Política de privacidad

1. Responsable y contacto

Controller: CarLotCRM LLC. Legal entity for invoices, privacy, and terms: CarLotCRM LLC. Mailing address: [JUAN FILL: registered / mailing address after LLC filing]. State of formation: [JUAN FILL: state of formation]. EIN: [JUAN FILL: EIN after IRS assignment — do not publish until assigned].

Privacy requests: privacy@carlotcrm.com ([JUAN FILL: create @carlotcrm.com mailboxes (privacy, legal, support, abuse) in Google Workspace]). Do not send payment card numbers to this address.

2. Alcance

This Policy covers our marketing site, product applications, APIs, widgets, and messaging channels we operate for dealership customers. It does not replace a dealership’s own privacy policy for shoppers on the dealer’s website or showroom.

• Marketing visitors and demo bookings on carlotcrm.com
• Dealer staff, admins, and authorized users of CarLotCRM accounts
• Shopper / lead data processed when dealers use CRM, inbox, voice, chat, or related tools

3. Información que recopilamos

We collect information you provide, information collected automatically, information from integrations you connect, and shopper data dealers submit or receive through the Service.

• Account and profile data (name, email, phone, role, dealership)
• Billing and subscription data (processed by Stripe; we do not store full card numbers)
• Content you upload (inventory metadata, notes, knowledge-base articles, messages)
• Support and demo requests
• Device / browser data, IP address, approximate location, pages viewed, referrers
• Cookies and similar technologies (see Cookie Notice)
• Product usage and security logs
• Telephony / SMS (e.g. Twilio), email (e.g. SendGrid), calendars (Google), payments (Stripe)
• Social / messaging platforms (e.g. Meta, TikTok) when a dealer connects accounts
• Inventory and lead feeds a dealer configures
• Shopper CRM fields: contact info, vehicle interest, conversation content, call recordings/transcripts when enabled, appointments

4. Cómo usamos la información

We use personal information to operate, secure, and improve the Service; authenticate users; prevent fraud; bill and collect fees; send transactional notices; provide AI-assisted features (suggested replies, voice agents, summaries) using conversation and inventory context you or the dealer supply; measure product reliability and (on our marketing site) marketing performance; and comply with law.

AI note: Content may be sent to subprocessors (for example OpenAI or ElevenLabs) to generate responses. We configure vendors for service delivery. We do not sell personal information.

5. Bases legales (EEE/RU cuando aplique)

Where GDPR/UK GDPR applies, we rely on: performance of a contract; legitimate interests (security, product improvement, B2B marketing to prospects); consent (certain cookies and messaging); and legal obligation.

6. Compartición

We share personal information with service providers / subprocessors under contract (hosting, payments, email, telephony, AI, analytics); with dealership customers (their tenant data is available to their authorized users); with professional advisors and authorities when required; and in connection with a business transfer, with notice where required.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising as a “sale” or “share” under the CPRA without required choices. Marketing-site cookies may require opt-out or consent tooling as described in the Cookie Notice.

7. Conservación

We retain information for as long as the account is active and as needed for legal, tax, dispute, and security purposes. Dealers may request export or deletion of tenant data subject to law and our agreements. Call recordings and transcripts are retained per product settings and any legal holds.

8. Seguridad

We use technical and organizational measures appropriate to the risk, including encryption in transit, access controls, and tenant isolation. No method of transmission or storage is 100% secure.

9. Sus derechos

Depending on your location (including US state privacy laws and GDPR), you may have rights to access, correct, delete, port, restrict, or object to certain processing; to opt out of sale/share/targeted advertising; and to appeal a denial. Submit requests to privacy@carlotcrm.com. Authorized agent requests are honored as required by applicable law. We will not discriminate against you for exercising privacy rights.

California: Categories collected align with Section 3. Shine the Light and CPRA metrics will be provided as required when the Service is live to California residents at scale.

10. Menores

The Service is for business users. It is not directed to children under 16. We do not knowingly collect children’s personal information.

11. Transferencias internacionales

Data may be processed in the United States and other countries where we or our subprocessors operate. Where required, we use appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.

12. Datos de plataformas conectadas

When a dealer connects Google, Meta, TikTok, or similar accounts, we process data those platforms provide solely to deliver the features the dealer enables (for example inbox sync, posting, or lead intake). We follow each platform’s developer and limited-use policies. Dealers can disconnect integrations in product settings; we delete or de-identify related tokens according to our retention rules and platform requirements.

13. Cambios

We may update this Policy. Material changes will be posted with an updated effective date. Continued use after notice constitutes acceptance where permitted by law.

14. Contacto

CarLotCRM LLC — privacy@carlotcrm.com — [JUAN FILL: registered / mailing address after LLC filing]