Privacy Policy

1. Information We Collect

Account & Dealership Information

• Dealership name, address, phone number, and website URL
• Owner and staff names, email addresses, and roles
• Billing information (processed via Stripe — we do not store card numbers)
• Dealership logo and uploaded photos

Vehicle Inventory Data

• Vehicle listings from your inventory feed (VIN, year, make, model, price, photos, description)
• Feed configuration settings and sync schedules
• Destination platform mappings (Facebook Marketplace, CarGurus, AutoTrader, etc.)

Customer Lead Data

• Lead name, email address, phone number, and vehicle interest
• Lead source (Facebook Lead Ad, website form, marketplace inquiry)
• ADF/XML payload data delivered by connected ad platforms
• CRM delivery status and timestamps

Ad Account Access

• OAuth tokens for Meta (Facebook/Instagram) and Google Ads — stored encrypted
• Ad campaign performance data (impressions, clicks, spend, conversions)
• Audience and targeting configurations you create in DealerDrive

Usage & Technical Data

• IP address, browser type, and device information
• Pages visited, features used, and session duration
• Error logs and performance metrics to improve the service

2. How We Use Your Information

We use the information we collect to:

• Provide and operate the DealerDrive platform
• Sync your vehicle inventory to Facebook Catalog, Google Merchant Center, and marketplace platforms on your behalf
• Deliver customer leads to your CRM via ADF/XML email or API
• Manage and optimize ad campaigns using your connected Meta and Google ad accounts
• Monitor and aggregate review data from Google, Facebook, and Yelp
• Generate AI-powered performance summaries (DealerIQ) using anonymized data
• Send transactional emails: lead notifications, feed sync alerts, billing receipts
• Send weekly performance reports and daily lead summaries (if enabled)
• Improve the platform through aggregate analytics and usage patterns
• Comply with legal obligations and prevent fraud

We do not sell your dealership data or lead data to third parties for marketing purposes.

3. Google API Services — Data Usage

DealerDrive uses Google API Services to provide advertising management features on behalf of our dealer customers. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google Ads API

When a dealer connects their Google Ads account via OAuth, DealerDrive accesses the Google Ads API (adwords scope) to:

• Create and manage Performance Max campaigns and Vehicle Ads on the dealer's behalf
• Create and manage campaign budgets and bidding strategies
• Upload vehicle inventory as asset groups and listings
• Create conversion actions to track lead form submissions and phone calls
• Retrieve campaign performance metrics (impressions, clicks, cost, conversions) for dashboard reporting
• Manage the dealer's sub-account within DealerDrive's Manager Account (MCC) structure

Google Ads campaign data retrieved via the API is used exclusively to provide the DealerDrive service to that dealer. We do not use Google Ads data for any purpose other than providing and improving the directly requested features. We do not share or sell Google Ads data to any third parties for advertising or other commercial purposes.

Google Analytics Data API

When a dealer connects their Google Analytics 4 property via OAuth, DealerDrive accesses the Analytics Data API (analytics.readonly scope) to:

• Retrieve website traffic, session, and user metrics for the dealer's website
• Retrieve conversion event data (lead forms, phone clicks, direction requests)
• Display audience, channel, and behavior analytics within the DealerDrive dashboard
• Provide real-time active visitor data

Google Analytics data is used exclusively to display analytics information to the authorized dealer. It is not shared with other dealers, third parties, or used for any purpose beyond the specific features the dealer has enabled.

Google Business Profile API

DealerDrive accesses Google Business Profile data to help dealers manage their business listing, publish posts, and respond to reviews through the DealerDrive dashboard. This data is not shared with any third party and is used only for the features the dealer explicitly requests.

Data Storage and Security for Google API Data

OAuth tokens from Google are encrypted at rest using AES-256-GCM before database storage and are transmitted exclusively over TLS. Retrieved campaign and analytics data is cached temporarily (maximum 24 hours) for dashboard performance and is not used beyond the purposes described above. Dealers may revoke DealerDrive's Google access at any time through their Google Account security settings or through the DealerDrive Settings → Integrations page.

4. Third-Party Sharing

DealerDrive integrates with the following third-party services to provide its features. Each has its own privacy policy governing how they handle data.

We may also disclose information to law enforcement or regulators when required by law, or to protect the rights, property, or safety of DealerDrive, our customers, or others.

5. Data Retention

• Customer leads: Stored for 90 days after receipt, then automatically purged unless exported to your CRM.
• Vehicle inventory: Retained while listed in your active feed. Removed from our systems within 24 hours of removal from your inventory.
• Ad campaign data: Retained for 24 months to support historical reporting and trend analysis.
• Review data: Retained for 24 months.
• Account data: Retained for 30 days after account termination, then permanently deleted (except records required for tax/legal compliance).
• Activity logs: Retained for 90 days for security and audit purposes.

6. Security

We use industry-standard security measures to protect your data, including TLS encryption in transit, AES-256 encryption at rest for sensitive fields (OAuth tokens, API keys), role-based access controls, and regular security audits. Passwords are hashed using bcrypt and are never stored in plain text. OAuth tokens are encrypted using AES-256-GCM before database storage.

While we take security seriously, no method of transmission or storage is 100% secure. If you discover a security vulnerability, please report it to privacy@dealersales.co.

7. California Privacy Rights (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: Request deletion of personal information we have collected, subject to certain exceptions.
• Right to Opt-Out: We do not sell personal information. You may still direct us not to share your data with certain third-party processors.
• Right to Non-Discrimination: We will not discriminate against you for exercising any CCPA rights.
• Right to Correct: Request correction of inaccurate personal information.

To exercise any of these rights, email privacy@dealersales.co with the subject line "CCPA Request." We will respond within 45 days.

8. Cookies & Tracking

We use cookies and similar tracking technologies to:

• Maintain your authenticated session (essential)
• Remember preferences like "Remember me for 90 days" (functional)
• Collect aggregate usage analytics to improve the platform (analytics)

We do not use advertising or cross-site tracking cookies. You can disable cookies in your browser settings, though some features may not work correctly.

9. Children's Privacy

DealerDrive is a B2B service intended for use by auto dealership businesses and their employees. We do not knowingly collect personal information from individuals under 18 years of age. If you believe we have inadvertently collected such information, please contact us immediately at privacy@dealersales.co.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email or an in-app banner at least 14 days before the changes take effect. The "Last updated" date at the top of this page will always reflect the most recent revision. Continued use of DealerDrive after the effective date constitutes acceptance of the updated policy.

11. Contact Us

For privacy-related questions, data requests, or to report a concern: