California Privacy Notice

This California Privacy Notice explains how LotPilot collects, uses, discloses, and "shares" personal information, and the rights you have under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). It applies to California residents who interact with LotPilot's dealer-facing website at dealers.lotpilot.com, including businesses that request a demo or an AI-visibility audit, as well as shoppers and consumers who interact with dealer inventory pages, chat, forms, or automated communications that LotPilot operates on a dealer's behalf. This notice supplements our general Privacy Policy.

Who we are

LotPilot is a Delaware C-Corporation. We operate this dealer-facing site (dealers.lotpilot.com) as well as our consumer site (lotpilot.com). We store personal information in the United States. LotPilot does not resell leads to lead aggregators or data brokers. If you have any question about this notice, email privacy@lotpilot.com.

This site serves two audiences, and this notice covers both: (1) business prospects — dealership owners and staff who request a demo, run an AI-visibility audit, or submit our contact form; and (2) consumers and shoppers — car buyers who browse dealer inventory pages, chat with our AI assistant, submit financing or contact forms, or receive calls, texts, and emails that LotPilot sends on a dealer's behalf.

Categories of personal information we collect

In the preceding 12 months, LotPilot has collected the following categories of personal information. The table shows examples of what we collect, where it comes from, and the parties we disclose it to for a business purpose.

Category	Examples we collect	Sources	Disclosed for a business purpose to
Identifiers	Name, email address, telephone number, postal address, IP address, and online/device identifiers (including advertising cookies)	Directly from you (forms, chat, calls); automatically from your browser and device	The selected dealer/lender; service providers (hosting, messaging, analytics, CRM/automation); Meta Platforms via the Meta Pixel
Customer records (Cal. Civ. Code 1798.80)	Name, address, telephone number, and — if you start financing — date of birth, employment/income, and the last four digits of your Social Security number	Directly from you when you begin pre-qualification or a financing application	The selected dealer/lender; the credit service that processes the application
Commercial information	Vehicles you viewed or inquired about, appointments you scheduled, and details of your inquiries or messages	Directly from you; automatically from your activity on dealer inventory pages	The selected dealer; service providers; LLM providers acting as service providers
Internet or network activity	Pages viewed, time on page, referring source, browser and user-agent string, and interactions with our chat and forms	Automatically from your browser and device	Service providers (analytics, security); Meta Platforms via the Meta Pixel
Geolocation	Approximate region derived from IP address (not precise GPS location)	Automatically from your IP address	Service providers (security, analytics)
Professional or employment information	For dealer prospects: business name, role, and business contact details. For financing applicants: employer and income	Directly from you	Service providers (CRM/automation); the selected dealer/lender and credit service
Audio and electronic information	The content of calls, SMS texts, chat sessions, and emails exchanged with LotPilot on a dealer's behalf	Directly from you during those communications	Communications providers (including Twilio); LLM providers acting as service providers; the selected dealer
Sensitive personal information	The last four digits of your Social Security number, collected only if you begin a financing or pre-qualification application	Directly from you	The selected dealer/lender and the credit service that processes the application
Inferences	Vehicle preferences, shopping intent, and lead-qualification or routing signals drawn from the above	Derived by LotPilot and its LLM service providers from the categories above	The selected dealer; LLM providers acting as service providers

Sources of personal information

We collect personal information from the following sources:

• Directly from you — when you submit a form, chat with our AI assistant, request a demo, run an AI-visibility audit, begin a financing application, or exchange calls, texts, or emails with us.
• Automatically — from your browser and device as you use the site, including through cookies and similar technologies (such as the Meta Pixel, which sets the first-party cookies named _fbp and _fbc).
• From dealers — the dealership you are engaging with may provide information about your inquiry so we can respond on its behalf.

Business and commercial purposes for collection

We collect and use personal information for these business and commercial purposes:

• To operate the site, dealer inventory pages, and the AI chat experience.
• To respond to inquiries and to qualify, route, and connect consumers with the specific dealer they are interested in.
• To place and send automated and AI-generated outbound phone calls, SMS texts, and emails to consumers on dealers' behalf.
• To generate messages, answer questions, book appointments, and analyze AI-search visibility using large-language-model service providers.
• To process financing pre-qualification and applications and transmit them to the selected dealer/lender.
• To auto-post dealer inventory to third-party marketplaces and to route inquiries from those platforms.
• To follow up with dealership prospects who request a demo, run an audit, or submit our contact form.
• To measure and optimize advertising, to secure the site, and to detect and prevent fraud and abuse.

How we disclose personal information to service providers

LotPilot discloses personal information to service providers and contractors that perform functions on our behalf. These parties are bound by contract to use the information only to provide services to LotPilot and are prohibited from using it for their own purposes. They include:

• Communications providers, including Twilio — to place and send outbound and inbound phone calls, SMS texts, and emails. See "Automated and AI-generated communications" below.
• Large-language-model (LLM) providers — consumer lead, chat, and message data may be processed by third-party LLM providers (for example, OpenAI, Google, Anthropic, xAI, and Perplexity) acting as our service providers to answer questions, qualify and route leads, generate messages, book appointments, and analyze AI-search visibility. These providers are contractually restricted from using the data to train their own models. A current sub-processor list is available on request at privacy@lotpilot.com.
• Credit service provider — if a consumer begins pre-qualification or financing, we transmit the application to the selected dealer/lender through a credit service. See "Sensitive personal information" below.
• CRM and automation platform — for dealer prospects, business contact details, IP address, and browser/user-agent information are processed through a third-party automation/CRM workflow so we can follow up.
• Hosting, security, and analytics providers — to run, secure, and measure the site.

We may also disclose the specific dealer you have chosen to contact the information necessary to respond to your inquiry, and we may disclose personal information as required by law or to protect our rights.

"Sharing" for cross-context behavioral advertising

The Meta Pixel is live on this dealer site. It initializes Meta's tracking function (fbq) and tracks a PageView event on load, along with conversion events such as Lead, CompleteRegistration, Contact, and Schedule when you take those actions. It sets the first-party cookies named _fbp and _fbc, and it shares that activity with Meta Platforms, Inc. for advertising measurement and optimization on Facebook and Instagram.

Because this data is provided to Meta Platforms for cross-context behavioral advertising, this activity qualifies as "sharing" under the CCPA/CPRA. You can opt out of this sharing through our cookie controls or by enabling a Global Privacy Control (GPC) signal in your browser, which LotPilot honors automatically. To opt out, visit Do Not Sell or Share My Info.

We do not "sell" your personal information

LotPilot does not sell personal information for money. We do not sell your information to lead aggregators or data brokers. The only activity that may be considered "sharing" under California law is the cross-context behavioral advertising described above, which you can opt out of at any time.

Sensitive personal information

If you begin a pre-qualification or financing application, LotPilot collects your name, address, date of birth, the last four digits of your Social Security number, and employment/income information, and transmits it to the dealer/lender you select. This information is processed through a credit service. Under the CCPA/CPRA, the last four digits of your Social Security number is sensitive personal information. We use and disclose it only to perform the financing service you requested — namely, to process your application and connect you with the dealer/lender — and not to infer characteristics about you. Because our use is limited to providing this requested service, no additional right to limit its use applies; nevertheless, you may contact us with any question.

A pre-qualification is a soft inquiry that does not affect your credit score. A hard inquiry is made only with your explicit consent. This activity is governed by the FCRA Notice provided during the financing flow.

Automated and AI-generated communications

LotPilot places and sends automated and AI-generated outbound phone calls, SMS text messages, and emails to consumers on dealers' behalf, using third-party providers including Twilio. These communications are not always handled by a live person and may be generated by artificial intelligence.

• By providing your phone number, you consent to receive automated and AI-generated calls and texts from or on behalf of the dealer and LotPilot.
• Message and data rates may apply.
• Reply STOP to any text to opt out, and HELP for help.
• Consent to receive these communications is not a condition of any purchase.

Third-party marketplaces

Dealers use LotPilot to automatically post their inventory to third-party platforms such as Facebook Marketplace and Craigslist. If you contact a dealer through one of those platforms, your inquiry there is also subject to that platform's own terms and privacy practices, which LotPilot does not control.

Your California privacy rights

Subject to certain exceptions, California residents have the following rights:

• Right to know — request the categories and specific pieces of personal information we have collected about you, the sources, the business or commercial purposes for collecting it, and the categories of third parties to whom it was disclosed.
• Right to delete — request deletion of personal information we have collected from you.
• Right to correct — request that we correct inaccurate personal information.
• Right to opt out of sale or sharing — direct us not to "share" your personal information for cross-context behavioral advertising. (We do not "sell" personal information.)
• Right to limit the use of sensitive personal information — we use sensitive personal information only to perform the financing service you request, which is a permitted use; you may still contact us with questions.
• Right to non-discrimination — we will not discriminate against you for exercising any of these rights.

How to exercise your rights

To exercise your right to know, delete, or correct, email privacy@lotpilot.com with the subject "CCPA Request" and tell us which right you are exercising. To opt out of "sharing" for advertising, use Do Not Sell or Share My Info. We will verify your identity before responding and will respond within the timeframes required by law (generally 45 days, extendable once). You may designate an authorized agent to submit a request on your behalf; we may require proof of the agent's authorization and verification of your identity.

Global Privacy Control (GPC)

LotPilot recognizes and honors the Global Privacy Control (GPC) browser signal as a valid request to opt out of the "sharing" of personal information for cross-context behavioral advertising. If you enable GPC, we will treat it as an opt-out for the browser and device from which it is sent, without requiring you to submit a separate request.

Contact us

For any question about this California Privacy Notice or to exercise your rights, email privacy@lotpilot.com. For more about how we handle personal information generally, see our Privacy Policy.