1Who we are
LotAgent is a dealership management system for independent dealers of used cars, golf carts, low-speed vehicles and powersports. It is operated by Paul Neto, carrying on business as LotAgent, a sole proprietor established in Ontario, Canada (LotAgent, we, us). Paul is also the person accountable for privacy here; there is no department to be passed around.
| Operator | Paul Neto, carrying on business as LotAgent, a sole proprietorship established in Ontario, Canada |
|---|---|
| Business address | Ontario, Canada. A full postal address is available on request — write to the privacy contact below. |
| Privacy contact | hello@lotagent.co — reaches a person, not a queue |
| Service | The website at https://lotagent.co, the LotAgent console, the dealer storefronts and vehicle pages we host, the shopper conversation pages, the public inventory API and the MCP endpoint |
| Where we operate | Canada and the United States |
LotAgent is in beta. That changes nothing about how we treat personal information, but it does mean the product is moving; §15 says how you find out when this document moves with it.
2Two roles, and which one applies to you
Almost every confusion about privacy in a system like this comes from missing a distinction, so it goes first. We stand in two quite different relationships to personal information, and which one applies depends on whose information it is.
Where the dealership decides and we act for them
A dealership's operating records — the people who enquire about a golf cart, the customer on a deal, the conversations in the messages screen, service customers, the payment schedule on an in-house finance account — belong to the dealership. They decide what is collected, why, and how long it is kept. We host it, keep it safe, and do what the dealership's users tell the system to do. In the language of the law we are a processor (Canada: a service provider acting under PIPEDA s. 4.1.3 accountability; United States: a service provider under the CCPA and equivalent terms in other state laws).
What follows from that, and it matters:
- We do not use a dealership's customer records for our own purposes. Not to market to their customers, not to sell, not to train a model, not to build a product with.
- If you dealt with a dealership and want your information corrected or deleted, the dealership is the right place to start, because they are the ones who decide. Write to us anyway if it is easier — §13 says what we will do.
- Each dealership's data is isolated from every other dealership's by the database itself, not by application code that could forget. §11 explains why that distinction is the one worth caring about.
Where the decisions are ours
We are the controller (US state laws say business) for the information that is genuinely about our own relationship with someone:
- The dealership's account with us, and the people who sign in to it — names, work email addresses, role, which rooftops they are assigned to.
- Sign-in and session records, including the security details in §3.
- Anyone who contacts us, signs up, or reads this website.
- Records of support and of any time a member of our staff acted inside an account (§11).
3What we collect
By surface, because that is how it actually arrives. Nothing here is collected from data brokers, advertising networks, or any source other than the ones named.
3.1 If you run a dealership on LotAgent
| What | Why it exists |
|---|---|
| Business name, country, state or province, and the vertical you sell in | The four signup answers. Currency, timezone, price-display rules, fee schedule, labour rates and markup bands are all derived from them |
| Each user's first and last name, email address, role, and rooftop assignments | Who may sign in, and what the database will let them see |
| A password hash, where a password is used at all (PBKDF2-SHA256, 480,000 iterations) | Passwordless sign-in is the normal path; passwords remain as a fallback |
| Sign-in codes: your email address, separate hashes of the six-digit code and of the emailed link, the IP address and browser user-agent of the request, the number of wrong guesses, and expiry | The code itself is never stored, so a stolen backup contains no usable credential. The address and user-agent are kept to rate-limit sign-in and to answer “who asked for this code?” after the fact |
| Sessions: a SHA-256 of the cookie value, never the value; creation and expiry; whether the session was opened by our staff on your behalf | A leaked database yields no working session cookie, and revoking a session is one update rather than a denylist |
| Invitations you send: the invitee's email, the role offered, who invited them, and a hash of the invitation token | No account exists for an invitee until they accept |
| Your dealership's operating data: units, VINs or serial numbers, photographs, prices, costs, deals, repair orders, parts movements, ledger entries, floorplan advances | It is the product. Most of it is not personal information at all |
Where you have entered one: the encrypted API key for your own model
provider, plus a masked hint such as sk-ant-…4f2a |
Encrypted at rest with Fernet. If no encryption secret is configured the save is refused rather than written in the clear, and the key is never rendered back to the screen |
| Per-day counts of model questions and tokens, per account | A daily ceiling, and evidence of what was spent. It holds no question text |
3.2 The customer and shopper records a dealership keeps
We are the processor for all of this (§2). It reaches the system either because a dealership's staff entered it or imported it, or because a member of the public used a page we host for that dealership.
| What | How it arrives |
|---|---|
| Contact details: first and last name, phone number, email address, preferred channel, source | Entered by the dealership, imported by them, or typed by a shopper into the enquiry form on a vehicle page. Name, phone and email are all optional on that form — a shopper can ask a question giving none of them |
| Consent records: which channel, which regime (TCPA or CASL), express or implied, when it was captured, when it expires, the source, and the exact wording shown at the time | Written whenever somebody grants permission. §8 is about this |
| Conversations: the messages in a thread, who wrote each one, direction, read state, delivery metadata | Typed by a shopper, by the dealership's staff, or drafted by an agent and approved by a person |
| Leads, tasks and appointments, and the vehicle each concerns | Created by the dealership, or automatically when an enquiry comes in |
| Deal records: sale price, fees and taxes as line items, trade, down payment, term, rate, payment, funding and title status, and the name of the lender | Entered by the dealership. §4 is about what is not in there |
| In-house finance accounts: principal, rate, payment amount and frequency, balance, due dates, and whether each payment was made | Entered by the dealership for its own buy-here-pay-here paper |
| Repair orders and parts tickets, and the customer they belong to | Entered by the shop |
| Photographs of vehicles | Uploaded by the dealership, usually from a phone on the lot. They are pictures of stock, but a photograph taken on a forecourt can incidentally include a person, a licence plate or a building |
3.3 If you are a shopper who used a page we host
Vehicle pages, storefronts and the conversation page are hosted by us for the dealership whose stock they show. Using one gives us:
- Whatever you typed into the enquiry form, which may be nothing more than a question. A phone number and an email address are each optional, each labelled with what it is for, and each records its own separate permission.
- Your conversation, reachable by an unguessable token that we can revoke. A cookie holds that token so you can come back to your own thread without an account. We also record when your page last checked for a reply, so that the “they replied” email only goes to people who have actually left.
- A scan record, if you arrived from a QR code on a windscreen. This one is worth spelling out because it is the only measurement we do anywhere. We store the time, the browser user-agent, and a day-salted fingerprint — a truncated SHA-256 of your IP address, your user-agent and the current UTC date. Your IP address itself is not stored. Because the date is part of the hash, the fingerprint changes every day and cannot be used to follow anyone across weeks. It exists for one narrow purpose: to count people rather than page loads, so that six refreshes of a URL cannot make the system propose a price cut on a dealer's vehicle.
3.4 Technical records we cannot avoid
- Rate-limiting counters. The unauthenticated surfaces — the enquiry form, the public inventory API, the conversation feed, the MCP endpoint — are rate-limited by IP address. Those counters live in memory only, are swept when they go quiet, and are gone when the process restarts. They are never written to the database.
- Server logs from our hosting and email providers, which contain IP addresses, request paths, timestamps and error traces in the ordinary way.
- An audit trail of what the system did — every agent proposal, who approved or rejected it, when it ran, its stated reasoning, and how to reverse it. This is a safety feature, and it is deliberately hard to erase.
4What we deliberately do not collect
A privacy policy is usually a list of what a company takes. This section is the more useful one, because the most reliable protection for a piece of information is that it was never stored. Each of these is an absence in the database, not a promise about behaviour — there is no column for any of it.
- No social insurance or social security numbers.
- No dates of birth.
- No driver's licence numbers or images of identity documents.
- No bank account numbers, routing numbers or payment card numbers. There is no card form anywhere in the product and no payment processor connected to it.
- No credit reports, credit scores or bureau data of any kind.
- No credit applications. Applications go through RouteOne, Dealertrack or a lender's own portal. What LotAgent keeps is a record of where a deal was sent and what came back — the lender's name, the date, the status, the approved amount, rate and term, any conditions, and the decline reason. Keeping a second copy of the application itself would create a second breach surface for the most regulated data a dealership handles, which is the one thing you least want two of.
- No signed contracts or e-signature documents. Again only the record: that signing happened, who recorded it, and when.
- No third-party analytics, advertising pixels, session recorders, heat maps or tag managers. There is not one third-party script on any page we serve, including this one. The charts in the console are a vendored library served from our own domain.
- No cross-site or cross-app tracking, and no advertising identifiers.
- No precise location data. A rooftop has a state or province because tax and disclosure rules need one. Nothing tracks where a device is.
- No biometric data, and no sensitive categories — health, racial or ethnic origin, religious or political belief, sex life or sexual orientation, union membership, or precise geolocation. We do not collect sensitive personal information as US state privacy laws define it, so there is nothing for a “limit the use of my sensitive personal information” right to act on.
5Cookies
Three. All first-party, all strictly necessary to make signing in or holding a conversation work, and none of them used for analytics or advertising. There is no consent banner because there is nothing to consent to.
| Cookie | What it does | How long |
|---|---|---|
lotagent_session |
Keeps a dealership user signed in. Holds a random opaque token; the database stores only its SHA-256 | 12 hours, or 60 days if you choose to be remembered on that device |
lotagent_staff |
The same, for the separate staff console. A member of our staff acting inside a dealer account is time-boxed to 30 minutes regardless | 12 hours |
lotagent_chat |
Lets a shopper return to their own conversation without an account. It holds the thread token and nothing else | 60 days, or until the thread is revoked |
All three carry HttpOnly and SameSite, and
Secure everywhere except a developer's local machine, where there is no
TLS for it to attach to. Blocking them will stop sign-in and the shopper conversation
from working; nothing else depends on them.
6Why we use it, and on what basis
| Purpose | Basis |
|---|---|
| Running the service for a dealership — inventory, leads, deals, service, parts, accounting | Performing our agreement with the dealership. For their customers' records, the dealership's own basis, on their instructions |
| Signing people in, holding sessions, stopping abuse and rate-limiting the public surfaces | Our legitimate interest in a service that is secure and available, and our agreement with the dealership |
| Sending a shopper a link to their conversation, or telling them the dealership replied | Consent, asked for in its own words at the point of capture and withdrawable in one click (§8) |
| Operational email to dealership users — sign-in codes, invitations, the morning digest, trial notices | Performing our agreement. These are transactional, not marketing |
| Counting distinct QR scans so the system can tell demand from refreshes | Legitimate interest, pursued with the least identifying method that works — which is why the fingerprint is day-salted and the IP address is discarded (§3.3) |
| Keeping an audit trail of every agent action and every approval | Legitimate interest in accountability, and the dealership's interest in being able to prove what happened and reverse it |
| Improving the product using aggregated, de-identified figures — how often a feature is used, how long a query takes | Legitimate interest. This never involves reading a dealership's customer records, never identifies a dealership or a person, and is never model training (§7) |
7AI, automated decisions and your data
LotAgent is agent-operated, so this section is not boilerplate — it is one of the main reasons to read the document.
7.1 We do not train models on your data
Not ours, not anyone's. Dealership data is never used as training or fine-tuning material, by us or by the model provider we send a request to, and it is never pooled across dealerships for that purpose. Our model provider's commercial terms likewise do not permit training on inputs submitted through the API.
7.2 Three arrangements, and a dealer picks one
| Mode | Whose key | What leaves our systems |
|---|---|---|
| Platform | Ours | The prompt for that task goes to our model provider under our account |
| Bring your own key | The dealership's, encrypted at rest | The same prompt, under the dealership's own account with that vendor and subject to their agreement with them |
| Your own assistant, over MCP | None stored | Nothing. No inference runs on our side at all — the dealership's own assistant connects to their data and does the work |
7.3 What is actually sent to a model
The design rule throughout is compute the facts, let the model only phrase them, and refuse when there are not enough facts to be worth phrasing. In practice a prompt contains vehicle details, prices, and the conversation the model is being asked to reply to. It does not contain your whole database, and there is no general “let the model look around” path: the analytics an assistant can run are a fixed set of parameterised queries, each scoped by the same database rules as the person asking.
7.4 Customer conversations are a separate permission, and it is off
Whether an external assistant connected over MCP may read customer message text is its own setting, held at the account level, and it is off until a manager turns it on. Connecting an assistant is consent to reach your business data; it is not consent to send your customers' words to a third-party model. Those are different decisions and the product refuses to bundle them. With the setting off, an assistant can see that a conversation happened and when — never what was said.
7.5 Agents propose; a person decides
There is no automated decision-making that produces a legal or similarly significant effect on anyone. Specifically:
- Every action starts at one-click approval, and a dealership raises the autonomy of an action only after watching it be right.
- Money, credit and contract actions stay at approval permanently, whatever a dealership sets.
- Nothing is ever sent to a customer that a person has not approved.
- The system does not score, rank or make decisions about individual people. It does not decide who gets financing — it does not hold the data that would let it, and it does not submit applications (§4).
- Every proposal carries plain-language reasoning, the evidence behind it and a sample size; every executed action is logged with who approved it and how to reverse it.
Where Quebec's Law 25 requires it, this section is the notice that automated processing is used to make recommendations, the explanation of what it is based on, and your route to have a person review any of it: write to hello@lotagent.co.
8Texts, emails and consent
Permission is modelled per channel rather than as one box that covers everything, because it genuinely is not one permission.
- Typing into a conversation is not consent to be texted. Asking a question on a vehicle page grants permission to be answered in that conversation. It is recorded as its own record and nothing downstream can mistake it for a phone permission.
- An email address on a record is not permission to email. Being told when the dealership replies is asked for separately, in its own words, and recorded separately. One click from inside the conversation stops it, and every such email carries that link.
- A phone number given to a dealership is permission for that dealership to text you about the vehicle you asked about. Replying STOP opts out.
- CASL implied consent expires after six months, and the system stores an expiry rather than a yes/no so that it lapses on its own. When it has lapsed, the send controls are disabled and say why.
- Every consent record keeps the wording that was on screen when it was granted, so what somebody agreed to can be produced later.
Marketing email from us to you is a separate matter: we do not run a marketing list. The email we send to dealership users is transactional — sign-in codes, invitations, the digest you asked for, and notice that a trial is ending.
9Who else ever sees it
We do not sell personal information, and we do not share it for cross-context behavioural advertising. Under the CCPA and the equivalent laws of other US states, we have not sold or shared personal information in the preceding twelve months, and we do not do so now. There is no “Do Not Sell or Share” link because there is nothing for it to switch off.
The complete list of companies that process data on our behalf:
| Who | What for | What they hold | Where |
|---|---|---|---|
| Supabase | The database and photo storage | Everything stored by the product | United States (us-east-2) |
| Render | Hosting the application and its workers | Data in transit and in memory; server logs | United States (Ohio) |
| Resend | Sending email | Recipient address and message content, for the mail we send | United States |
| Anthropic | The model behind the agents, in platform mode | Only the prompt for the task at hand (§7.3). Nothing when a dealer uses their own key or their own assistant | United States |
| NHTSA vPIC | Decoding a VIN into specifications | The VIN only. No personal information, no account, no key | United States |
We will also disclose information where the law genuinely requires it — a valid court order, subpoena or lawful demand — or where it is necessary to protect someone's safety or to establish or defend a legal claim. Where we are permitted to tell the affected dealership that a demand has arrived, we will.
If the business is ever sold or merged, records may transfer with it. The buyer would be bound by this policy for information collected under it, and dealerships would be told before anything moved, with time to export and leave.
10Where it is stored
Data is stored and processed in the United States, in the
us-east-2 region, with the application hosted in the same metropolitan
area so that the two are co-located. Our email and model providers are also United
States companies. An account is pinned to a region when it is created and does not
move.
For Canadian dealerships and their customers, this means your information is processed outside Canada and is subject to the laws of the United States, including lawful access by US courts and authorities. PIPEDA does not require data to stay in Canada — it requires that we tell you plainly where it goes and that we hold our providers to comparable protection by contract, both of which this section and §9 are doing. If that is not acceptable for your dealership, the honest answer is that LotAgent is not the right system for you today, and we would rather you knew that before you imported anything.
11How it is protected
The measures that do the most work here, stated specifically enough to be checked:
- One dealership cannot see another's data, and that is enforced by the database. Every request runs as a restricted database role under row-level security, and the rules are applied by Postgres rather than by application code remembering to add a filter. A query that forgets its tenant condition returns only your own rows instead of leaking somebody else's. This is the single most consequential design decision in the system and it is covered by tests that prove the isolation rather than assume it.
- Roles and rooftops narrow it further. A salesperson assigned to one location cannot read another's. Cost and gross figures are restricted to the roles a dealership chooses.
- Credentials are never stored in a usable form. Session tokens and invitation tokens are stored as hashes; sign-in codes and their links are hashed separately from each other; passwords use PBKDF2-SHA256 at 480,000 iterations. A stolen database backup yields no working credential.
- A dealership's own model key is encrypted at rest, and if no encryption secret is configured the save is refused rather than written in plain text.
- Our staff are on a separate identity plane from dealership users and multi-factor authentication is required. When a member of our staff needs to act inside an account to help, the session is time-boxed to 30 minutes, requires a stated reason, is recorded against the staff member, and cannot approve anything — the one thing an impersonated session is refused is the power to authorise an action on your behalf.
- The unauthenticated surfaces are rate-limited, and the shopper conversation is reachable only by a long random token that can be revoked without destroying the conversation.
- Traffic is encrypted in transit. Text written by members of the public is rendered as text and never as markup, and anything a model is shown from a public source is labelled as data rather than instruction.
No system is perfectly secure and we will not pretend otherwise. If a breach affects personal information in a way that creates a real risk of significant harm, we will notify the affected dealerships without undue delay, and the regulators and individuals the law requires us to notify — under PIPEDA's breach-of-security- safeguards rules in Canada, and under the applicable state statutes in the United States. We will tell you what happened, what was affected and what we did, rather than the smallest thing we could get away with saying.
12How long we keep it
| What | How long |
|---|---|
| A dealership's operating data | For as long as the account exists. Nothing is ever deleted because an invoice went unpaid — when a trial ends the agents stop and deal booking locks, but the data stays and the public storefront stays up, because it belongs to the dealership and their customers rather than to us |
| After an account closes | Kept for 30 days so it can be exported or an accidental closure undone, then deleted within a further 60 days. Ask us to delete it sooner and we will |
| Sign-in codes | Minutes. Consumed on use and expired regardless |
| Sessions | 12 hours, or 60 days when remembered; a staff session inside an account, 30 minutes |
| QR scan fingerprints | The demand signal reads a 30-day window. The fingerprint is already useless for identification after the day it was made (§3.3) |
| Rate-limiting counters | In memory only; swept when quiet, gone on restart |
| Audit records of agent actions and approvals, and of staff access | Kept for the life of the account. They are the record of what was done in somebody's name and are deliberately durable |
| Financial and deal records | A dealership normally has its own statutory retention obligation for these. We keep them while the account exists and follow the dealership's instructions within what the law allows |
| Backups | Deleted data may persist in backups for a short period before rotating out. It is not restored into the live system except in a disaster |
13Your rights, and how to use them
Depending on where you live you have some or all of the following. We apply them to everyone regardless of whether the law in your state or province grants them, because operating two standards is how mistakes happen.
- Know and access — what we hold about you, where it came from, why we have it, and who it has been disclosed to.
- Correct anything inaccurate.
- Delete, subject to what we must keep by law or to finish something you asked for.
- Take it with you in a portable, machine-readable format. For dealerships this is a product feature rather than a request: export whenever you like, at no charge, and there is no exit fee for getting your own records out.
- Withdraw consent at any time, including for the emails and texts in §8. One click, from inside the conversation.
- Opt out of sale, sharing, targeted advertising and profiling — none of which we do (§9), so there is nothing to opt out of.
- Not be discriminated against for exercising any of this. We do not offer financial incentives for personal information.
- Appeal a refusal. Several US state laws require an appeal route; write to the same address, say that you are appealing, and a decision with reasons follows within 45 days.
How. Email hello@lotagent.co and say what you want. We will verify who you are in proportion to the request — for a deletion that usually means confirming control of the email address or phone number the records are held under. We do not ask for identity documents to answer a data request; that would mean collecting exactly the kind of information §4 is about. An authorised agent may act for you with written permission.
How long. Within 30 days (Canada) or 45 days (United States), with one extension where a request is genuinely complex, and we will tell you if we take it. There is no charge.
14Children
LotAgent is a business tool sold to dealerships, and the consumer-facing pages exist to ask a dealer about a vehicle. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, write to hello@lotagent.co and we will delete it.
15Changes to this policy
When this document changes, the date at the top changes with it. For a change that materially affects how personal information is handled — a new category collected, a new company processing it, a new purpose, or anything that would make §4 untrue — we will email the dealership account owners at least 30 days before it takes effect, and post the new version here with the change described. Continuing to use LotAgent after that is acceptance; if it is not acceptable, §12 says how long you have and the export is free.
We will not make a material change quietly, and we will not make one retroactive.
16Complaints
Start with us: hello@lotagent.co. A complaint reaches Paul directly and gets a substantive answer, not an acknowledgement.
If we do not resolve it, you can complain to a regulator:
- Canada — the Office of the Privacy Commissioner of Canada at priv.gc.ca, or your provincial commissioner (Quebec, Alberta and British Columbia each have their own).
- United States — your state Attorney General. California residents may also contact the California Privacy Protection Agency.