Legal
Privacy Policy
Effective date: August 31, 2026
This Privacy Policy explains how BDC Pros, LLC (“CarBot”, “we”, “us”) collects, uses, and shares personal information in connection with our websites (including gocarbot.com) and the CarBot platform for automotive dealerships (together, the “Services”).
The two roles we play
CarBot handles personal information in two distinct capacities, and your rights differ depending on which applies to you:
- CarBot as a business/controller. For visitors to our websites and for the dealership personnel who create and use CarBot accounts, we decide how and why information is processed, and this Policy applies directly.
- CarBot as a service provider/processor. Dealerships use CarBot to communicate with their own customers and leads (“Consumers”). Consumer information inside the platform — contact records, text messages, emails, call recordings, transcripts, appointment and vehicle-interest data — is processed on the dealership’s behalf and under its instructions. The dealership is responsible for that data, including for providing privacy notices and obtaining any required consents. If you are a dealership’s customer and want to exercise privacy rights over that data, contact the dealership; we support dealerships in honoring such requests. If a Consumer contacts us directly, we will route the request to the relevant dealership where we can identify it.
1. Information We Collect
Account and business information (as a controller): name, work email address, phone number, role, dealership name and details, authentication data, and billing information (payment card details are collected and processed by our payment processor, [PAYMENT PROCESSOR]; we do not store full card numbers).
Website and product usage information (as a controller): log data such as IP address, browser and device information, pages viewed, and actions taken in the product; diagnostic and security logs. Our application logs are designed to reference internal identifiers rather than message content or phone numbers.
Communications content and Consumer records (as a processor, on dealership instructions): Consumer names and contact details; lead, appointment, and vehicle-of-interest records; SMS/MMS messages and attachments; emails; voice calls, including recordings and transcripts where the dealership enables them; voicemail; notes; and consent/opt-out records.
Cookies and similar technologies. We use a small set of cookies necessary to operate the Services — authentication/session cookies and preferences such as your theme choice. [IF ANALYTICS/MARKETING COOKIES ARE USED ON THE MARKETING SITE, LIST THEM AND ADD A CONSENT MECHANISM WHERE REQUIRED.] Because our essential cookies are required for the Services to function, they cannot be disabled while using the platform.
Information from third parties: data dealerships import or connect from their CRM/DMS and lead providers; carrier metadata (such as message delivery status) from telephony providers.
2. How We Use Information
- To provide, operate, secure, and support the Services, including routing calls and messages, maintaining the shared inbox, and syncing integrations the dealership connects.
- To provide AI features at the dealership’s direction (see Section 3).
- To manage accounts, process payments, and communicate with dealership users about the Services (service messages, security notices, and — with the ability to opt out — product news).
- To monitor, audit, and improve the Services, including troubleshooting, analytics, and developing new features; where feasible we use aggregated or de-identified data for these purposes.
- To support compliance: recording consent and opt-out events, enforcing quiet hours and do-not-contact flags, and maintaining audit logs of sensitive actions.
- To comply with law and enforce our agreements.
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use Consumer communications content to build advertising profiles.
3. AI Features
Dealerships can enable AI agents that answer phone calls and reply to text messages, plus AI-assisted tools such as call transcription, call summaries, sentiment analysis, and suggested replies. When these features are used:
- Relevant content — such as the Consumer’s message or call audio, conversation history, and dealership data like contact profiles, lead status, and vehicle inventory — is processed by our AI infrastructure subprocessors (listed in Section 5) to generate the output.
- AI text and voice agents are designed to identify themselves as automated assistants and to hand off to dealership staff.
- Our agreements with AI subprocessors restrict them from using this content to train their generally available models. [VERIFY against current provider agreements.]
- Dealerships control whether AI features are enabled — globally, per department, and per conversation — and are responsible for the disclosures required in their jurisdictions, including call-recording notices.
4. Call Recording and Text Messaging
Call recording, transcription, and monitoring occur only where the dealership enables them, and dealerships are responsible for providing legally required notices to call participants. Text messaging through the platform honors standard opt-out keywords (for example, STOP) automatically; opting out creates a suppression record that blocks further texts from that dealership through our platform. Message and data rates from your carrier may apply to Consumers’ messages.
5. How We Share Information
We share personal information only with:
Subprocessors and service providers that help us run the Services, bound by contracts limiting their use of the data to providing services to us:
[KEEP THIS TABLE IN SYNC WITH THE ACTUAL SUBPROCESSOR LIST; ADD/REMOVE AS ARCHITECTURE CHANGES.]
The dealership you interact with. If you are a Consumer, your communications and records are visible to the dealership you are communicating with — that is the purpose of the platform.
Legal and safety. We may disclose information to comply with law or legal process, to protect the rights, safety, or property of CarBot, our customers, or others, or in connection with preventing fraud or abuse.
Corporate transactions. In a merger, acquisition, financing, or sale of assets, information may be transferred subject to this Policy’s commitments.
6. Data Retention
We retain account information for as long as the account is active and as needed afterward for legitimate business purposes (such as billing records and legal compliance). Customer Data processed for a dealership is retained for the duration of the dealership’s subscription; after termination we delete or de-identify it within 90 days, except backups purged on standard cycles and records reasonably retained to document communications compliance (such as consent and opt-out logs), which we may retain for four (4) years (aligned with the TCPA statute of limitations) in defensible form.
7. Security
We use administrative, technical, and physical safeguards appropriate to the nature of the data, including encryption in transit, role- and tenant-scoped access controls, audit logging of sensitive actions, and separation of customer environments. No system is perfectly secure; we encourage strong, unique passwords and prompt reporting of suspected issues to security@bdcpros.com.
8. Your Privacy Rights
Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, and to opt out of certain processing.
- Dealership users and website visitors: submit requests to privacy@bdcpros.com. We will verify your request and respond within the time required by applicable law. We will not discriminate against you for exercising your rights.
- Consumers of dealerships: because we process your data on your dealership’s behalf, please direct requests to the dealership you interacted with. We provide dealerships with tools to search, export, and delete Consumer records to honor such requests.
- U.S. state privacy laws (such as the CCPA/CPRA and similar statutes): we do not sell or share personal information as those terms are defined; we act as a service provider with respect to Consumer data. You may designate an authorized agent to make requests on your behalf, subject to verification.
- Global Privacy Control: where legally required, we honor GPC signals on our websites. We do not respond to browser “Do Not Track” signals otherwise.
- [IF EEA/UK USERS ARE IN SCOPE: ADD GDPR SECTION — LAWFUL BASES, INTERNATIONAL TRANSFER MECHANISMS, EU/UK REPRESENTATIVE, SUPERVISORY-AUTHORITY COMPLAINT RIGHT.]
9. Children
The Services are for business use and are not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, contact privacy@bdcpros.com and we will delete it.
10. Changes to This Policy
We may update this Policy from time to time. We will post the revised version with a new effective date and, for material changes, provide notice by email or through the Services. Your continued use after the effective date constitutes acceptance.
11. Contact Us
BDC Pros, LLC
[POSTAL ADDRESS]
privacy@bdcpros.com