Privacy
your data, handled with care.

Introduction

SoldLoop ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use the SoldLoop platform and services, including the salesperson web app, your selling website, the Chrome extension, and related services.

Information We Collect

Information You Provide

• Email Address: Used for account authentication and communication
• Dealership Domain: Used to connect your inventory data

Information Collected Automatically

• Device Fingerprint: A hashed identifier used for security and preventing unauthorized access
• Usage Data: How you interact with the platform (features used, vehicles posted)
• Browser Information: Browser type and version for compatibility

Information We Access

• Vehicle Inventory Data: Accessed from your connected dealership's inventory system via the SoldLoop API and our inventory data provider
• Leads and Customer Contact Data: Captured through your selling website so we can route them to your dealer CRM
• Facebook Marketplace Pages: Accessed only when you initiate a vehicle posting

Google User Data

If you connect your Google account in SoldLoop (Settings > Google Calendar and Gmail), SoldLoop accesses only the following, only for you, and only to provide these features:

• Calendar free/busy (calendar.freebusy): the busy and free time blocks of your primary calendar for the coming days, so the times SoldLoop suggests for a test drive or visit avoid your existing commitments. SoldLoop does not read event titles, details or attendees, and does not store these blocks.
• Calendar events you own (calendar.events.owned): to add an appointment you booked in SoldLoop to your own calendar. SoldLoop creates these events without guests and without sending invitations.
• Sending email as you (gmail.send): to send a message you approved in SoldLoop (for example, a test drive confirmation to a customer) from your own Gmail address. SoldLoop cannot read, search or delete your email.
• Your email address (openid, email): to show which Google account is connected and to send from it.

How we protect it

Google access and refresh tokens are encrypted at rest (AES-256-GCM) and used only by SoldLoop's servers. We keep them until you disconnect; when you disconnect in Settings we revoke them with Google and delete them. You can also remove SoldLoop's access at any time at https://myaccount.google.com/permissions.

Limited Use

SoldLoop's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular: we use Google user data only to provide the features above that you can see in SoldLoop; we do not sell it; we do not use it for advertising, including retargeting or personalized ads; we do not use it to train, develop or improve AI or machine-learning models, ours or anyone else's; we do not transfer it to others except as needed to provide these features, to comply with law, or as part of a merger or acquisition with notice to you; and no person at SoldLoop reads it unless you ask us to (for support), it is needed for security or abuse investigation, or the law requires it.

How We Use Your Information

We use the collected information to:

• Authenticate your identity and secure your account
• Provide the vehicle listing service
• Operate your selling website and forward captured leads to your dealer CRM via ADF email
• Sync your dealership inventory
• Improve our platform and services
• Provide customer support
• Prevent fraud and unauthorized access

Data Storage and Security

• All data is transmitted using HTTPS encryption
• Your sign-in session is kept in a secure, HTTP-only cookie. Tokens for services you connect (such as Google) are encrypted at rest.
• We use industry-standard security measures to protect your data
• We do not store Facebook credentials. We interact with Facebook only through the browser

Data Sharing

We MAY share data:

• With service providers who assist in operating our service (under strict confidentiality)
• With our inventory data provider, which powers the vehicle inventory data behind the platform
• With the dealer or agency tenant your account belongs to
• If required by law or legal process
• To protect our rights or the safety of users

Your Rights

You have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request deletion of your data
• Withdraw consent at any time
• Export your data
• Disconnect Google at any time in Settings, or at https://myaccount.google.com/permissions; disconnecting revokes and deletes SoldLoop's Google tokens

Data Retention

• Account data is retained while your account is active
• Usage logs are retained for 90 days
• You may request deletion at any time by contacting support@lotpro.io

Third-Party Services

The platform interacts with:

• SoldLoop Web App (app.lotpro.io and api.lotpro.io): For your account, selling website, inventory data, and authentication
• Inventory data provider: The inventory data layer powering vehicle listings across the platform
• Facebook Marketplace: For posting vehicle listings (user-initiated only)
• Google (Calendar and Gmail): Only if you connect your Google account; see Google User Data
• Anthropic: AI model provider that writes the drafts you review, such as listing descriptions and replies. It does not receive your Google user data
• Twilio SendGrid: Delivers emails you send from SoldLoop when you are not using your own Gmail

Each service has its own privacy policy that governs its data practices.

Children's Privacy

The platform is not intended for users under 18 years of age. We do not knowingly collect information from children.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by updating the "Last Updated" date and, for significant changes, by email notification.

California Privacy Rights (CCPA)

California residents have additional rights under the CCPA:

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of the sale of personal information (we do not sell data)
• Right to non-discrimination for exercising privacy rights

GDPR Compliance (EU Users)

For users in the European Union:

• Legal basis for processing: Consent and legitimate interest
• Data transfers: Data may be transferred to servers in the United States
• Data Protection Officer: privacy@lotpro.io