Privacy Policy

LotIQ, Inc. (“LotIQ,” “we,” “us,” or “our”) operates a software platform that helps used car dealerships manage their operations, including inventory, customer relationships, sales, and communications. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, visit our websites, or interact with communications sent through our service.

This policy applies to dealership personnel who use the LotIQ platform (“Users”) and to consumers who interact with dealerships through LotIQ-powered forms, messages, or other touchpoints (“Consumers”).

2.1 Information You Provide

• Account Information: Name, email address, phone number, and job title when dealership personnel create an account.
• Consumer Application Data: Name, address, phone number, email, and other details submitted through dealership onboarding or application forms.
• Financial Information: Income details, employment information, and other financial data submitted for verification purposes, as directed by the dealership.
• Communications: Messages exchanged between dealership representatives and consumers through our messaging features (SMS, WhatsApp).
• Vehicle Information: VINs, pricing, mileage, photos, and other inventory data entered by dealership personnel.

2.2 Information Collected Automatically

• Usage Data: Pages viewed, features used, time spent on the platform, and other interaction data.
• Device Information: Browser type, operating system, IP address, and device identifiers.
• Cookies: Session cookies for authentication and analytics cookies for improving our service. See Section 8 for details.

2.3 Information from Third Parties

• Vehicle Valuation Data: Market pricing and condition data from services like Manheim and JD Power, requested by dealership personnel.
• Credit and Verification Data: Reports obtained through authorized third-party providers at the consumer’s and dealership’s request.
• Meta / WhatsApp Business Account Data: When a dealership connects WhatsApp through Meta’s Embedded Signup, we receive their Facebook Business Manager ID, WhatsApp Business Account ID, phone number ID, and a long-lived access token (stored encrypted at rest). We use this solely to register the dealership’s WhatsApp sender and route messages on their behalf. See Section 6.

• Provide and Operate the Platform: Manage accounts, process applications, facilitate communications between dealerships and consumers, and support dealership operations.
• Communications: Send transactional messages (e.g., verification links, appointment reminders) and facilitate dealership-to-consumer messaging, with consumer consent.
• Improve Our Services: Analyze usage patterns to enhance features, fix bugs, and develop new functionality.
• Security and Fraud Prevention: Detect and prevent unauthorized access, abuse, and fraudulent activity.
• Legal Compliance: Comply with applicable laws, regulations, and legal processes.

When consumers submit an application through a LotIQ-powered form, they are asked to provide express written consent to receive calls or text messages from the dealership. This consent is:

• Voluntary: Consent is not a condition of purchase or service.
• Recorded: We capture the consent timestamp, IP address, and method (web form) for compliance purposes.
• Revocable: Consumers may reply STOP to any message to immediately opt out of future messages.
• Transparent: The consent checkbox clearly describes the types of messages the consumer may receive.

Standard message and data rates may apply. For help, consumers may reply HELP to any message to receive support information.

We do not sell your personal information. We may share it with:

• Dealership Partners: Consumer application data is shared with the specific dealership to which the consumer applied. Each dealership is responsible for their own use of consumer data in accordance with applicable laws.
• Service Providers: Third-party vendors who assist in operating our platform (hosting, communication delivery, analytics, payment processing) under contractual obligations to protect your data.
• Third-Party Integrations: Valuation providers, credit bureaus, and other services activated by dealership personnel. Data is shared only as directed by the dealership.
• Legal Requirements: When required by law, regulation, legal process, or governmental request.

LotIQ integrates with Meta Platforms, Inc. (“Meta”) solely to enable dealerships to send and receive messages on WhatsApp. This integration is opt-in and is initiated by a dealership owner from our settings page.

6.1 How the integration works

• Meta Embedded Signup SDK: When a dealership connects WhatsApp, our settings page loads Meta’s JavaScript SDK from connect.facebook.net. That SDK runs in the dealership user’s browser and is subject to Meta’s own privacy practices.
• OAuth handshake: Meta returns an authorization code, which our servers exchange for a long-lived Business Integration System User access token. The token is encrypted at rest before storage and is never exposed to the client.
• WhatsApp messaging: Messages sent or received via WhatsApp pass through Meta’s infrastructure and our telephony provider Twilio. Meta processes message content per its own policies (WhatsApp Business Policy).

6.2 What we do NOT do

• We do not run the Meta Pixel, Facebook Conversions API, or any other ad-tracking technology on our platform.
• We do not use Facebook Login, Sign in with Facebook, or any other Meta-based authentication for end users.
• We do not use the Meta Marketing API, Lead Ads, or Custom Audiences. We do not send personal information to Meta for advertising or audience-building purposes.

For information about how Meta processes data, see Meta’s Privacy Policy.

We implement industry-standard security measures to protect your information:

• Encryption of sensitive data at rest and in transit (TLS 1.2+).
• PII encryption for sensitive fields such as Social Security Numbers using AES-256 encryption.
• Row-level security (RLS) ensuring strict multi-tenant data isolation between dealerships.
• Role-based access controls (RBAC) limiting data access to authorized personnel.
• Regular security assessments and monitoring.

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

We retain personal information only as long as necessary to provide our services, comply with legal obligations, resolve disputes, and enforce agreements. Specific retention periods:

• Account data (dealership users): Retained while the account is active. Deleted within 90 days of account closure unless we are required to retain it longer for legal, tax, or accounting purposes.
• Consumer application and financial data: Typically retained for up to 7 years to comply with FCRA, state dealer recordkeeping rules, and applicable tax law. The dealership, as data controller, may instruct us to delete data sooner subject to those legal minimums.
• Communication records (SMS, WhatsApp, email): Retained for 2 years by default, configurable per dealership, and subject to TCPA, CTIA, and Meta WhatsApp record-keeping requirements.
• Meta access tokens: Retained (encrypted) only while the WhatsApp integration is active; revoked and deleted within 30 days of disconnection.
• Usage analytics: Raw event data retained for 13 months; aggregated and de-identified data may be retained indefinitely.
• Encrypted backups: Purged within 35 days of the corresponding production deletion.

LotIQ is based in the United States and stores data on infrastructure located in the United States. If you access the platform from outside the United States, your information will be transferred to, stored, and processed in the United States.

Some of our service providers (including Meta, Twilio, and our cloud hosting providers) may process data in other jurisdictions. Where transfers from the European Economic Area, United Kingdom, or Switzerland are involved, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or other lawful transfer mechanisms.

We use the following types of cookies:

• Essential Cookies: Required for authentication and core platform functionality. Cannot be disabled.
• Analytics Cookies: Help us understand how the platform is used so we can improve it. These collect aggregated, anonymized data.

We do not use advertising or cross-site tracking cookies.

Depending on your jurisdiction, you may have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your personal information, subject to legal retention requirements.
• Opt-Out of Communications: Reply STOP to any text or WhatsApp message, or contact us to opt out of all messaging.
• Data Portability: Request your data in a structured, machine-readable format.
• Withdraw Consent: Withdraw previously granted consent at any time (without affecting the lawfulness of prior processing).

How to submit a request: Email privacy@lot-iq.com with the request type and the email address associated with your account or application. We may need to verify your identity before acting on the request.

Response time: We will acknowledge requests within 10 business days and substantively respond within 30 days. For California residents under the CCPA, we will respond within 45 days (with one 45-day extension if reasonably necessary, with notice to you).

Important note for consumers: When you submit an application or otherwise interact with a dealership through LotIQ, the dealership is the controller of your personal information. We will route deletion requests to the relevant dealership and assist them in fulfilling the request, subject to legal retention obligations described in Section 8.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected, used, and shared.
• Right to delete personal information.
• Right to opt out of the sale of personal information. We do not sell personal information.
• Right to non-discrimination for exercising your rights.

LotIQ is intended for use by licensed dealership personnel and adult consumers. The consumer-facing flows on our platform (credit applications, deal documents, financing) require legal capacity to enter into contracts and are not designed for users under 18.

Consistent with the Children’s Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from children under 13. If you believe we may have collected information from a child under 13, please contact privacy@lot-iq.com and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify Users of material changes via email or through the platform. The “Last updated” date at the top of this page indicates when the policy was last revised.

If you have questions about this Privacy Policy or our data practices, please contact us: