Privacy Policy

1. Who we are

Out The Lot is a delivery management software platform for automotive dealerships, operated from Ontario, Canada. In this policy, "we", "us" and "Out The Lot" refer to the operator of the platform; "you" refers to a subscribing dealership or a user of the platform.

We can be reached at support@outthelot.com.

2. Information we collect

From dealership users

• Account information — name, work email address, phone number, employee number, role, and dealership affiliation.
• Authentication data — a hashed password, and two-factor authentication settings if enabled. We never store passwords in readable form.
• Usage records — sign-in times, actions taken in the platform, and an audit log of changes made to delivery records.

Vehicle and delivery data entered by the dealership

• Stock number, VIN, year, make, model, mileage, colour and condition.
• Repair order numbers, service requests, accessories and certification numbers.
• Delivery date and time, status history, notes, photographs and QC results.
• Customer name, and on the Cal Connect plan, customer mobile number, entered by dealership staff for the purpose of the vehicle delivery.

Technical information

• IP address, browser type and device type, collected in server logs.
• Email delivery events (sent, delivered, bounced, complained) for messages we send.

3. How we use information

We use information only to operate and support the service:

• To provide the platform, its scheduling, tracking and notification functions.
• To send internal notifications to dealership staff according to each user's own notification preferences.
• On Cal Connect, to send ready-for-pickup SMS messages and serve tracking pages to the vehicle purchaser, when the dealership has enabled this.
• To maintain an audit trail for accountability within the dealership.
• To provide support, investigate faults, and secure the platform against abuse.
• To bill the subscribing dealership.

4. Controller and processor

For information about dealership users (staff accounts and billing contacts), Out The Lot acts as the controller.

For vehicle purchaser information entered into the platform by dealership staff, the subscribing dealership is the controller and Out The Lot acts as a processor on the dealership's instructions. A vehicle purchaser wishing to exercise rights over that information should contact the dealership directly; we will assist the dealership in responding.

5. SMS and customer tracking pages

These features exist only on the Cal Connect plan and are off unless the dealership turns them on. Two independent controls apply: a global switch at the dealership level, and a per-delivery switch that staff can use to exclude an individual customer.

• Messages relate solely to the status of a vehicle the recipient has purchased. We do not send marketing messages.
• Recipients can opt out at any time by replying STOP. Opt-outs are honoured automatically and recorded on a suppression list.
• Tracking page links are unguessable and show only delivery status information for that vehicle.

6. Service providers

We use a small number of third-party providers to operate the service. Each receives only the data necessary for its function:

• Hosting — server infrastructure hosted in a commercial data centre.
• Email delivery — a transactional email provider for notifications and digests.
• SMS delivery — a messaging provider for Cal Connect ready-for-pickup texts.
• Payment processing — a payment processor for subscription billing. We do not store full card numbers on our systems.

We may also disclose information where required by law, or to protect the rights, safety or property of Out The Lot, our customers or the public.

7. Storage and security

• Each dealership is provisioned with its own separate database, rather than a shared table partitioned by customer. Data does not cross between dealerships.
• Data is encrypted in transit using TLS, and encrypted at rest.
• Access is controlled by role, with sensitive fields restricted to appropriate roles.
• Uploaded photographs are served through an access-controlled endpoint; a direct file URL cannot be used to retrieve an image without an authenticated session.
• Backups are taken on a regular schedule and restore capability is tested periodically.

No system is perfectly secure. We work to protect your information but cannot guarantee absolute security.

8. Retention

Delivery records and their audit history are retained for as long as the dealership's subscription is active, because they form the dealership's operational record. Internal notification records are pruned on a rolling basis. Server logs are retained for a limited period for security and troubleshooting.

On termination, a dealership may request a full export of its data. We will delete the dealership's data within a reasonable period after termination, unless retention is required by law.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete or port your personal information, to withdraw consent, or to object to certain processing. Under Canadian federal privacy law (PIPEDA) and applicable provincial legislation, you have the right to access your personal information and challenge its accuracy.

To make a request, email support@outthelot.com. We will respond within the period required by applicable law. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada.

10. Cookies

We use strictly necessary cookies to keep you signed in and to maintain your session. We do not use advertising cookies or third-party tracking pixels on the platform.

11. Children

The platform is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under the age of majority in their province.

12. Changes and contact

We may update this policy from time to time. Material changes will be communicated to subscribing dealerships by email, and the "last updated" date above will change.

Questions about this policy can be sent to support@outthelot.com.