Your data, in plain terms.

This policy explains how Lotsmith ("we", "us") handles personal information when you visit lotsmith.co or use the Lotsmith product. Lotsmith is based in the United States. We are the controller of the personal information described here. It applies from July 15, 2026.

If anything in this policy is unclear, write to hello@lotsmith.co and a person will answer.

We collect only what we need to run the product:

• Account details: your name, email address, dealership name, and a password we store only as a one-way hash.
• Dealership and inventory data: your website address, vehicle facts, photos, pricing, and the brand details you give us (tagline, logo, brand voice). Lotsmith reads inventory from your existing dealership website; we never ask you to upload spreadsheets of customer data, and we do not collect information about your customers.
• Billing information: payments are handled by Stripe. We never see or store card numbers. We keep records of your plan, invoices, and payment status.
• Publishing credentials and sessions: if you connect an account for posting (for example Craigslist, or a Facebook Business Page through Facebook's official login), credentials, access tokens, and session data are encrypted before storage, are never shown back to anyone, and are never written to logs. We never see your Facebook password. You can disconnect at any time, which removes them; see our data deletion page.
• Usage and technical data: sign-in times, actions taken in the product, and standard server logs (IP address, browser type) needed to keep the service running and secure.
• Analytics: one optional Google Analytics cookie on the marketing site, and only if you accept it. See the cookies section below.
• Communications: emails and support messages you send us.

We sometimes contact independent dealerships about Lotsmith using business contact information published on the dealership's own website or public listings. We only use it to introduce Lotsmith, we include a way to opt out in every message, and one reply saying no is enough to stop. If you want your contact details deleted from our records, ask and we will do it.

We use the information above to:

• Run the product: sync your inventory, find marketing opportunities, and generate campaigns.
• Publish listings, but only where you have connected an account and approved the listing.
• Bill you for your plan and keep the records tax law requires.
• Support you, secure the service, and fix problems.
• Understand which parts of the site and product help dealers most, so we can improve them.

We do not sell your personal information. We do not share it with anyone for advertising. We do not use your data to market to your customers. Your inventory and your brand belong to you.

Lotsmith sends vehicle details, photos, and your brand profile to AI providers (OpenAI and Anthropic) to generate campaign text and images. These requests go through business API agreements under which the providers do not use your content to train their models. We record what each request cost so we can show you honest usage, and every AI request is traceable in our logs without exposing your credentials or secrets.

We use a small number of service providers, each only for the job listed, each under a contract that limits what they may do with the data:

• Stripe: payment processing and subscription billing.
• OpenAI and Anthropic: generating campaign text and images from your inventory and brand profile.
• Meta (Facebook and Instagram): when you connect a Facebook Business account, publishing the content you approve to your Page (and, if linked, Instagram). Lotsmith uses Meta's official API and only the access you grant; you can disconnect at any time.
• Resend: sending transactional and service emails.
• Google Analytics: site usage statistics on the marketing site, only after you accept the analytics cookie.
• Vercel and our cloud hosting providers: running the website and application. Data is stored in the United States.

Signing in uses an essential cookie. It only keeps you signed in and needs no consent.

The only optional cookie is Google Analytics on the marketing site. It does not load until you accept it, declining changes nothing about how the product works, and we honor the Global Privacy Control browser signal as a decline. You can change your choice here at any time:

Where the GDPR or a similar law applies, we rely on:

• Performance of a contract: running your account, syncing inventory, generating and publishing campaigns, billing.
• Legitimate interests: securing the service, preventing abuse, improving the product, and contacting dealerships about Lotsmith using published business contact details.
• Consent: the optional analytics cookie. You can withdraw it at any time using the choice above.
• Legal obligation: keeping billing and tax records.

You can ask us to show you the personal information we hold about you, correct it, export it in a portable format, restrict or object to how we use it, or delete it. Email hello@lotsmith.co and we will respond within 30 days. We will verify the request came from you, and we will never treat you worse for exercising a right.

If you are in the EEA or UK, you also have the right to complain to your data protection authority.

If you are a California resident, the CCPA gives you the rights above by other names (right to know, correct, delete, and opt out of sale or sharing). We do not sell or share personal information as the CCPA defines those terms, and we honor the Global Privacy Control signal.

We keep your data while your account is active. If you close your account, or ask us to, we delete or anonymize your personal information within 30 days, except billing records we are legally required to keep and server logs, which expire on a short rolling window. Publishing credentials are deleted immediately when you disconnect them.

Passwords are stored only as one-way hashes. Publishing credentials are encrypted before storage and excluded from logs. Data moves over encrypted connections. Access to production data is limited to the people who need it to run the service. No system is perfectly secure, but if a breach ever affects your data we will tell you promptly.

Lotsmith runs in the United States. If you use the service from outside the United States, your information is transferred to and processed in the United States under this policy.

Lotsmith is a business tool for dealerships. It is not directed at children, and we do not knowingly collect information from anyone under 16.

If we change this policy, we will post the new version here and update the date at the top. If a change meaningfully affects how we handle your data, we will email account holders before it takes effect.