Privacy Notice

1. What this notice covers

This notice explains how CloseLine ("CloseLine," "we," "us," or "our") handles personal information in connection with the CloseLine dealer management platform at app.gocloseline.com, the websites and pages we host for dealerships, the secure links we send to their customers, and our own marketing and support activity (together, the "Service").

CloseLine is a business-to-business platform for licensed motor vehicle dealerships. Most of the personal information in it is not ours: it belongs to a dealership's customers and was given to that dealership. Section 3 explains the difference that makes, because it determines who you should contact about your information and who is responsible for it.

Dealerships are independently responsible for providing all legally required privacy notices, obtaining all required permissions and consents, honoring applicable consumer rights, and ensuring that their collection and use of information through CloseLine is lawful. CloseLine's Privacy Notice does not serve as a dealership's consumer privacy notice or GLBA privacy notice.

This notice does not cover a dealership's own practices, a third-party service a dealership connects to CloseLine, or a website we do not operate. The CloseLine Companion browser extension has its own separate policy.

2. Who we are and how to reach us

The Service is operated by the company behind CloseLine.

For any question about this notice, about the information we hold, or to make a privacy request, email support@gocloseline.com. That mailbox is monitored by our team.

3. Our two roles — and which one applies to you

When a dealership is our customer

A dealership that subscribes to CloseLine is our own customer. For information about the dealership as a business and about the people who work there and sign in to the platform, we decide how and why that information is used, and we are responsible for it. This notice is our notice to them.

When a dealership's customer is in the system

When a dealership loads its customers, deals, credit applications and documents into CloseLine — or when a member of the public fills in a form on a website, a vehicle page, or a secure upload link that we host on a dealership's behalf — we handle that information as a service provider acting for that dealership. The dealership decides what is collected, why, how long it is kept, and who it is sent to. We act on the dealership's instructions and use the information to provide the Service, not for our own purposes.

If you are a dealership's customer and you want to see, correct, or delete information a dealership holds about you, the dealership is the right place to start, and in most cases the only party that can decide. Contact the dealership you did business with. You may also contact us at support@gocloseline.com; we will pass the request to the dealership and support them in responding to it.

One part of the Service is different. CloseLine operates its own consumer-facing vehicle enquiry funnel, and its own wholesale marketplace for dealer-to-dealer transactions. Where you deal with CloseLine directly through those, we are responsible for that information ourselves.

4. Information we collect from people who use the platform

When someone at a dealership uses CloseLine, we hold: their name and initials, their email address, an optional phone number and address, the dealership and role they are assigned, their interface preferences, and when they last visited certain screens. Sign-in itself is handled by our authentication provider, which holds the credentials — we do not store passwords.

We also hold correspondence: if you email our support address, the message, its subject, its attachments and your address are stored in the support mailbox inside the platform, and your address and display name are kept in a contact list so that replies thread correctly.

If you ask us for a demonstration through our marketing site, we collect the name, business name, email address and phone number you give us, record the enquiry in our own CRM, and follow up — including by text message to the number you provide. We use your network address at that moment only to rate-limit the form.

5. Information dealerships put into CloseLine about other people

This is the bulk of the personal information in the Service, and it is collected by dealerships, not by us. Depending on what a dealership uses, it can include information about:

• customers and prospects — name, address, phone numbers, email, date of birth, driver's licence number, state and expiry, and photographs of both sides of the licence;
• credit applicants — Social Security number, date of birth, current and previous address, employer, job title, length of employment, income and other income, housing payment, and a co-applicant's equivalent details;
• documents a customer uploads or a dealership files — pay stubs, W-2s, bank statements, proof of residence, Social Security card images, insurance cards and binders, and other supporting paperwork;
• banking details, where a customer enrols in a biweekly payment product — routing number, account number and account type;
• trade-in and title information, including a lienholder's name and the customer's loan account number with them, and licence plate details;
• people a customer names — a co-buyer, personal references, and household drivers listed for an insurance quote;
• messages, notes, appointments and activity recorded against a customer; and
• vehicle sellers, wholesale buyers, vendors, insurance agency staff, and other business counterparties.

Whether any particular item exists for a particular person depends entirely on what that dealership collected and what parts of the Service it uses.

6. Sensitive information

The Service processes information that is sensitive under United States federal and state law, because dealership paperwork requires it. Specifically: Social Security numbers and tax identification numbers; dates of birth; driver's licence and state identification numbers, and images of those documents; financial account and routing numbers; income, employment and housing-payment information; insurance documents; and information relating to a credit application.

We process this information only to provide the Service to the dealership that collected it — to store it, to place it on the dealership's paperwork, to assemble the package a dealership sends to a lender it chooses, and to make it available to that dealership's own authorized staff. We do not use it to advertise, we do not sell it, and we do not use it to make any decision about you.

Much of this information is subject to the Gramm-Leach-Bliley Act in the dealership's hands. The dealership is responsible for its GLBA privacy notice, for its opt-out obligations, and for its information security programme under the FTC Safeguards Rule.

7. Information collected automatically

On dealership websites and vehicle pages we host

We run our own first-party visitor measurement so a dealership can see how its website is performing. When someone visits, the page reports the page path with the query string removed, the kind of page, the host, the referring website's domain (not the full referring address), any campaign tag in the link, and a device category derived from the browser's user agent. Our servers add an approximate city and region supplied by our hosting provider. We do not store the visitor's network address in this log, and we do not store the raw user agent.

To tell a returning visit from a new one, the page creates two random identifiers and keeps them in the browser's local storage: one that persists, and one that expires after thirty minutes of inactivity. They are random values, they are not linked to a name, an email address or a customer record, and no part of the Service joins them to a person.

If the browser sends a Global Privacy Control or Do Not Track signal, those identifiers are left out of the report and our servers discard them if they arrive anyway. The visit is still counted; the visitor is simply not distinguished across visits.

These records are deleted automatically after thirteen months.

Across the Service

Our hosting provider processes the network address and headers of every request in the ordinary course of delivering the Service. We record technical error reports — an error message, the page it happened on, and part of the technical stack — so we can diagnose faults.

In a small number of places we deliberately record a network address and browser user agent as evidence, because the law or a lender expects a record of who did something and when. Those places are: an electronic signature on a credit application submitted through a dealership's website; a consent to receive text messages; a consumer's consent to be referred to another dealership; a vehicle seller's submission to our own enquiry funnel; an insurance agency's application to join our referral network; a dealership user's acceptance of a marketplace consent; the access log for the secure links we send to customers; and the acceptance record described in section 8.

8. Records of agreement

When someone at a dealership accepts these documents or acknowledges responsibility for the forms their dealership prints, we record the dealership, the person, their role, the versions they accepted, an identifier of the exact wording, the date and time, the network address and browser user agent, where in the product it happened, and whether that person held authority to bind the dealership. These records are kept unchanged — a later acceptance is added, never written over an earlier one — because their entire purpose is to show what was agreed and when.

No customer information and no document content is recorded in them.

9. Information we receive from other services

Where a dealership connects CloseLine to another service, information flows back to us from it. The main examples are a customer relationship and messaging platform, which supplies contacts, conversation history, lead source and qualification details a dealership's customers gave in conversation; lead emails from vehicle marketplaces, which supply a shopper's name, contact details and the vehicle they asked about; a service contract administrator, which returns an issued contract document; and vehicle data sources, which supply specifications and recall information about a vehicle rather than about a person.

10. Why we process personal information

We process personal information in order to:

• provide the Service and the features a dealership has enabled;
• create, fill, print, package and deliver a dealership's documents and paperwork;
• send messages, documents and links a dealership asks us to send, including secure upload links to its customers;
• assemble and transmit the packages a dealership sends to a lender, insurer or administrator it selects;
• publish a dealership's website, vehicle listings and marketing material, and syndicate its inventory where it has enabled that;
• measure how a dealership's own public pages perform;
• authenticate users, operate roles and permissions, and keep records of who did what inside a dealership's account;
• keep the Service secure, detect and investigate abuse, fraud and security incidents, and enforce our terms;
• diagnose faults, monitor availability, and improve and develop the Service;
• support our customers and respond to correspondence;
• market CloseLine to dealerships and prospective dealerships; and
• comply with law, respond to lawful requests, and establish, exercise or defend legal claims.

11. Who receives personal information

Service providers who process information for us

We use other companies to run the Service. They act on our instructions and may use the information only to provide their service to us. They include providers of: application hosting and its scheduled jobs; the database and file storage; user authentication; outbound email delivery; inbound email receiving; the customer relationship and messaging platform through which dealership messages are sent and received; artificial intelligence processing, as described in section 12; and speech synthesis for the in-product assistant's spoken replies.

Recipients a dealership chooses

Much of what leaves CloseLine leaves because a dealership sent it. When a dealership submits a deal to a lender, the lender receives the credit application and the supporting documents as email attachments — including the customer's identity documents, income documents, and the application itself with the Social Security number, date of birth and income on it. When a dealership issues a vehicle service contract, the administrator receives the buyer's name, address, phone and email. When a customer authorizes an insurance referral, the agency receives the details the customer authorized. When a dealership refers a customer to another dealership, that dealership receives only the fields the customer approved. When a dealership publishes a vehicle or syndicates its inventory, the marketplace receives the listing.

Other disclosures

We may disclose personal information when the law, a subpoena, a court order or another lawful request requires it; where we believe in good faith that disclosure is necessary to protect the rights, property or safety of CloseLine, our customers, or the public, or to investigate fraud, abuse or a security incident; to our professional advisers; and in connection with a merger, acquisition, financing, reorganisation, or sale of assets, in which case information may transfer to the successor, which will remain bound by commitments at least as protective as those in this notice.

12. Artificial intelligence

Parts of the Service use artificial intelligence, and where they do, content is sent to an AI provider to be processed and returned.

Most AI features send no personal information about a dealership's customers at all: writing a vehicle description sends the vehicle's specifications and the dealership's own business details; reading a photographed invoice sends the photograph; the daily industry brief sends only trade-press headlines.

The in-product assistant is different, because dealership staff ask it about people. When a member of staff asks the assistant about a customer, or dictates a command that names one, the customer's name and — depending on the question — phone number, email address, city and state, position in the sales process, lead source, appointment times and stated budget can be sent to the AI provider as part of that request. Where a spoken reply is produced, the text of the reply is sent to a speech provider, and that text can contain a customer's name.

Social Security numbers, dates of birth, tax identification numbers and driver's licence numbers are deliberately excluded from everything the assistant sends, by an explicit list of the fields it is allowed to use.

We do not keep AI conversations: the Service stores no record of the questions asked or the answers given. AI output that a person saves — a vehicle description, for example — is stored like any other content.

No artificial intelligence in the Service makes a credit, pricing, underwriting, approval or eligibility decision about a consumer, and no consumer-facing automated decision is made about you by the Service.

13. Selling, sharing, and targeted advertising

CloseLine does not sell personal information for money. We do not share personal information for cross-context behavioural advertising for our own purposes, we do not operate an advertising pixel or advertising network on the platform itself, and we do not use dealership or customer information to target advertising.

There is an exception you should know about, because it is a dealership's decision rather than ours. A dealership can enter its own Meta (Facebook) advertising pixel in its CloseLine settings. If it does, that pixel loads on that dealership's public storefront and vehicle pages, and Meta receives the visit — including, on a vehicle page, the vehicle identification number of the car being viewed, so the dealership can advertise that specific car to that shopper again. The pixel belongs to the dealership and fires under the dealership's own arrangements with Meta. It does not load at all unless the dealership has entered a pixel identifier, and it never loads inside the CloseLine application itself. Depending on the state you live in, that may count as "sharing" personal information for targeted advertising by the dealership, and the dealership is the party to direct an opt-out request to.

Some pages also embed content from other companies, which means your browser contacts them directly and they receive your network address and browser details: an embedded Google map of the dealership's location on contact and vehicle pages, and web fonts loaded from Google on our own consumer vehicle enquiry pages.

We do not currently operate a cookie consent banner or a "Do Not Sell or Share My Personal Information" control. Our own visitor measurement honours Global Privacy Control and Do Not Track signals as described in section 7, and browser and device controls are described in section 16.

14. How long information is kept

While a dealership is a customer, its records — customers, deals, documents, credit applications, messages — are kept for as long as the dealership keeps them. There is no automatic expiry on that content, because a dealership's records are its own business and regulatory records, and deleting them on a schedule of our choosing would destroy records it is required to keep.

When a dealership cancels, its data is retained for ninety days, during which the account can be reactivated. Deletion happens later and is blocked until the record-retention periods that attach to its transactions have run — five years for odometer disclosures, twenty-five months for credit applications, two years for financing disclosures, one year for Buyers Guides, plus a state record-retention period — and until any in-house finance note is paid off, and until an archive has been produced for the dealership or the reason for waiving it recorded. A legal hold blocks it entirely. When deletion runs it is irreversible, and we keep a receipt that records the counts destroyed but no content.

Some categories have their own schedule. Visitor measurement records are deleted after thirteen months. Records of our scheduled jobs and of automated feed retrievals are deleted after thirty days.

Some records are kept until we delete them by hand rather than on a timer, and a dealership's deletion does not remove them because they are not attached to a single dealership. These are: our support mailbox, which holds our correspondence with dealerships, lenders and others; our error and monitoring records; the access log for secure links; consent evidence, which exists to be produced later; and a log of inbound lead emails. We are reviewing retention for each of these, and section 18 tells you how to ask about information we hold about you.

15. How information is protected

We take measures we consider appropriate to the sensitivity of what the Service holds. Access to the application requires an account, and every dealership's records are separated at the database level so that one dealership's account cannot read another's. Inside a dealership, what a user can see and do depends on the role assigned to them. Traffic between browsers and the Service uses encrypted connections.

Identity and income documents are stored inside the protected database rather than in the file storage used for public content such as vehicle photographs. Links sent to customers are long random tokens that expire, can be revoked, and in most cases can be used only once; the sensitive ones are stored only as a one-way hash, and every use and failed attempt is logged. Values such as a dealership's bank account and tax identification numbers are masked in the interface and removed from logs and audit records.

No system is completely secure, and we do not claim that ours is. We do not hold a security certification, and this notice makes no representation that any particular technical control applies to any particular field. If we become aware of a breach affecting personal information we will act in accordance with applicable law, including the notification requirements of the New York SHIELD Act where they apply.

If you believe you have found a security problem in the Service, please tell us at support@gocloseline.com.

16. Your choices

• Email from us: marketing email we send carries an unsubscribe link, and we honour it. We will still send messages about your account and the Service.
• Text messages: reply STOP to a text to opt out of further texts from that sender. Messages a dealership sends to its customers are sent under the dealership's own registration and consent records.
• Browser storage and cookies: you can clear or block browser storage and cookies through your browser settings. Blocking them will sign you out and will stop our visitor measurement from telling a returning visit from a new one; the Service will still work.
• Privacy signals: our own visitor measurement honours Global Privacy Control and Do Not Track, as described in section 7.
• Third-party embeds: content embedded from other companies — an advertising pixel a dealership enabled, an embedded map, web fonts — is controlled through your browser and through your settings with those companies.
• Your account: a dealership user can update their own profile details in the product, and an administrator at the dealership can change or remove a user's access.

17. Your rights

Depending on where you live, you may have rights to know what personal information is held about you and to obtain a copy of it; to correct inaccurate information; to have information deleted; to obtain it in a portable form; to opt out of its sale, of sharing for cross-context behavioural advertising, and of targeted advertising; to limit the use of sensitive personal information; and not to be discriminated against for exercising a right. Several United States states, including New York, also give you rights in connection with a data breach.

Which rights you have, and who must satisfy them, depends on your state and on who is responsible for the information. For information a dealership collected about its customer, the dealership decides — see section 3, and contact the dealership.

Some information cannot be deleted on request, because a dealership is required by law to keep it. An odometer disclosure, a credit application, a financing disclosure and other transaction records carry federal and state retention periods, and a request to delete them will be refused for as long as those periods run.

18. How to make a privacy request

Email support@gocloseline.com and tell us what you are asking for. If your information is in a dealership's records, tell us which dealership you dealt with, so we can route your request to them.

We will ask you for enough information to verify that the request is really yours before we act on it — typically confirmation from the email address or phone number already on the record, plus details only the person concerned would know. We will not ask you to create an account, and we will not use what you give us for verification for anything else. If we cannot verify you to a reasonable degree of certainty, we will tell you, and we will not disclose personal information to someone we cannot confirm is entitled to it.

An authorized agent may make a request on your behalf where state law allows it. We will ask for proof of the agent's authority and may still verify your identity with you directly.

We will respond within the time your state's law requires. If we decline a request we will tell you why. Where state law provides a right to appeal a refusal, you may appeal by replying to our decision with the word "appeal" and your reasons; a different person will review it and respond within the period the law allows, and will tell you how to contact your state's attorney general if you remain dissatisfied.

19. Children

CloseLine is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 18 through the platform. A dealership's records may contain information about a young person in the ordinary course of a vehicle transaction; that information is the dealership's, held under this notice's service provider terms. If you believe a child's information has reached us in error, contact support@gocloseline.com and we will work with the dealership concerned to address it.

20. Changes to this notice

We may update this notice. Every version carries a version number and an effective date, and previous versions stay published at their own stable web addresses. If we make a material change we will tell dealership account holders before it takes effect, and where the change affects what a dealership must agree to, we will ask an authorized person to acknowledge the new version.

21. Contact

Email support@gocloseline.com.

If you are a dealership's customer, contacting the dealership you did business with will usually be faster, and for most requests it is the dealership that decides.