pages to share with us and to let us see them, read them, and create, edit and delete posts on them. From Facebook we receive and keep: the Page's name and id; an access key for the Page, which we store encrypted; the id Facebook gives your account for our app; and what Facebook says you may do on the Page. We do not receive your Facebook password, name, email address or friends. If you manage several Pages, we hold your own access key, encrypted, and the names and ids of the Pages you may pick while you pick one. We delete them when you pick or cancel, or within a day after the 30 minutes to pick run out, so of the Pages offered we keep only the chosen one's name, id and key. We also keep your dealership's posting settings.

We use this only to post the cars your dealership asks us to post, to keep those posts accurate, and to take them down. A post carries the car's details, price and photos from your website, your dealership's phone number, and a link to the car on your website if you choose. When a car's price changes we edit its post. When it sells we mark the post sold or take it down, as your settings say, and when it is deleted from your inventory we take the post down, or mark it no longer available if Facebook will not delete it. If your dealership turns on automatic posts or posts cars from the inventory list, they go out on the schedule it sets, without anyone reviewing each post. Once a day we ask Facebook whether the Page's key still works. We do not read your Page's followers, comments or messages. For each post we keep a record of what was posted and when: its words, price and photos, the Page it went to, and the post's own id and link on Facebook.

Facebook Vehicle Ads

If you connect Vehicle Ads, Facebook asks you to let us manage the vehicle catalog of your Meta business account, and we create a catalog there if it has none. We receive and keep your business account's id, the catalog's id and an access key, which we store encrypted. Meta may also send us notices about your catalog, which we keep with our service records. We send the catalog each car published on your website: its stock number, title, description, link, make, model, year, mileage, price, condition, colors, transmission, fuel, drivetrain, VIN, trim, body style and up to 20 photo links, with your dealership's name and phone number and the address and map point of the lot it is on. Each car goes to the catalog when it is published and again whenever it changes, without anyone reviewing it, and we remove it when it leaves your website. To find each lot's map point we send its street address to the U.S. Census Bureau's geocoder; you can correct the point.

Meta Pixel on dealer websites

A dealership can add its own Meta Pixel to its hosted website in Website settings. Meta's script then collects visits to that website, such as the pages viewed and the visitor's IP address, for the dealership under the dealership's own agreement with Meta. The Service also sends Meta an event through that Pixel when a visitor sends a form or taps to call or text, naming only the kind of form, such as a financing or trade-in form, or that it was a call or a text; it never adds the visitor's name, email address or phone number. Anything more Meta's script collects depends on the dealership's own settings with Meta. A browser that sends a Global Privacy Control signal never loads the Pixel, and when the dealership turns on its cookie banner, the Pixel loads only after the visitor agrees. We do not put a Pixel of our own on dealer websites.

How we use and share Facebook data

We do not sell, license or buy information we receive from Facebook. We do not use it for advertising beyond the posts and catalog your dealership asks us to send, to build profiles of people, or to decide anyone's eligibility for credit, financing, insurance, employment or housing. We share it only with Meta to run the features you connect, with the service providers that host and run the Service, which may use it only for that, with an app a team member connects under Settings → Connected apps, and where the law requires. Such an app acts for that team member and can see what they can see, such as the Page's name on a Facebook post waiting for approval. Owners and managers see the connected Page, who connected it and the recent posts. Team members who can open a car's page see its posts, and those who can edit inventory can post it or take a post down. Access keys are never shown to anyone, and only our servers use them.

Deleting your Facebook data

Anyone, wherever they live, can have the Facebook data we hold deleted:

• Disconnect in the Service. In Settings, Marketplaces, Disconnect deletes the Page connection at once: the Page's key, your Facebook account's id, what Facebook says you may do on the Page, and the posting settings. For Vehicle Ads it deletes the key and the business and catalog ids and stops updating the catalog; the cars already in it stay there until you remove them in Meta's Commerce Manager. Posts already on your Page stay on Facebook, so take them down first if you want them gone.
• Remove AutoDealer.io in Facebook, under Settings & privacy, Settings, Business integrations, for a Page connection. Facebook stops accepting our key at once, and when Facebook tells us, we delete the Page's key and stop posting. Disconnect, or ask us, to delete the rest.
• Ask Facebook to have us delete your data, for a Page connection. Facebook tells us, and we delete the Page connection you made as soon as the request arrives. You get a confirmation code and a page that shows what was deleted.
• Email us at info@autodealer.io, for either feature. We confirm the request, delete the data and tell you when it is done.

When a dealership's subscription is cancelled or its account is deleted, we delete its Facebook connections and take Facebook's ids off each of its post records (the Page's id and the post's own id and link), usually within a day, even if nobody asks. What each post said, its price, its photos and when it ran are the dealership's own advertising records, which a dealer may have to keep by law (California dealers, for example, must keep advertisements that show a car's total price for two years). So they stay with the dealership's other records and are deleted with them when the dealership asks us to delete its data. Our activity log, which cannot be changed, keeps the Page's name and id and the Vehicle Ads business and catalog ids as a record of who connected and disconnected them. Boxer's past suggestions to post a car may name the Page, and notices Meta sent about a catalog stay with our service records. None of this comes from the Facebook account of the person who connected the Page.

AI features

The Service uses AI providers to process prompts, chat messages, dealership context, public vehicle data, and draft outputs as needed to provide AI features. Dealer AI actions that would change records are designed to create proposals for authorized users to review and approve, not to mutate records automatically. Public shopper AI is limited to public inventory, published website content, and safe general automotive information. AI use is also governed by our Terms of Use.

Connected accounting and banking services

QuickBooks Online

Connecting a QuickBooks Online company is optional. If you connect one, we exchange data with Intuit only to run the accounting features you enable: we post the journal entries the Service generates to your QuickBooks company, and we read your chart of accounts so you can map ledger accounts. We never receive your Intuit password, and we store the connection tokens Intuit issues in encrypted form.

We act on your instructions, not Intuit's. AutoDealer.io does not process this information on Intuit's behalf. We do not sell it, and any service provider that handles it is bound by obligations at least as protective as those described here. When you disconnect QuickBooks in the Service, we ask Intuit to revoke the connection and we delete the stored tokens and account mappings. If you revoke access from Intuit instead, the connection stops renewing and the Service stops posting to your QuickBooks company. If you ask us to delete related data, we delete it securely.

Bank connections

Where bank connections are available and you choose to link a bank account, we use Plaid Inc. to make the connection. You enter your online banking credentials directly with Plaid, not with us, and we never see or store your banking username, password, or multi-factor codes. Plaid returns account and transaction information to us, such as account name and type, the last four digits, balances, and transaction lines, which the Service uses to match activity against your books. We do not initiate payments, transfers, or any movement of money through these connections.

Plaid handles the information it collects from you under its own End User Privacy Policy. We do not sell or rent that information and we do not use it for advertising.

Data security

We use technical and organizational safeguards designed to protect information, including tenant isolation, role-based access, audit logging, encryption for selected sensitive fields, secure direct uploads, MFA support, observability controls that scrub sensitive data, and infrastructure providers with security programs. No method of transmission or storage is completely secure. See the Security Overview for more detail.

Data retention

We retain information for as long as needed to provide the Service, maintain business records, comply with law, resolve disputes, enforce agreements, maintain security, and support dealership retention obligations. Dealer-controlled records may be retained or deleted according to the dealer's instructions, the subscription status, backup cycles, legal holds, these terms, and our customer agreement.

When a dealership cancels its subscription or its account is closed, we keep its Customer Data until the dealership asks us to delete it. To ask, the account owner emails info@autodealer.io from the email address on the account. We confirm the request with the account owner, then delete or de-identify the data, except records we must keep by law, to resolve a dispute or to enforce our agreements. Copies in backups are overwritten on their normal cycle. We tell the account owner when the deletion is done. Before asking, the dealership should export any records it needs to keep, because deleted records cannot be restored. Facebook connections, and Facebook's ids on each post record, are the exception: we delete them when a dealership's subscription is cancelled or its account is deleted, as Deleting your Facebook data describes.

Your privacy rights and choices

Depending on where you live, you may have rights to know, access, correct, delete, export, restrict, or object to certain processing of your personal information. If your request concerns information a dealership collected from you, we may direct you to that dealership or ask for its authorization because the dealership controls those records. To make a request to us, email info@autodealer.io.

When you create an account we subscribe you to marketing email (our newsletter, product news, tips, and trial reminders). You can unsubscribe at any time using the unsubscribe link in any marketing message or from the email preferences in your account settings, and we will honor your request promptly. We may still send transactional, billing, security, and account notices, which are part of the Service and cannot be turned off while your account is active.

Cookies and similar technologies

We use cookies, local storage, pixels, SDKs, and similar technologies on autodealer.io, the dealer app, admin tools, hosted dealer websites, public shopper chat, support flows, and pages served through dealer subdomains or custom domains.

• Strictly necessary: authentication, session management, CSRF protection, security, routing, billing checkout, support sessions, and load balancing.
• Preferences: interface choices such as sidebar state, theme preferences, and similar settings that make the Service work as expected.
• Analytics and diagnostics: feature usage, page performance, error reporting, event logs, and product analytics used to improve reliability and understand adoption.
• Communications and support: support, contact, demo, email, and notification workflows.
• Dealer-enabled technologies: scripts, pixels, analytics, chat tools, and marketing tags a dealership adds to its hosted website through custom code or integrations.

Most browsers let you block or delete cookies. If you block strictly necessary cookies, parts of the Service may not work, including sign-in, security checks, billing checkout, or dealer website functions. Some browsers offer “Do Not Track” signals; because there is no consistent industry standard for responding to these signals, the Service may not respond to them. We will honor legally required opt-out signals where applicable and technically feasible.

Financial privacy and auto dealer compliance

Auto dealers that provide financing or lease-related services may have independent obligations under the Gramm-Leach-Bliley Act, the FTC Privacy Rule, the FTC Safeguards Rule, state privacy laws, and motor vehicle finance rules. AutoDealer.io provides software tools; dealerships remain responsible for determining which notices, opt-outs, safeguards, forms, and retention rules apply to their customers and transactions. We do not assume a dealership's privacy, financial, advertising, credit, title, registration, records, or consumer-notice obligations by hosting, processing, routing, storing, displaying, or exporting dealership-controlled data.

International users

The Service is operated from the United States and is designed for United States dealerships. If you use the Service from outside the United States, your information may be processed in the United States and other countries where our providers operate.

Children's privacy

The Service is intended for businesses and vehicle shoppers. It is not directed to children under 16, and we do not knowingly collect personal information from children under 16.

Changes to this policy

We may update this policy from time to time. We will post the updated version here and revise the “last updated” date above.

Contact us

Questions or privacy requests can be sent to info@autodealer.io.