Privacy policy

1. What we collect

Account data

When you create an account: your email address, a display name, and for dealers a phone number and the dealership you manage. Sign-in with Google shares your name and email with us. Passwords are hashed by our authentication provider; we never see them.

Content you submit

Reviews, dealer responses, profile edits, photos, inventory feeds, messages to dealers (leads) and messages sent through the contact form.

Technical data — hashed IPs only

We do not store raw IP addresses. When we need to limit abuse (rate limiting, duplicate reviews, spam) we store a one-way hash of the IP, salted with a secret, and for page views the hash also includes the day so it cannot be joined across days. We also store a hash of the browser user agent for the same purpose. These hashes cannot be turned back into an address.

Page-view aggregates

We log which public pages are viewed (the path, whether the visitor looked like a bot, and the referring site's domain). Raw rows are deleted after 35 days; only daily totals per page are kept, which dealers see as “profile views”.

2. How we use it

• To run the directory: show profiles, publish moderated reviews, deliver leads to dealers, and compute trust scores.
• To contact you about your account, claim, subscription, reviews or leads. Marketing email is sent only if you opt in, and every message has an unsubscribe link.
• To keep the site safe: rate limiting, spam screening and fraud prevention using the hashed data described above.
• We do not sell personal data and we do not show third-party advertising.

3. Third parties that process data for us

• Supabase. Database, authentication and file storage for accounts, profiles, reviews, leads and photos.
• Vercel. Hosting, content delivery and privacy-friendly, cookie-free site analytics and performance monitoring.
• Stripe. Subscription billing for dealers. Card details are entered on Stripe and never reach our servers.
• Resend. Transactional email: sign-in links, claim updates, lead and review notifications, digests.
• Twilio. Phone verification codes for dealer claims and SMS lead alerts for dealers who opt in. Reply STOP to end SMS.
• Google. Google Places data for dealer listings and ratings, and static map images. We store Place IDs and two rating numbers, never Google review text.
• Anthropic. AI models that write labelled summaries from structured profile data and screen reviews for spam. Prompts contain profile data and review text, not account details.
• Cloudflare. Turnstile bot checks on public forms, when enabled.
• Upstash. Rate limiting keyed by a hashed IP, when enabled.
• Sentry. Error reporting with personal data scrubbed, when enabled.

Each provider processes data under its own agreement with us and may store it in the United States.

4. What is public

Dealership profiles are public business information. Reviews are public with the display name you choose. Dealer responses are public. Leads and contact-form messages are private to the dealer or to us. A dealer's email address is never shown publicly unless the dealer switches that on.

5. Cookies

We set a session cookie only when you sign in, so you stay signed in. We do not use advertising or cross-site tracking cookies. Site analytics are cookie-free. Stripe and Cloudflare may set their own cookies on the pages where their components load (checkout, bot check).

6. Retention

Account data is kept while your account exists. Reviews stay published while they comply with the policy. Leads are kept so dealers can follow up and for billing records. Page-view rows are deleted after 35 days (aggregates are kept). Backups roll off within 30 days.

7. Your choices and deletion requests

You can see and change your account details in settings. You can ask for a copy of your data or for deletion by email to support@thedealerprofile.com or via the contact form; we verify the request from your account email and respond within 30 days. When an account is deleted, reviews are anonymised rather than removed unless the law requires removal. Dealers can request removal of personal information from a profile as described on the trust & safety page. California and other state residents have additional rights to know, delete and opt out of sale; we do not sell data, and we honour the other rights through the same address.

8. Children

The site is for adults buying and selling vehicles. We do not knowingly collect data from anyone under 16; write to us and we will delete it.

9. Changes

We will post changes here with a new date and, for material changes, email account holders before they take effect.

10. Contact

Privacy questions: support@thedealerprofile.com.