Privacy Policy

General privacy practices

We respect your privacy and protect your Personal Information. This section describes how we collect, use, share, retain, and protect your personal information.

We collect your Personal Information when you provide it to us, or when you authorize third-parties to share your Personal Information with us. Personal information is any information that identifies you, or that could reasonably be linked to you. This may include information such as your business name, the names of authorized users, addresses, account information, profile information, phone numbers, email addresses, passwords, payment details (for example, credit card information), transaction history, information about your customers and your personnel, vehicle information, and any other information you provide us (“ Personal Information ”).

We process Personal Information by securely transmitting it, storing it in access-controlled systems, and using commercially reasonable safeguards to protect it. We use Personal Information only for the purposes described herein, or as otherwise authorized by the owner of such Personal Information. We may use your Personal Information to: (a) provide our Services to you; (b) communicate with you from time to time via email or third party applications such as Facebook Messenger; (c) improve and optimize our Services; (d) facilitate our marketing activities; and (e) other business purposes.

Our employees and contractors are authorized to request and access Personal Information as needed to perform their job duties. We share Personal Information only as requested by you (for example, to promote your inventory or business) and with third-party service providers who support our Services, such as payment processors, hosting providers such as Amazon Web Services, and platform providers such as Facebook/Meta that help manage account verification, communications, and customer support. We may also share Personal Information where required or permitted by law. Please note that once Personal Information is shared with a third party, its security depends on that third party’s practices and other factors outside our control.

Furthermore, we will comply with all applicable legal obligations relating to privacy, security, integrity, and confidentiality of data collected from our customers and users, except for aggregated data that does not enable identification of such customer or user, and any other extracted data.

We may use cookies and similar technologies for collecting and storing information for marketing purposes. These technologies may be set and controlled by us or by our third-party service providers or advertising providers for marketing purposes. You can disable cookies completely, or be prompted prior to a cookie being loaded, by adjusting your browser’s settings. Please note that disabling cookies may impair the functionality of the Services, either fully or in part, and may prevent you from using certain Services or Platform/Application/Website features. Check your browser’s “help” feature for more information.

We will retain your Personal Information until you request its deletion or until otherwise removed in accordance with our internal retention policies.

You may request access to, correction of, or deletion of your Personal Information at any time. We may decline, redact, or restrict responses as required or permitted by law (for example, to protect others’ privacy, security, legal privilege, or proprietary information), and we may retain certain information where we are legally required or permitted to do so. Deleted information may continue to exist temporarily in system backups before being permanently removed in accordance with our backup retention cycles.

Deletion requests apply only to Personal Information in our possession or control. We cannot delete Personal Information already held by third parties but will forward deletion requests to them where appropriate, or as required by law or by our agreements with them. Please note deleting certain information may limit or prevent your ability to use some or all features of the Services. To submit a request, please contact us at info@hillzdealer.com. We may request information to verify your identity and will respond within a reasonable timeframe.

Connecting a Gmail account

An authorized dealership user can connect their own Gmail account to HillzDealer through Google OAuth 2.0. Each account connection requires that account owner's authorization. HillzDealer does not access an account that has not been connected and authorized.

Gmail data we access and store

HillzDealer requests the Gmail read-only scope ( https://www.googleapis.com/auth/gmail.readonly) to read messages for CRM communication history, and the Gmail send scope ( https://www.googleapis.com/auth/gmail.send) to send messages that a user initiates through the CRM. The read-only scope permits access to messages in the connected mailbox; it is not limited by Google to customer messages.

To provide CRM features, HillzDealer may import and store message sender and recipient details, subjects, timestamps, message bodies, thread information, and attachments where an enabled feature requires them. The connected user's Gmail data is associated with their HillzDealer account. Access to customer communication history within a dealership is managed through HillzDealer user roles and permissions.

How we use Gmail data

We use Gmail data to associate customer conversations with CRM records, display communication history to authorized dealership users, support customer service and sales workflows, and send communications initiated by the connected user. We do not use Gmail data for advertising, sell it, or use it to create profiles unrelated to these CRM features.

Sharing and human access

We do not sell Google user data or transfer it to advertising platforms or data brokers. Gmail data may be processed by service providers that help operate the requested CRM features, for security purposes, or as required by law, subject to Google's Limited Use requirements.

HillzDealer personnel do not read Gmail message content except with a user's explicit agreement to view specific content for support, when necessary to investigate security issues, or when required by law. Such access is limited to what is necessary for that purpose.

Security

We use encrypted connections, authentication, access controls, and role-based permissions to protect Gmail data. OAuth access and refresh tokens are stored securely and used to maintain the authorized Gmail connection.

Disconnecting, retention, and deletion

Users can disconnect their Gmail account in HillzDealer or revoke access in their Google Account settings. After access is revoked, HillzDealer will no longer access that Gmail account. Messages previously imported into the CRM may remain while the dealership account is active or as needed to provide the CRM service; revoking access does not itself delete those copies.

A connected user or dealership administrator can request access to or deletion of Gmail-related data by emailing info@hillzdealer.com. We may need to verify the requester's identity and may retain information where required by law or applicable contractual obligations. Copies in backups may remain temporarily until the applicable backup retention cycle ends.

Google Limited Use

HillzDealer's use of information received from Google Workspace APIs adheres to the Google Workspace user data and developer policy, including its Limited Use requirements.

Contact

HillzDealer · info@hillzdealer.com