Privacy Policy
Effective date: October 4, 2026
See also our Terms of Service.
1. Who we are
DealerVLO (“DealerVLO,” “we,” “us,” or “our”) provides a software-as-a-service platform for used-vehicle dealerships to manage inventory, customers, deals, sales documents, and a public-facing dealer website. This Privacy Policy explains what information we collect, how we use it, and the choices you have.
When a dealership uses DealerVLO to keep records about its own customers, or to email them or collect their signatures, the dealership decides how that information is used and we process it on the dealership's behalf. If you bought or inquired about a vehicle from a dealership that uses DealerVLO, the dealership is usually the best first contact for questions about your information, and you can also contact us.
2. Information we collect
- Account: name, email, and password (hashed by our authentication provider). If you choose “Continue with Google,” Google shares your name and email address with us instead of a password.
- Dealership: legal name, DBA, license number, tax ID, address, phone, email, hours, logo, brand colors
- Billing: handled by Stripe; we receive only metadata (last 4 digits, expiration, customer ID), never full card numbers
- Settings and preferences you configure within the Service
- Customer records you create: customer names, addresses, phone numbers, email addresses, dates of birth, and driver's license numbers. Driver's license numbers are encrypted at rest using AES-256-GCM.
- Vehicle inventory: VINs, year/make/model/specs, photos you upload, descriptions
- Deal records: pricing, finance terms, trade-in information, generated documents
- Leads: inquiries received through your dealer website, with the notes and status you add
- Contact-form submissions on dealer websites: name, email, phone, optional message, vehicle of interest
- Online credit applications, if a dealership turns them on: the applicant's (and any co-applicant's) name, date of birth, contact details, current and previous address, housing costs, employer and job history, income, the vehicle and down payment they're interested in, and their signed authorization. We do not collect Social Security numbers or driver's license numbers through this form. We process this information on behalf of the dealership, which decides how it is used, including sharing it with lenders to arrange financing.
- Electronic signatures: when a buyer or co-buyer signs documents electronically, we record their consent to sign electronically, when they viewed and signed, their IP address, and their device and browser. This audit trail is attached to the signed document as a certificate of completion, as electronic-signature laws require.
- Email engagement for emails sent through DealerVLO, described in section 4
- We do not place tracking, analytics, or advertising cookies, or any other analytics, on dealer websites
- Usage analytics, collected by us rather than a third-party analytics company: the pages you view, the site that referred you, campaign tags in the link you followed (such as utm_source), your approximate country, your device type (mobile, tablet, or desktop), and a random session identifier kept in your browser's session storage, which is cleared when you close the tab. We do not store your IP address for analytics. You can turn analytics off by choosing Decline on our cookie notice.
- Free calculators: the numbers you enter are recorded without any personal information and used in aggregate to publish industry benchmarks.
- Email sign-ups: if you subscribe to our newsletter or ask us to email you a calculator result, we collect your email address and whether you opted in to follow-up emails.
- Log data for security and debugging: IP address, browser, requested URL, timestamp
- Error reports, which may include technical details of the request that failed
- Authentication cookies required for the CRM to remember you between requests
3. How we use information
- To operate, maintain, and improve the Service
- To authenticate users and protect accounts
- To process subscriptions and billing
- To populate the legal sale documents (Bill of Sale, title and registration forms, Buyers Guide, Odometer Disclosure) from your deal data
- To host and display each dealership's public website using inventory and customer-facing information you enter
- To send email on a dealership's behalf to its customers, such as signature requests, sale documents, and replies to website inquiries
- To send inventory to the listing sites a dealership chooses (see section 5)
- To provide optional AI features, such as vehicle descriptions, price suggestions, deal-jacket reviews, and lead summaries (see section 5)
- To communicate about your account, trial, billing, security alerts, and material Service changes
- To send our newsletter and dealer tips to people who subscribed or opted in
- To understand how our website is used and which content and campaigns are useful, in aggregate
- To comply with legal obligations
We do not use customer data to train machine-learning models or sell it to third parties.
4. Email and email tracking
We send email through our email provider, Resend. That includes emails to dealership users (account, trial, and billing messages), emails a dealership sends to its customers through DealerVLO, and our newsletter and tips for people who subscribed.
Open and click tracking. Emails sent through DealerVLO may contain a small invisible image that tells us when the email was opened, and links in them may pass through links.dealervlo.com, which records the click and then immediately sends you to the destination. We use this to confirm delivery, troubleshoot, and learn which emails are useful. Open information is approximate, because many email apps load images automatically.
Your choices. You can block images in your email app to prevent open tracking. Every newsletter and tips email has an unsubscribe link. Emails that are necessary for your account, or that a dealership sends you about your purchase, are not marketing and don't carry an unsubscribe option; you can ask the dealership about those.
5. How we share information
We share information only with the following service providers, each contractually obligated to protect it, and only as needed to provide the Service:
- Supabase — database, authentication, file storage. US data centers.
- Vercel — application hosting and edge delivery.
- Stripe — payment processing. PCI-DSS Level 1 certified.
- Resend — email delivery and email open and click tracking.
- Anthropic — the AI model behind our optional AI features. We send only what a feature needs: vehicle details (and, for price suggestions, the dealership's ZIP code); deal terms for deal-jacket reviews, never a customer's driver's license number, Social Security number, date of birth, or address; and, for lead summaries, the lead's first name, message, and vehicle of interest, never their phone number or email.
- fal.ai — separates the vehicle from its background when a dealership chooses to enhance a photo. Only the photo is sent.
- Sentry — error monitoring, so we can find and fix problems. For dealerships that sign up on or after October 4, 2026, during their first week Sentry also records how the dealer app is used (pages visited, clicks, and screen layout) so we can see where setup gets confusing. All on-screen text, everything typed into forms, and all images are hidden before anything is sent.
- Google — sign-in, if you choose “Continue with Google.”
- NHTSA vPIC — public US government VIN-decode API. Only the VIN is transmitted; no PII.
Listing sites a dealership chooses. If a dealership turns on inventory syndication, we send its inventory (vehicle details, photos, and prices) along with the dealership's name, address, and contact details to the listing sites it selects, such as CarGurus, Cars.com, AutoTrader, and Facebook. No information about the dealership's customers is included. Those sites handle the listings under their own privacy policies.
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
We may disclose information if required by a valid legal process (subpoena, court order) or to protect the rights, property, or safety of DealerVLO, our users, or the public.
6. Data retention
- Account data is retained for the life of the account.
- Customer, vehicle, and deal data is owned by the dealership; the dealership can export or delete it at any time.
- Generated sale documents, including electronic-signature certificates, are retained as a versioned audit trail per deal.
- Online credit applications are deleted automatically 25 months after they are submitted, or sooner if the dealership's account is deleted.
- Newsletter and tips subscriptions are kept until you unsubscribe.
- Website analytics records contain no names, email addresses, or IP addresses and are kept for trend reporting.
- After account deletion, your data is removed from active systems within 30 days. Backups are rotated within 60 days.
- We may retain limited records (e.g. invoices) longer where required by law.
7. Security
- HTTPS / TLS for all data in transit
- AES-256-GCM encryption at rest for sensitive PII (driver's license numbers and dates of birth)
- Online credit applications are encrypted with a separate key, can be opened only by a dealership's owners, admins, and finance managers, and every view or download is logged
- Password hashing handled by our authentication provider (bcrypt)
- Generated documents stored privately; download links are short-lived signed URLs
- Regular dependency updates and security patches
- Role-based access within each dealership (OWNER, ADMIN, SALES, FNI)
No system is perfectly secure. We will notify affected users without undue delay if we become aware of a personal-data breach affecting their information.
8. Your rights
You may, at any time:
- Access and download your data via the Service
- Correct or update your information from within the application
- Request deletion of your account and associated data by emailing us at the address below
- Unsubscribe from our newsletter and tips using the link in any of those emails
- Ask us a question about your data by contacting us at the email below
If a dealership holds your information, you can make these requests to the dealership, or to us and we will work with the dealership to respond.
California residents: the CCPA grants you the right to know what personal information we collect, to correct it, to delete it, and to opt out of any sale or sharing (we do neither).
EU/UK residents: the GDPR grants you the rights of access, rectification, erasure, restriction, portability, and objection. Our legal basis for processing is contract performance (operating the Service you subscribed to), legitimate interest (securing the Service and understanding how our website is used), and consent (our newsletter and tips).
9. Cookies and similar technologies
We use a small number of first-party browser storage items and no third-party advertising or analytics cookies:
- Authentication cookies, which are strictly necessary to keep you signed in to the CRM.
- A short-lived cookie (30 minutes) set only when you choose “Continue with Google,” so the page or campaign that brought you is remembered through sign-in. It is deleted once sign-up completes.
- Session storage (not a cookie) holding the analytics session identifier and campaign tags described in section 2. It is cleared when you close the tab.
- Local storage remembering your choice on our cookie notice. If you decline, we stop collecting usage analytics and delete the analytics identifiers stored in your browser.
Dealer-owned public websites we host use only what is strictly necessary to display them.
10. Children's privacy
11. International users
12. Changes to this policy
13. Contact us
Questions, requests, or complaints about this Privacy Policy:
privacy@dealervlo.com
DealerVLO