Privacy Policy

1. Who we are

Autodori runs autodori.com, the dealer dashboard and the dealer websites at *.autodori.com (and on the dealers’ own domains). You can reach us at larrydev.op@gmail.com or through our contact page. For privacy questions, including requests under the GDPR, Brazil’s LGPD, Japan’s APPI or Australia’s Privacy Act, write to the same address with “Privacy” in the subject.

2. Dealers and car shoppers

Autodori is used by two groups of people, and our role is different for each:

• Dealers (the businesses that subscribe to Autodori) and their staff: we decide how their account and billing data is used, so we are the controller of that data.
• Car shoppers who use a dealer’s website: the dealer decides what to do with your request, so the dealer is the controller and we process that data on the dealer’s behalf. For questions about a request you sent to a dealer, contact that dealer first. We will help them answer.

3. What we collect

• Account details from dealers: your name, dealership name, website name, email, phone number and password (stored only as a secure hash, never in readable form).
• Billing details: plan, billing period, currency, amounts paid and invoice records. You type your card details at Stripe, and they never reach our servers. Stripe gives us a card fingerprint, the card brand and the last four digits.
• Content that dealers add: cars, photos, prices, descriptions, store details and the logins of their staff.
• Requests from car shoppers on dealer websites: name, email, phone number, message, the car you asked about, and the test drive date or video request.
• Messages sent through our contact form: name, email, dealership (if given), topic and message.
• Technical data: IP address, browser and device details, and records of sign-ins and security events such as failed logins.
• Signup checks: whether the domain of your email address can receive mail, and whether it belongs to a throwaway email service.

4. Why we use it

We use personal data only for these purposes, each with its legal basis:

• To create and run your dealer website and dashboard (to perform our contract with you).
• To charge subscriptions, send receipts and trial or renewal reminders, and keep accounting records (contract, and our legal duties under tax law).
• To keep Autodori safe: rate limits, bot checks, login protection and one free trial per business. To stop repeated free trials we keep the email, phone number, dealership name and card fingerprint used for each trial (our legitimate interest in preventing fraud and abuse).
• To answer your messages and support requests (our legitimate interest, or steps you asked for before a contract).
• To send service emails such as sign-in codes, password resets and notices about your site or plan (contract).

We do not sell personal data, do not use it for advertising and do not share it for advertising. Our signup checks can refuse a second free trial automatically; you can still buy a plan, or contact us and a person will review it.

5. Who we share it with

We use a small number of service providers who process data for us under contract:

• Stripe: payments, invoices and payment fraud checks.
• Vercel: hosting of autodori.com and the dealer websites.
• Neon: our database.
• Google: email delivery (Gmail).
• Cloudflare: bot checks on our forms, when turned on.

We also share data when the law requires it, for example with tax authorities or in response to a valid court order, and with professional advisers bound by confidentiality. If Autodori is sold or merged, data may pass to the new owner under this policy.

6. International transfers

Our providers store and process data mainly in the United States. The United States does not have a general privacy law equal to the GDPR, the LGPD or the APPI, so we only use providers that commit to protective measures such as standard contractual clauses or equivalent safeguards. You can ask us for details of these measures and of the countries involved.

7. How long we keep it

• Dealer accounts and their content: while the subscription is active. When a trial or plan ends without payment, the site is paused and then deleted for good, with its cars and shopper requests, 30 days later (the pause email gives the date). Until then you can download your cars and customer requests from your dashboard (“Download my data”), and we email you 3 days before the deletion.
• Shopper requests: as long as the dealer keeps them in their dashboard, and never longer than the dealer’s account.
• Billing records: as long as tax and accounting laws require, generally 5 to 10 years depending on the country.
• Free trial records (email, phone number, dealership name and card fingerprint): up to 3 years after the trial, to enforce one free trial per business.
• Contact form messages: as long as needed to answer and follow up, and no longer than 2 years.
• Security records such as rate limit counters: from one day up to a few months.

Backup copies can keep deleted data for a short time until they are replaced.

8. Cookies

We only use cookies that the site needs to work: your language choice, your sign-in session, and a short-lived cookie that shows your confirmation right after signing up. When the bot check is on, Cloudflare may set a cookie needed for it. Stripe’s payment pages, which are on Stripe’s own site, set Stripe’s cookies. We do not use analytics or advertising cookies, so there is no cookie banner.

9. Your rights

Depending on where you live, you can ask us to:

• confirm whether we hold data about you and give you a copy;
• correct data that is wrong or incomplete;
• delete your data, or anonymise it;
• give you your data in a common format, or send it to another provider;
• stop or limit some uses, or object to uses based on our legitimate interest;
• withdraw consent where we rely on it, and tell you who we share your data with.

Write to larrydev.op@gmail.com. We may ask you to confirm your identity. We answer within 15 days, or sooner when the law requires it. Some data we must keep, such as billing records. Car shoppers: we pass your request to the dealer who holds your data.

You can also complain to a data protection authority, for example ANPD in Brazil, the Personal Information Protection Commission in Japan, the OAIC in Australia, or the authority where you live in the EU or the UK.

10. Security

All traffic uses HTTPS. Passwords are stored as secure hashes, admin accounts use two-step login, sign-ins are locked after repeated failures and access to data is limited to people who need it. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the authorities as the law requires.

11. Children

Autodori is a service for businesses and is not meant for anyone under 18. We do not knowingly collect children’s data.

12. Changes to this policy

When we change this policy we update the date at the top. For important changes we email dealers before they take effect.

13. Contact and data protection officer

Questions or requests about your data go to larrydev.op@gmail.com, which also reaches our data protection contact (the “encarregado” under the LGPD).