Privacy Policy

1. Who we are #

MotoDealerHQ is operated by [Missing business fact: Legal name of the business that operates MotoDealerHQ], [Missing business fact: Entity type and place of registration (for example the kind of company and the state it is registered in)], [Missing business fact: Postal address for notices]. Privacy questions and requests: [Missing business fact: Email address for privacy requests].

2. What this policy covers #

• People who visit this site or sign up. We decide how this information is used.
• Dealership staff who use the dealer console.
• A dealership's customers and website visitors. Dealerships use MotoDealerHQ to run their websites and keep their customer records. For that information we act on the dealership's behalf and follow its instructions: the dealership's own privacy notice applies, and requests about it are best sent to the dealership. We help dealerships answer them.

3. What we collect #

When you sign up: your name, your email address and a password, which we store only as a one-way Argon2id hash. We also keep the IP address of the sign-up request, which versions of the Terms of Service and this policy you accepted, and when.

When staff use the console: name, email, role and rooftops; sign-in sessions with their IP address and browser; two-factor secrets, stored encrypted; and an audit log of who changed what and when, with IP addresses.

What a dealership puts in: inventory, leads and customer records (names, contact details, vehicles of interest, trade-ins), messages, appointments, deals, service and parts records, documents and photos. Credit applications are encrypted with a separate key per dealership; only the last four digits of a Social Security number are stored readable.

On dealership websites: visit statistics are counted without cookies and without storing IP addresses. A visit is grouped by a keyed hash of the IP address and browser that changes every day. Form submissions store a hashed IP address. If a dealership adds its own Google Analytics id, Google receives visit data under the dealership's account. Dealership websites can also show Google Maps and load fonts from Google Fonts, which tells Google the visitor's IP address.

Cookies: this site and the consoles use cookies needed for sign-in, security tokens and forms. If you choose to remember a device after two-factor sign-in, a cookie keeps it remembered for up to 30 days. We do not use advertising cookies.

4. How we use it #

To provide and secure the service, to send service emails (sign-up confirmation, password resets, invitations, alerts), to bill dealerships, to answer support requests and to investigate errors and misuse. Our staff enter a dealership's console only when the dealership grants support access, for a limited time, and those sessions are logged.

[Decision needed: Confirm that personal information is never sold or shared for cross-context advertising, and whether any marketing email is sent to sign-ups (and how to opt out).]

5. AI features #

When a dealership uses an AI feature, the request and the records needed to answer it are sent to the AI model provider configured for the platform. What is sent is limited to what the user is allowed to see: financial and customer details are removed when that person's permissions or the dealership's AI policies say so. AI drafts are not sent to customers until a person approves them.

[Decision needed: Which AI model providers are used, where they process data, and whether they keep or train on it under the platform's agreements with them.]

6. Service providers #

The server and its backups are hosted by [Missing business fact: Hosting provider and the country where the server and its backups are located].

Other providers receive data only for the features that use them, and only once the platform or the dealership has connected them: email delivery, text messaging, card payments, AI models, vehicle history reports, market data, accounting, video and marketplace listings. Providers a dealership connects with its own account (for example its own payment, texting, accounting or marketplace account) work under the dealership's agreement with that provider.

[Decision needed: The list of service providers (sub-processors) in use on the effective date, what each receives and where it is located, and how dealerships are told about changes.]

7. How long we keep it #

[Decision needed: How long the data of a cancelled account is kept before it is deleted, and how long billing and acceptance records are kept.]

8. Export, correction and deletion #

• Dealerships can export inventory, leads, customers, parts, reports and accounting records as CSV files, also after cancellation.
• Dealership staff with the delete permission can erase a customer's personal details on request; reports keep an anonymous record.
• A dealership account is permanently deleted only after it has been archived for a waiting period with no open invoices, confirmed by a platform owner.
• To ask about your own information, write to [Missing business fact: Email address for privacy requests].

[Decision needed: Which privacy laws the business must comply with, the rights it offers (access, correction, deletion, opt-out, appeal), how requests are verified, and the response time.]

9. Security #

How data is separated, protected and backed up, including what is not in place yet, is described at /trust.

[Decision needed: Who is notified of a personal-data breach, by whom, and within what time (see the draft incident-response procedure).]

10. Children #

MotoDealerHQ is a business service and is not meant for children.

11. Changes #

Each version of this policy has a version id and an effective date. We record which version was accepted at sign-up. [Decision needed: How users are told about a new version and how much notice they get.]