Privacy Policy

This policy describes how CarLotConnect (“the platform,” “we,” “us”) handles information when a dealership or a customer uses the site — browsing listings, creating a dealer account, following a shared link, or messaging through the platform.

Dealer accounts: name, email, phone number, and dealership name and address. If you subscribe to a paid plan, billing is handled entirely by Stripe — we never receive or store your card number.

Customers following a shared link: a name, phone number and/or email if you choose to provide one, plus which vehicles you viewed, liked or passed on. This powers the interactive swipe-deck experience and lets a dealer follow up on real interest — it isn’t shared outside the dealership that sent you the link.

Vehicle listings: everything a dealer enters or uploads about a vehicle, including photos.

Messages: the content of messages sent between a dealer and a customer through the platform’s messaging feature.

Usage data: page views, listing impressions, and engagement signals like time spent on a listing. This is computed and stored entirely within our own systems — we don’t use Google Analytics, Meta Pixel, or any third-party advertising tracker.

Entering a VIN sends it to the U.S. National Highway Traffic Safety Administration’s free public vPIC lookup service to retrieve the vehicle’s specifications — a government service we don’t operate, and no personal information travels with that request.

AI-assisted features (auto-filling a listing from photos, drafting marketing copy) send the photos or text a dealer provides for that purpose to Google’s Gemini API to generate a suggestion, which the dealer reviews before anything is published.

The platform uses a small number of strictly functional cookies and browser storage — keeping you signed in, remembering whether the dashboard menu is open, and remembering a light/dark theme choice. None of these are used for advertising, and none track you across other websites.

• Google Cloud / Firebase — hosts our database, file storage and sign-in.
• Stripe — processes all payments; we never see full card numbers.
• Google Gemini API — processes content submitted to an AI-assisted feature.
• NHTSA’s vPIC service — receives a VIN to return public vehicle data.

We do not sell personal information, and we don’t share it with advertisers or data brokers.

We keep account, listing and message data for as long as an account stays active and for as long as reasonably needed afterward to support the service. You can update most of your own information directly from your dashboard at any time.

The platform is intended for licensed dealerships and adult consumers. It isn’t directed at children, and we don’t knowingly collect personal information from anyone under 13.

Access to stored data is restricted through authentication and database access rules, and payment details never pass through our own servers. No system is perfectly secure, and we can’t guarantee against every possible incident.

If this policy changes materially, we’ll update the effective date above and post the revised version here.