SavvyDealer Chat — Privacy Policy

Version 1.0

This Privacy Policy describes how SavvyDealer (“SavvyDealer,” “we,” “us”) collects, uses, and discloses information in connection with the SavvyDealer Chat service (“Service”). This Policy supplements the Terms of Use and is incorporated by reference.

1. Scope and Two Distinct Roles

The Service is offered to U.S. auto dealerships (“Dealers”). This Policy covers two distinct types of information:

(A) Dealer Account Information — information we collect from Dealer employees and authorized users to provide the Service. For this information, SavvyDealer is the “controller” (or “business” under California law).

(B) Dealer Data Submitted Through the Service — content, messages, and any personal information about Dealer's customers or other third parties that flows through the Service. For this information, SavvyDealer acts as a “service provider,” “processor,” or equivalent, and the Dealer is the controller. The Dealer's own privacy policy, not this one, governs how that information is collected from consumers and what consents the Dealer obtained.

If you are a consumer whose information was submitted to the Service by a Dealer, please contact that Dealer to exercise privacy rights regarding your information. We will refer such requests to the Dealer.

2. Information We Collect

2.1 Information You Provide Directly

• Account information: name, business email, dealership name, job title, phone number, password (hashed).
• Dealership information: rooftop locations, OEM affiliations, DMS/CRM in use, integration credentials you choose to provide.
• Communications: support requests, feedback, survey responses.

2.2 Information Collected Automatically

• Usage data: pages viewed, features used, click events, session duration, search queries, error logs.
• Device and connection data: IP address, browser type and version, operating system, device identifiers, referring URLs, timestamps.
• Cookies and similar technologies: see Section 6.

2.3 Information Submitted Through the Service (Dealer Data)

Dealers may submit content and messages through the Service that contain information about consumers, vehicles, transactions, and other business operations. We process this information only as a service provider/processor on behalf of the Dealer, in accordance with the Terms of Use.

2.4 CCPA/CPRA Categories

Over the past 12 months, we have collected the following categories of personal information defined under the California Consumer Privacy Act:

3. How We Use Information

We use information to:

• Provide, operate, secure, debug, and improve the Service;
• Authenticate users and prevent fraud, abuse, and unauthorized access;
• Communicate with Dealers about the Service, including service announcements, changes, and support;
• Comply with legal obligations and enforce the Terms of Use;
• Generate de-identified, aggregated analytics that do not identify any individual or Dealer.

We do not use Dealer Data submitted through the Service to train, fine-tune, or improve any general-purpose AI model. We may use de-identified, aggregated data to monitor, secure, debug, and improve the Service.

4. How We Share Information

4.1 Subprocessors

We share information with third-party service providers (“Subprocessors”) that help us operate the Service. Current Subprocessor categories include:

A current Subprocessor list is available on request to support@savvydealer.com. We may add or change Subprocessors at any time.

4.2 Legal and Safety

We may disclose information when required by law, subpoena, court order, or government request; to enforce the Terms of Use; to protect the rights, property, or safety of SavvyDealer, our users, or others; or to investigate fraud or security incidents.

4.3 Business Transfers

If SavvyDealer is involved in a merger, acquisition, reorganization, financing, or sale of assets, information may be transferred as part of that transaction. We will require the recipient to honor this Policy or provide notice of any material change.

4.4 With Your Direction

We may share information at your direction, such as when you connect a third-party integration.

4.5 No Sale or Sharing of Personal Information

We do not “sell” personal information, and we do not “share” personal information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act and similar state laws. We do not have actual knowledge of selling or sharing the personal information of consumers under 16.

5. AI Models and Output

The Service uses third-party AI models to generate responses. When you submit a message, its content is transmitted to the AI provider (such as Anthropic or OpenAI) for processing. We have agreements with our AI providers prohibiting use of submitted content to train their general-purpose models. Output generated by AI may be inaccurate, incomplete, or fabricated; you should independently verify Output before relying on it.

6. Cookies and Similar Technologies

We use cookies and similar technologies for:

• Strictly necessary functions: authentication, session management, security, load balancing.
• Functional purposes: remembering preferences and settings.
• Analytics: understanding how the Service is used so we can improve it.

We do not use third-party advertising cookies. Most browsers let you control cookies through settings. Disabling strictly-necessary cookies will break the Service. We do not currently respond to “Do Not Track” browser signals, but we honor recognized opt-out preference signals (such as Global Privacy Control) for users in jurisdictions where required.

7. Data Retention

We retain information for as long as needed to provide the Service and for legitimate business and legal purposes:

• Account information: for the life of the account, plus up to ninety (90) days after termination.
• Dealer Data submitted through the Service: as configured by the Dealer, or until termination. After termination, we may delete Dealer Data at any time. Backup copies may persist for up to ninety (90) days in the ordinary course of business.
• Usage logs and security logs: typically up to twenty-four (24) months.
• Records required by law (tax, accounting, legal hold): as required by applicable law.

Upon termination, we may, in our sole discretion, provide an export window of up to thirty (30) days, as described in the Terms of Use.

8. Security

We implement commercially reasonable administrative, technical, and physical safeguards designed to protect information, including encryption in transit, access controls, and monitoring. No system is completely secure. We cannot guarantee that information will not be accessed, disclosed, altered, or destroyed by breach of any of our safeguards. You are responsible for safeguarding your account credentials and for all activity under your account. Notify us promptly at support@savvydealer.com if you suspect unauthorized access.

9. Your Privacy Rights

9.1 California Residents (CCPA/CPRA)

If you are a California resident whose information SavvyDealer holds as a controller (Dealer Account Information), you have the right to:

• Know what personal information we collect, use, disclose, and retain;
• Access a copy of your personal information;
• Correct inaccurate personal information;
• Delete personal information, subject to legal exceptions;
• Opt out of “sale” or “sharing” of personal information (we do not sell or share — but you may submit a request);
• Limit the use of sensitive personal information (we do not collect sensitive personal information for the purpose of inferring characteristics);
• Non-discrimination for exercising these rights.

You may submit a request by emailing support@savvydealer.com with the subject line “Privacy Request.” We will verify your identity by confirming information already on file. You may use an authorized agent; we will require written permission and identity verification.

If you are a California consumer whose information was submitted by a Dealer, please contact the Dealer directly. We will assist the Dealer in responding to verified requests.

9.2 Other U.S. State Residents

Residents of states with comprehensive privacy laws, including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, New Hampshire, Nebraska, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, and others as enacted, have similar rights to access, correct, delete, and opt out of certain processing, and to appeal a denial of a request. Submit requests to support@savvydealer.com with the subject line “Privacy Request.”

9.3 Appeals

If we deny your privacy request, you may appeal by replying to our denial. We will respond within the timeframe required by your state's law. If your appeal is denied, you may contact your state attorney general.

10. Children's Privacy

The Service is not directed to children under 18. We do not knowingly collect personal information from anyone under 18. If you believe a child has submitted information through the Service, contact us at support@savvydealer.com and we will take steps to delete it. Dealers are prohibited under the Terms of Use from submitting information of individuals known or reasonably believed to be under 18.

11. U.S. Only

The Service is offered solely to Dealers located in the United States and is intended for U.S. data only. We do not intentionally collect personal information from individuals outside the United States. If you are located outside the United States, do not use the Service or submit information through it. The General Data Protection Regulation (GDPR), UK GDPR, and other non-U.S. privacy laws do not apply to our processing.

12. Changes to This Policy

We may update this Policy at any time by posting an updated version with a new “Last updated” date. Material changes will be communicated by email to the address associated with your account or by in-product notice. Continued use of the Service after changes are posted constitutes acceptance.

13. Contact Us

Questions, requests, or concerns about this Policy or our privacy practices:

SavvyDealer
Email: support@savvydealer.com
Subject line for privacy requests: “Privacy Request”