Privacy Policy

1. Our role

AutoSavant plays two roles depending on the data:

• For the Records and content you upload, you (the dealership) are the controller, and we act as your processor or service provider, handling that data only on your instructions to provide the Service. If the Records contain personal information about a buyer or other individual, the dealership is responsible as the controller, and we will assist you in responding to that individual's requests.
• For Showroom transcripts, session records, and leads (Section 3), the dealership that enabled the Showroom is likewise the controller, and we process that data on the dealership's behalf. A Showroom visitor who wants to exercise privacy rights should contact the dealership; we will assist the dealership in responding.
• For account information, sign-up and billing information, and usage and log data that we collect to run, secure, and bill the Service, we act as a controller and handle it as described in this Policy.
• If you use the Service as a staff member of a dealership, the dealership's owners and administrators can see activity attributed to you, such as entries in the activity log and the notes, documents, findings, and escalation answers you create for the dealership's cars. Your own chat sessions, and the questions and answers inside them, are visible only to you.

2. Information we collect

• Account information: name, email address, role, dealership association, and your password, which we store only as a salted hash. If you enable two-step authentication, we also store the authenticator secret needed to verify your codes. Backup codes are stored only as SHA-256 hashes, never in usable form.
• Mobile number for text-message alerts: text-message alerts about buyer leads are optional. If you turn them on in Settings, we store the mobile number you add, once you have confirmed it by entering a code we text to it, and whether alerts are on. We also keep a log of each text we try to send you: the time, whether it was a code or an alert, and whether it was accepted, but not the number or the words. You can turn alerts off or remove the number at any time in Settings.
• Sign-up requests and invitations: an account is created from a single-use link. Where self-service sign-up is open, the sign-up page on our website asks for your email address and, where we have opened sign-up to private sellers, whether you are signing up for a dealership or to sell your own vehicle. We store that email address, the kind of account chosen, and any plan picked on our pricing page, with a single-use sign-up link, which we send only to that address, through our email provider, and which expires after 48 hours. The kind of account and the plan picked are then kept with the account and the store created from the link. If the address already has an account, we send it a message saying so and do not create a second account. A sign-up request that is never completed is deleted automatically after its link expires. The deletion is done by a routine clean-up (when the Service starts, with its scheduled tasks, and when another sign-up request arrives), so the record can remain for a short time after the link has expired; if the email could not be sent, the request is deleted at once and the address may appear in our server logs. When an owner of a dealership, or we, invite someone, we store the invited email address and role with a single-use link that expires after 7 days; the link is emailed to the invited address and is also shown to the person who sent the invitation, so that they can pass it on themselves.
• Changes of login email: if you ask to change the email address you log in with, we store the new address with a single-use confirmation link, which we send only to that address, through our email provider, and which expires after 24 hours. Your login email changes only when that link is opened by someone signed in to your account; until then it stays as it was. We also send a notice of the request, naming the new address, to your current address, and a second notice there once the change has been made. If the new address already belongs to another account, we send that address a message saying that a request was made and that nothing was changed, and we do not tell the person who asked. A request is deleted when the change is confirmed, when you make a newer request, when you change or reset your password, or at once if its email could not be sent. A request that is never confirmed is deleted automatically after its link expires, by the same kind of routine clean-up (when the Service starts, with its scheduled tasks, and when another such request is made), so the record can remain for a short time after the link has expired.
• Billing information: plans are paid for on a payment page hosted by our payment processor, Stripe, and managed in a billing portal that Stripe also hosts. Stripe collects the payment details entered on its pages, such as card details and the billing details it requires for the payment method, and, when we have turned on tax calculation, a full billing address. We do not receive or store card numbers. When an owner starts a purchase we send Stripe the plan chosen and our internal identifiers for the store, and, while Stripe holds no customer record for the store, that owner's email address; once it does, a purchase refers to that customer record instead. For each store we keep a billing record: Stripe's identifiers for the customer, the subscription, and the checkout; the plan, its status, its quantity, and the end of the current period; whether it is set to cancel; when a payment first failed; any promotional discount (its identifier, name, size, and end date); for a 14-day pilot, when it was bought and the amount credited; and any note we add when we grant complimentary access. We also keep a ledger of the one-time purchases applied to a store (Stripe's checkout identifier, the store's internal number, the plan, the vehicles covered, and dates) and a log of the billing events Stripe sends us (Stripe's event identifier, its type, the outcome, and a short technical note). Those events can contain a customer's email address; we do not keep a copy of their content.
• Records you upload: the documents and data you provide about vehicles, which may include vehicle history reports (such as Carfax), VINs, service and repair receipts, build sheets, listings, and photographs. We also generate and store processed text extracted from your uploaded documents (the "master record"), which the Service uses to answer questions. See Section 6 on other people's data inside these documents.
• Photographs: photos you upload may incidentally contain license plates, VINs, location backgrounds, or images of people. We process them to display them in the Service and to generate Output, including the photo inspection feature, and they are transmitted to our AI provider for that purpose.
• Content you generate: the questions you ask, the drafts and answers produced, your edits, notes, and other material you create in the Service, including appraisal outputs (the market estimates the appraisal feature produces, and the Service's own comparison of those estimates with the asking price you have set for the car).
• Showroom data: where a dealership enables the Showroom, the buyer's questions and the Service's answers (the transcript), session details (a random session token, timestamps, and a question count), and any lead the buyer chooses to leave (name, phone number, email address). Section 3 describes this in full.
• Support and contact messages: if you use the contact form on the help page, we receive the message you write, your email address, and the name of your dealership. If you use the contact form on our public website, we receive the email address you enter and what you tell us there: a dealership name or the vehicle you are selling, and, if you choose, an inventory range or where you plan to list the vehicle. In both cases the message is relayed by email through our email provider to our support inbox, with your address set as the reply-to so we can respond. Neither form's submission is stored in the Service's database.
• Usage and operational data: technical information generated when you use the Service, such as IP address, device and browser information, timestamps, pages viewed, and actions taken, together with operational records such as change logs and measures of AI processing volume used for security, debugging, and our own cost accounting. We do not charge by usage.
• Consent records: when you accept the Terms, we record the version you accepted, the date and time, and the IP address of that acceptance, as evidence of the agreement.

3. The Showroom (buyer questions)

The Showroom is an optional feature available to every dealership. When a dealership publishes the Showroom QR code or link for a specific car, a buyer can scan or open it and ask the Service questions about that car directly, in a short, time-capped session. This section applies to buyers who use those codes and links.

• What we collect from visitors: the questions asked and the answers given (the transcript), plus session details consisting of a random session token, timestamps, and a question count. We do not store the visitor's IP address with the session. Rate limiting uses short-lived, in-memory IP tracking that is never written to the database. A visitor's questions may include personal details the visitor chooses to type; anything typed becomes part of the transcript.
• Optional lead form: a visitor may choose to leave a name, phone number, or email address (at most one lead per session). Leads are visible only to the dealership's staff and to us as the dealership's service provider. When a visitor leaves a lead, we also deliver it by email through our email provider (Resend) to the dealership's owners and, when the visitor arrived through the personal QR code or link of a staff member the owner has given lead access, to that staff member. The email contains the name, phone number, and email address the visitor entered, and which car it concerns. A recipient of that email who has turned on text-message alerts also receives a text message saying that a lead has arrived on a named car, with a link to it in the Service. The text message does not include the buyer's name, phone number, or email address.
• No cookie: we set no cookie for Showroom visitors (see Section 13).
• Transcripts: the transcript is stored with the car's question-and-answer history for as long as the dealership keeps the car and its account, as the dealership's audit trail of what the Service told buyers; it is deleted when the associated car or the dealership account is deleted. The visitor-readable transcript link expires about 60 minutes after the session ends.
• Human review: Showroom answers are shown to the buyer directly, without prior review by dealership staff. Review happens after the fact, through the question-and-answer history and the dealership's escalation inbox. Questions the Service declines to answer are routed to the dealership to answer.
• Digest emails: if the dealership enables the optional daily digest email, that email includes the text of declined buyer questions and is sent through our email provider (Resend) to the recipient the dealership configures.
• Who is responsible: the dealership that enabled the Showroom is the controller of Showroom data, and we process it on the dealership's behalf. Privacy requests about a Showroom session or lead should be directed to the dealership; we will assist the dealership in responding. The dealership's owners can delete an individual lead in the Service; Section 10 describes what that deletion does and does not reach. While a dealership's store is locked because it has no active plan (Terms of Service, Section 11), its owners cannot open the page that holds that control; during that time we can delete a lead for the dealership on its request.
• When the Showroom stops: a dealership's Showroom pages work only while its store has an active plan. While the store has none, its codes and links lead to a page-not-found response and no questions or contact details are collected.

4. How we use information

• to provide, operate, and secure the Service, and to improve it using account, usage, and operational data rather than the content of your Records;
• to generate drafts, summaries, answers, and photo-inspection findings, which involves sending relevant Records and content, including uploaded photographs that are analyzed by the AI model, to our AI provider and infrastructure providers for processing;
• to authenticate users, create and maintain accounts (including sending sign-up and invitation links), and prevent fraud or abuse;
• to take payment for plans through our payment processor, keep each store's plan in step with what the processor reports, and apply the plan's limits;
• to communicate with you about the Service, including support and administrative messages;
• to comply with legal obligations and enforce our agreements.

Web search. Web search in the question-and-answer chat is off by default. Where it is enabled, the Service may run web searches for general, model-level public information through our AI provider's search tool. Those searches are never used to look up the specific car you are working with, including its history, accident or title records, VIN, or current listing, and search results are treated as reference data, not as facts about your specific vehicle.

Appraisal. The dealer-only appraisal feature estimates a car's market value from sale results and current listings of comparable cars. With web research on (the default), it first runs two research steps through our AI provider, one for past sales and one for cars listed for sale now. Each step uses our AI provider's web search tool and can open web pages found through those searches, within limits we set on each request to our AI provider: currently up to 9 searches and 4 page fetches in the past-sales step, and up to 11 searches and 10 page fetches in the current-listings step. A step that our AI provider pauses, or that fails, can be resumed or retried a small number of times, each time within the same limits. The research steps receive only the car's specification, as far as it is filled in: year, make, model, trim, mileage, color, transmission, drivetrain, body style, title status, accident history, and number of previous owners, plus the market you chose for the appraisal (such as the United States). They do not receive the VIN, the asking price, or the master record, and they are instructed to research the model's market, not the specific car, its listing, or the dealership selling it.

A final valuation step, with no web access, then receives the same specification, a short summary of how well the car is documented, the evidence the research steps gathered, and the car's master record. Before the master record is sent, every appearance of the VIN saved in the car's details is replaced with a placeholder, regardless of letter case, provided the saved VIN is at least 8 characters long. A VIN written any other way (for example, broken up by spaces or dashes, or only its last characters), a different VIN, or any VIN in the records of a car with no VIN saved is not removed. The asking price you set in the car's details is not sent in any appraisal request; the Service compares it with the estimate itself, afterwards. A price written into the car's records, such as in an uploaded listing or in an answer added to the records, is sent as part of the master record.

Automated processing. The Service uses AI to generate drafts, summaries, and findings, but it does not make automated decisions that produce legal or similarly significant effects about any individual. Outside the Showroom, Output is a draft for a member of your staff to review before it is used, and it is the dealership, not AutoSavant, that makes representations to buyers. Where a dealership enables the Showroom (Section 3), answers are shown to buyers directly, and staff review happens after the fact through the question-and-answer history and the escalation inbox.

5. AI processing and training

To generate Output, we transmit relevant Records and content to our AI provider (Anthropic, through its Claude API) for processing. We do not use your Records or content to train, fine-tune, or improve any artificial-intelligence model, and our AI provider processes your data through its API to generate Output for you and does not use that data to train its models.

Prompt caching. To reduce cost and latency, AutoSavant's own static instruction text for the question-and-answer feature (fixed rules of ours, the same for every request) is cached temporarily by our AI provider; this is on by default. Your Records, questions, and other content are not cached in this way; they are transmitted with each request and processed as described above.

Metering. Our internal AI-usage ledger records, for each request to our AI provider, the kind of task, the model used, the car it related to, token counts (measures of processing volume), and the number of web searches run; it never stores the content of Records, questions, or answers. We use it for our own cost accounting, not to charge you.

6. Data inside your documents

Documents you upload, such as vehicle history reports, service receipts, and auction listings, may contain personal details about other people, for example prior owners, consignors, or a repair shop's customers. Those details persist in the stored file, in the text extracted from the document, and in the consolidated master record, and they are transmitted to our AI provider when the Service runs AI processing over them. Deleting a source document also removes that document's section from the master record. The dealership is responsible for this data as controller, as described in Section 1.

Photographs you upload are retained as uploaded and served only to authenticated users of your dealership. The exception is the public Showroom hero photo, which is re-encoded before display; re-encoding strips embedded metadata such as EXIF and GPS location data.

7. Subprocessors and third parties

We rely on a limited set of service providers ("subprocessors") to operate the Service. Each processes information only on our instructions and only as needed to provide its service:

Stripe. The payment page and the billing portal are operated by Stripe on Stripe's own domains, not ours. What Stripe collects there, including the payment details you enter and whatever its pages collect from your browser, is handled by Stripe under its own terms and privacy policy. Stripe may email receipts, invoices, and notices about a failed payment to the email address on the customer record it holds.

Resources your browser loads. Pages in the Service load some resources directly from third-party hosts: the Tailwind styling library from cdn.tailwindcss.com, the HTMX library from unpkg.com, QR-code and markdown libraries from cdnjs.cloudflare.com, and fonts from fonts.googleapis.com and fonts.gstatic.com. As with any web resource, those hosts see the visitor's IP address and browser user agent when the resource loads. This applies to Showroom visitors as well as dealership users. QR codes are generated in your browser; the URL encoded in a QR code is not sent to any QR service.

We may update this list as our providers change, and will provide notice of material changes where required. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

8. Data location and international transfers

We store and process information in the United States. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States. Where applicable law requires safeguards for an international transfer of personal information, we will put appropriate safeguards in place, such as Standard Contractual Clauses, before making the transfer.

9. Legal bases (where GDPR or UK GDPR applies)

Where the GDPR or UK GDPR applies, we process personal information on these bases: performance of a contract (to provide the Service to your dealership and your users); legitimate interests (to secure, maintain, debug, and improve the Service and to prevent fraud or abuse), balanced against your rights; legal obligation (to comply with law and retain records as required); and consent where we ask for it. For personal information contained in the Records, and for Showroom data, our basis is to perform the Service on the dealership's instructions, and the dealership is responsible for having a lawful basis to provide or collect that data.

10. Data retention and deletion

We keep different categories of information for different periods:

• Account information: for the life of your account and for a period afterward to meet legal, tax, and dispute-resolution needs.
• Mobile number for text-message alerts: kept until you remove it in Settings or your account is deleted. The log of texts we tried to send is deleted after 30 days.
• Sign-up requests and invitations: a self-service sign-up request that is never completed is deleted automatically after its link expires. An invitation sent by an owner of a dealership is kept with the dealership's account and deleted with it. An owner invitation that we issue before a dealership exists is not tied to a dealership, and is kept until we remove it.
• Changes of login email: a requested change that is never confirmed is deleted automatically after its link expires, and sooner if you make a newer request or change or reset your password. A confirmed request is deleted when the change is made.
• Records and generated content (including the master record and uploaded photos): kept while the dealership's account exists and you choose to keep them. Within the Service, the dealership's users can delete individual Records, such as a photo, a document, or a whole vehicle, subject to their role (deleting a document or a whole vehicle is limited to owners), and an owner can delete all of a store's vehicles and their Records at once from Settings. Deleting a dealership's account as a whole is not a self-service control: we do it on the dealership's request. Two limits apply. First, while a store is locked because it has no active plan (Terms of Service, Section 11), the pages for its vehicles cannot be opened, so individual Records cannot be deleted in the Service until the store has an active plan again; an owner can still delete all of the store's vehicles from Settings, and we can still delete Records or the account on request. Second, a user can delete their own login from Settings, except that the only owner of a dealership or dealer group cannot do so until another owner has been added or the dealership's account is closed.
• Showroom transcripts and session records: retained for as long as the dealership keeps the car and its account, as the dealership's audit trail of what the Service told buyers; deleted when the associated car or the dealership account is deleted.
• Showroom leads: kept until the dealership deletes them. The dealership's owners can delete an individual lead in the Service, for example to act on a visitor's deletion request, and all of a car's leads are deleted when the car or the dealership account is deleted. Deleting a lead removes the name, phone number, and email address; the session's transcript is kept, as described above. Copies of a lead already delivered to the dealership by email reside in the dealership's own mailboxes and are under the dealership's control, not ours, so deleting a lead in the Service does not delete those emailed copies. While a dealership's store is locked because it has no active plan, its owners cannot open the page with the per-lead delete control; an owner can still delete all of the store's vehicles, and with them every lead, from Settings, and we can delete an individual lead for the dealership on its request.
• Billing records: the billing record for a store is kept while the dealership's account exists and is deleted with it. The ledger of one-time purchases and the log of billing events described in Section 2 are not deleted with the dealership's account; they exist so that a payment or a billing event is never applied twice, and they are kept as a record of what was applied. Deleting a dealership's account in the Service, or a user's login, does not delete anything at Stripe: the customer record, payment history, and invoices that Stripe holds stay with Stripe under its own retention rules.
• Usage, log, change-log, and processing-volume data: retained for security, debugging, and cost accounting; the AI-usage metering ledger and the change log are retained indefinitely.
• Consent records: retained as evidence of your acceptance for as long as needed to evidence the agreement.

On a verified deletion request, or on account closure, we will delete or de-identify your personal information and Records that we are able to remove from active systems, within a reasonable period, subject to legal retention requirements. Residual copies may persist in routine database backups: we keep the most recent 14 backup snapshots on a rolling basis, so deleted data can persist in a backup until it rotates out. We may also keep periodic copies of those snapshots, and of uploaded files, outside our hosting provider for disaster recovery. Backups are not used to restore deleted data except as part of a disaster-recovery event.

11. Security

We use reasonable technical and organizational measures designed to protect information, including encryption in transit (HTTPS and TLS), passwords stored only as salted scrypt hashes, signed session cookies that expire after 7 days and can be revoked on the server, protection against cross-site request forgery, role-based access controls, per-tenant data isolation, and optional two-step authentication for accounts. Within AutoSavant, access to your Records and content is limited to personnel who need it to operate the Service, provide support you request, or investigate abuse, security, or legal issues. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

Incident notification. If we become aware of a security incident affecting your personal information or Records, we will notify you without undue delay and as required by applicable law, and provide information reasonably available to help you meet your own notification obligations.

12. Your rights

As between you and AutoSavant, you (the dealership) own the Records and content you upload. Depending on where you and your users are located, you may have some or all of the following rights regarding personal information we control:

• to access or know what personal information we hold, and its categories, sources, purposes, and recipients;
• to correct or rectify inaccurate information;
• to delete or erase information, subject to legal retention exceptions;
• to receive certain information in a portable format;
• to restrict or object to certain processing;
• to opt out of sale or sharing (we do not sell personal information and do not share it for cross-context behavioral advertising), and to limit the use of sensitive personal information where applicable;
• not to be discriminated against for exercising these rights.

To exercise a right, contact us at support@autosavant.app. We may need to verify your identity and your authority before acting on a request, and we will respond within the time required by applicable law. You may use an authorized agent and, where applicable, appeal a decision or lodge a complaint with your data protection authority or state regulator. If your request concerns personal information contained in the Records or collected through the Showroom (for example, a buyer's information, a Showroom transcript, or a lead), we act as the processor and will refer or direct the request to the relevant dealership as the controller.

13. Cookies and sessions

The Service uses a single strictly necessary signed session cookie, named "dealer_session", to keep you logged in and to protect against cross-site request forgery. It expires after 7 days and can be revoked on the server. We do not use advertising, analytics, or cross-site tracking cookies, and we set no cookie for Showroom visitors. The Service also stores device-local preferences (such as your theme, dismissed tips, and panel layout) in your browser's localStorage; those values never leave your device. Because we do not track users across sites or over time, we do not respond differently to "Do Not Track" or Global Privacy Control browser signals, and there is no cross-context behavioral advertising to opt out of.

14. Children

The dealer-facing Service is a business tool for licensed dealers and is not intended for, or directed to, children, and we do not knowingly collect personal information from children. The Showroom (Section 3) is reachable by anyone who scans a car's QR code.

15. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the updated Policy with a new effective date and, where appropriate, notify you within the Service. Your continued use of the Service after the changes take effect means you accept the updated Policy. We will not use previously collected personal information in a materially new way without first providing prominent notice and, where applicable law requires it, obtaining consent.

16. Contact

Questions about this Privacy Policy, or requests relating to your data, can be sent to AutoSavant Technologies LLC at support@autosavant.app.