Privacy Policy

1. Our role

AutoSavant plays two roles depending on the data:

• For the Records and content you upload, you (the dealership) are the controller, and we act as your processor or service provider, handling that data only on your instructions to provide the Service. If the Records contain personal information about a buyer or other individual, the dealership is responsible as the controller, and we will assist you in responding to that individual's requests.
• For Showroom transcripts, session records, and leads (Section 3), the dealership that enabled the Showroom is likewise the controller, and we process that data on the dealership's behalf. A Showroom visitor who wants to exercise privacy rights should contact the dealership; we will assist the dealership in responding.
• For account information and usage and log data that we collect to run, secure, and bill the Service, we act as a controller and handle it as described in this Policy.
• If you use the Service as a staff member of a dealership, the dealership's owners and administrators can see activity attributed to you, such as entries in the activity log and the notes, documents, findings, and escalation answers you create for the dealership's cars. Your own chat sessions, and the questions and answers inside them, are visible only to you.

2. Information we collect

• Account information: name, email address, role, dealership association, and your password, which we store only as a salted hash. If you enable two-step authentication, we also store the authenticator secret needed to verify your codes. Backup codes are stored only as SHA-256 hashes, never in usable form.
• Records you upload: the documents and data you provide about vehicles, which may include vehicle history reports (such as Carfax), VINs, service and repair receipts, build sheets, listings, and photographs. We also generate and store processed text extracted from your uploaded documents (the "master record"), which the Service uses to answer questions. See Section 6 on other people's data inside these documents.
• Photographs: photos you upload may incidentally contain license plates, VINs, location backgrounds, or images of people. We process them to display them in the Service and to generate Output, including the photo inspection feature, and they are transmitted to our AI provider for that purpose.
• Content you generate: the questions you ask, the drafts and answers produced, your edits, notes, and other material you create in the Service, including appraisal outputs (the market estimates the appraisal feature produces, which include the asking price you have set for the car).
• Showroom data: where a dealership enables the Showroom, the buyer's questions and the Service's answers (the transcript), session details (a random session token, timestamps, and a question count), and any lead the buyer chooses to leave (name, phone number, email address). Section 3 describes this in full.
• Support messages: if you use the contact form on the help page, we receive the message you write and your email address. The message is relayed by email to our support inbox, with your address set as the reply-to so we can respond.
• Usage and operational data: technical information generated when you use the Service, such as IP address, device and browser information, timestamps, pages viewed, and actions taken, together with operational records such as change logs and measures of AI processing volume used for security, debugging, and billing.
• Consent records: when you accept the Terms, we record the version you accepted, the date and time, and the IP address of that acceptance, as evidence of the agreement.

3. The Showroom (buyer questions)

The Showroom is an optional feature, disabled by default and enabled per dealership. When a dealership turns it on, a buyer can scan a QR code for a specific car and ask the Service questions about that car directly, in a short, time-capped session. This section applies only where a dealership has enabled the feature.

• What we collect from visitors: the questions asked and the answers given (the transcript), plus session details consisting of a random session token, timestamps, and a question count. We do not store the visitor's IP address with the session. Rate limiting uses short-lived, in-memory IP tracking that is never written to the database. A visitor's questions may include personal details the visitor chooses to type; anything typed becomes part of the transcript.
• Optional lead form: a visitor may choose to leave a name, phone number, or email address (at most one lead per session). Leads are visible only to the dealership's staff and to us as the dealership's service provider. When a visitor leaves a lead, we also deliver it by email — the name, phone number, and email address the visitor entered, and which car it concerns — through our email provider (Resend) to the dealership's owners and to any staff member the dealership's owner has designated to receive leads.
• No cookie: we set no cookie for Showroom visitors (see Section 13).
• Transcripts: the transcript is stored with the car's question-and-answer history for as long as the dealership keeps the car and its account, as the dealership's audit trail of what the Service told buyers; it is deleted when the associated car or the dealership account is deleted. The visitor-readable transcript link expires about 60 minutes after the session ends.
• Human review: Showroom answers are shown to the buyer directly, without prior review by dealership staff. Review happens after the fact, through the question-and-answer history and the dealership's escalation inbox. Questions the Service declines to answer are routed to the dealership to answer.
• Digest emails: if the dealership enables the optional daily digest email, that email includes the text of declined buyer questions and is sent through our email provider (Resend) to the recipient the dealership configures.
• Who is responsible: the dealership that enabled the Showroom is the controller of Showroom data, and we process it on the dealership's behalf. Privacy requests about a Showroom session or lead should be directed to the dealership; we will assist the dealership in responding.

4. How we use information

• to provide, operate, and secure the Service, and to improve it using account, usage, and operational data rather than the content of your Records; [BUSINESS: IF AGGREGATED OR DE-IDENTIFIED USAGE DATA SHOULD BE USABLE FOR PRODUCT IMPROVEMENT OR MARKETING, ADD A MATCHING RIGHT TO THE TERMS' RECORDS-LICENSE SECTION INSTEAD]
• to generate drafts, summaries, answers, and photo-inspection findings, which involves sending relevant Records and content, including uploaded photographs that are analyzed by the AI model, to our AI provider and infrastructure providers for processing;
• to authenticate users, maintain accounts, and prevent fraud or abuse;
• to communicate with you about the Service, including support and administrative messages;
• to comply with legal obligations and enforce our agreements.

Web search. Web search in the question-and-answer chat is off by default. Where it is enabled, the Service may run web searches for general, model-level public information through our AI provider's search tool. Those searches are never used to look up the specific car you are working with, including its history, accident or title records, VIN, or current listing, and search results are treated as reference data, not as facts about your specific vehicle.

Appraisal. The dealer-only appraisal feature estimates a car's market value from sales of comparable models. To do this it runs a small, capped number of web searches (currently up to 8) through our AI provider's search tool for comparable-model sale results. Those searches are never used to look up the specific car, its VIN, or its listing. To generate an appraisal, we transmit to our AI provider the car's specification (from which we withhold the VIN), the asking price you have set, and the car's master record, from which we redact the VIN where it appears.

Automated processing. The Service uses AI to generate drafts, summaries, and findings, but it does not make automated decisions that produce legal or similarly significant effects about any individual. Outside the Showroom, Output is a draft for a member of your staff to review before it is used, and it is the dealership, not AutoSavant, that makes representations to buyers. Where a dealership enables the Showroom (Section 3), answers are shown to buyers directly, and staff review happens after the fact through the question-and-answer history and the escalation inbox.

5. AI processing and training

To generate Output, we transmit relevant Records and content to our AI provider (Anthropic, through its Claude API) for processing. We do not use your Records or content to train, fine-tune, or improve any artificial-intelligence model, and our AI provider processes your data through its API to generate Output for you and does not use that data to train its models.

Prompt caching. To reduce cost and latency, AutoSavant's own static instruction text for the question-and-answer feature (fixed rules of ours, the same for every request) is cached temporarily by our AI provider; this is on by default. Your Records, questions, and other content are not cached in this way; they are transmitted with each request and processed as described above.

Metering. Our internal AI-usage ledger records token counts (measures of processing volume) only; it never stores the content of Records, questions, or answers.

6. Data inside your documents

Documents you upload, such as vehicle history reports, service receipts, and auction listings, may contain personal details about other people, for example prior owners, consignors, or a repair shop's customers. Those details persist in the stored file, in the text extracted from the document, and in the consolidated master record, and they are transmitted to our AI provider when the Service runs AI processing over them. Deleting a source document also removes that document's section from the master record. The dealership is responsible for this data as controller, as described in Section 1.

Photographs you upload are retained as uploaded and served only to authenticated users of your dealership. The exception is the public Showroom hero photo, which is re-encoded before display; re-encoding strips embedded metadata such as EXIF and GPS location data.

7. Subprocessors and third parties

We rely on a limited set of service providers ("subprocessors") to operate the Service. Each processes information only on our instructions and only as needed to provide its service:

Resources your browser loads. Pages in the Service load some resources directly from third-party hosts: the Tailwind styling library from cdn.tailwindcss.com, the HTMX library from unpkg.com, QR-code and markdown libraries from cdnjs.cloudflare.com, and fonts from fonts.googleapis.com and fonts.gstatic.com. As with any web resource, those hosts see the visitor's IP address and browser user agent when the resource loads. This applies to Showroom visitors as well as dealership users. QR codes are generated in your browser; the URL encoded in a QR code is not sent to any QR service.

We may update this list as our providers change, and will provide notice of material changes where required. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

8. Data location and international transfers

We store and process information in the United States. If you access the Service from outside the United States, you understand that your information will be transferred to and processed in the United States. Where applicable law requires safeguards for an international transfer of personal information, we will put appropriate safeguards in place, such as Standard Contractual Clauses, before making the transfer.

9. Legal bases (where GDPR or UK GDPR applies)

Where the GDPR or UK GDPR applies, we process personal information on these bases: performance of a contract (to provide the Service to your dealership and your users); legitimate interests (to secure, maintain, debug, and improve the Service and to prevent fraud or abuse), balanced against your rights; legal obligation (to comply with law and retain records as required); and consent where we ask for it. For personal information contained in the Records, and for Showroom data, our basis is to perform the Service on the dealership's instructions, and the dealership is responsible for having a lawful basis to provide or collect that data.

10. Data retention and deletion

We keep different categories of information for different periods:

• Account information: for the life of your account and for a period afterward to meet legal, tax, and dispute-resolution needs.
• Records and generated content (including the master record and uploaded photos): while your account is active and you choose to keep them. You may delete individual Records or your account at any time.
• Showroom transcripts and session records: retained for as long as the dealership keeps the car and its account, as the dealership's audit trail of what the Service told buyers; deleted when the associated car or the dealership account is deleted.
• Showroom leads: deleted when the associated car is deleted. Copies of a lead delivered to the dealership by email reside in the dealership's own mailboxes and are under the dealership's control, not ours.
• Usage, log, change-log, and processing-volume data: retained for security, debugging, and billing; the AI-usage metering ledger and the change log are retained indefinitely.
• Consent records: retained as evidence of your acceptance for as long as needed to evidence the agreement. [COUNSEL: SELF-SERVE ACCOUNT DELETION CURRENTLY HARD-DELETES THE USER ROW, INCLUDING THE CONSENT TIMESTAMP AND IP, WHICH CONFLICTS WITH THIS RETENTION PROMISE; DECIDE WHETHER THE DELETION FLOW OR THIS CLAUSE CHANGES]

On a verified deletion request, or on account closure, we will delete or de-identify your personal information and Records that we are able to remove from active systems, within a reasonable period, subject to legal retention requirements. Residual copies may persist in routine database backups: we keep the most recent 14 backup snapshots on a rolling basis, so deleted data can persist in a backup until it rotates out. Backups are not used to restore deleted data except as part of a disaster-recovery event.

11. Security

We use reasonable technical and organizational measures designed to protect information, including encryption in transit (HTTPS and TLS), passwords stored only as salted scrypt hashes, signed session cookies that expire after 7 days and can be revoked on the server, protection against cross-site request forgery, role-based access controls, per-tenant data isolation, and optional two-step authentication for accounts. Within AutoSavant, access to your Records and content is limited to personnel who need it to operate the Service, provide support you request, or investigate abuse, security, or legal issues. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

Incident notification. If we become aware of a security incident affecting your personal information or Records, we will notify you without undue delay and as required by applicable law, and provide information reasonably available to help you meet your own notification obligations.

12. Your rights

As between you and AutoSavant, you (the dealership) own the Records and content you upload. Depending on where you and your users are located, you may have some or all of the following rights regarding personal information we control:

• to access or know what personal information we hold, and its categories, sources, purposes, and recipients;
• to correct or rectify inaccurate information;
• to delete or erase information, subject to legal retention exceptions;
• to receive certain information in a portable format;
• to restrict or object to certain processing;
• to opt out of sale or sharing (we do not sell personal information and do not share it for cross-context behavioral advertising), and to limit the use of sensitive personal information where applicable;
• not to be discriminated against for exercising these rights.

To exercise a right, contact us at support@autosavant.app. We may need to verify your identity and your authority before acting on a request, and we will respond within the time required by applicable law. You may use an authorized agent and, where applicable, appeal a decision or lodge a complaint with your data protection authority or state regulator. If your request concerns personal information contained in the Records or collected through the Showroom (for example, a buyer's information, a Showroom transcript, or a lead), we act as the processor and will refer or direct the request to the relevant dealership as the controller.

13. Cookies and sessions

The Service uses a single strictly necessary signed session cookie, named "dealer_session", to keep you logged in and to protect against cross-site request forgery. It expires after 7 days and can be revoked on the server. We do not use advertising, analytics, or cross-site tracking cookies, and we set no cookie for Showroom visitors. The Service also stores device-local preferences (such as your theme, dismissed tips, and panel layout) in your browser's localStorage; those values never leave your device. Because we do not track users across sites or over time, we do not respond differently to "Do Not Track" or Global Privacy Control browser signals, and there is no cross-context behavioral advertising to opt out of.

14. Children

The dealer-facing Service is a business tool for licensed dealers and is not intended for, or directed to, children, and we do not knowingly collect personal information from children. The Showroom (Section 3) is reachable by anyone who scans a car's QR code. [COUNSEL: AUDIENCE AND CHILDREN LANGUAGE FOR THE PUBLIC SHOWROOM SURFACE, INCLUDING ANY COPPA POSITION]

15. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the updated Policy with a new effective date and, where appropriate, notify you within the Service. Your continued use of the Service after the changes take effect means you accept the updated Policy. We will not use previously collected personal information in a materially new way without first providing prominent notice and, where applicable law requires it, obtaining consent.

16. Contact

Questions about this Privacy Policy, or requests relating to your data, can be sent to [COMPANY LEGAL NAME] at support@autosavant.app, or by mail at [MAILING ADDRESS].