Privacy Policy
Effective October 4, 2026
This policy explains what personal information CarCortex collects, how we use and share it, and the choices and rights you have. It covers our website, carcortexai.com, and the CarCortex service we provide to used-car dealerships.
Who we are and what this policy covers
CarCortex (“we”, “us”) runs the website at carcortexai.com and the CarCortex service: AI agents that help US used-car dealerships find and value cars and answer their buyers. CarCortex is a US service. We host the website and the service, and keep the service’s database, in the United States. Some of our service providers may process information outside the United States.
This policy applies to:
- Website visitors, including people who request a demo.
- Our customers’ users: the owners and staff who sign in to CarCortex for a dealership.
- Buyers and sellers whose information we handle for a dealership, for example when they email, text or call a dealership that uses CarCortex. For this information we act for the dealership: see Information we handle for dealerships.
It does not cover how a dealership itself uses information (its own privacy policy does), or other websites we link to.
Notice at collection: demo requests
This notice is for people who request a demo on our website.
- What we collect: your name, work email, phone number (optional), dealership name, role, number of rooftops, current DMS or CRM (optional) and your message (optional). When you pick a time, our scheduling provider also receives your name, your email and anything you enter there.
- Why: to answer your request, schedule and give the demo, and follow up with you about CarCortex.
- How long we keep it: as long as we need to schedule the demo and follow up with you. Then we delete it from our inbox.
- Selling and sharing: we do not sell it, and we do not share it for cross-context behavioral advertising.
- Sensitive information: the form does not ask for any.
Your request is emailed to us through our email delivery provider. It is not stored in a database. Our hosting provider also logs technical data about your visit (see Information we collect on our website). You have the rights described in Your privacy rights.
Information we collect on our website
Demo requests
The demo form asks for the details listed in the Notice at collection: demo requests. We send them to our own inbox through our email delivery provider and do not store them in a database.
Scheduling
You pick a demo time in a scheduling tool that is embedded in our page and run by our scheduling provider. It receives your name, your email and anything you enter there, and may set its own cookies inside its frame. Its own privacy policy also applies.
Technical data
Our hosting provider logs technical data when you visit: your IP address, your browser, the pages you request and when. We use it to keep the website secure and running.
Emails you send us
If you email us, we receive your address and your message and use them to reply.
The website sets no cookies of its own and uses no analytics or advertising trackers.
Information we collect in the CarCortex service
Dealerships use CarCortex under a contract with us. When a dealership uses it, we collect:
Account information
For each person who signs in: name, email address, password, role (owner or staff) and when they last signed in. We store passwords only as a scrypt hash, never the password itself. When an owner invites someone, we store that person’s email address and send them the invitation.
Dealership settings
The dealership’s name, ZIP code, business hours, buying targets and money settings, such as its daily spend cap, and which agents are switched on.
Connected accounts
A dealership can connect its own email, phone and text, voice and messaging accounts so its agents can send and receive messages and calls. We store the credentials for those accounts encrypted with AES-256-GCM.
Business records
What the dealership creates in CarCortex: the listings it tracks, valuations, deals, inventory, appointments, leads and notes.
Conversations with buyers and sellers
When buyers and sellers email, text or call a dealership through its connected accounts, or the dealership contacts sellers, we keep the conversation for the dealership:
- names, email addresses and phone numbers;
- the content of the messages;
- for calls, a transcript, a summary and a link to the recording, which the dealership’s voice provider keeps;
- financing interest a buyer chooses to share, in their own words, such as cash or finance, a down payment, how they describe their credit, and their work. The agents never ask for a Social Security number, a date of birth, bank details or financial documents.
Listings and market data
The agents search public marketplace listings and licensed market data, and look up public VIN and recall records. A listing can include a seller’s name or contact details if the seller published them.
Usage and activity records
What each agent run did and cost, the agents’ working notes, and an audit log of what the agents did and the decisions and approvals people made. We use these to show the dealership its history and spend, to enforce its daily spend cap and to keep the service secure. Our servers also log technical data, such as requests and errors, for security and troubleshooting.
How we use information
We use personal information to:
- provide the service: run the agents a dealership switches on, such as searching listings, valuing cars, answering buyers, contacting sellers with the owner’s approval and booking appointments;
- create and manage accounts, and send account emails such as invitations and password resets;
- answer demo requests, schedule demos and follow up;
- keep the website and the service secure, prevent abuse, and enforce limits such as the daily spend cap;
- fix problems and keep the service running;
- comply with the law and enforce our Terms of Service.
We do not sell personal information, and we do not use it for targeted advertising.
AI processing
CarCortex’s agents run on AI models from AI model providers. To do their work, the agents send those providers the content in front of them: listing text, the dealership’s settings and notes, and buyers’ and sellers’ messages and calls. The providers return drafts of replies, valuations and summaries.
We do not use customer content to train generalized AI models, and where we control the choice, we do not allow our providers to train on it.
When the Concierge answers a dealership’s phone, it introduces itself as the dealership’s AI assistant. When the Closer calls a seller, it says it is an AI assistant calling for the dealership.
Information we handle for dealerships
When we handle buyers’ and sellers’ personal information for a dealership, we act as that dealership’s service provider (also called a processor). The dealership decides why and how the information is used, and its own privacy policy applies.
We use that information only to provide CarCortex to that dealership, as our contract with it allows. We keep each dealership’s data separate from every other dealership’s.
If you are a buyer or a seller and want to access, correct or delete your information, contact the dealership. If you contact us instead, we will refer you to the dealership and help it answer your request.
Text messages and calls
The Concierge answers buyers on the channel they used. It never makes the first call or sends the first text to a buyer. The Closer contacts sellers by email, text or call only after the dealership’s owner approves each message.
Opting out of texts
Reply STOP to any text from a dealership that uses CarCortex, and nothing more is sent to your number from that dealership through CarCortex. UNSUBSCRIBE, QUIT, CANCEL and END work the same way.
Mobile information
We do not sell, rent or share mobile phone numbers or text-messaging opt-in data with third parties or affiliates for their marketing or promotional purposes. Text messaging providers receive phone numbers only to deliver the messages.
Calls
Calls through a dealership’s voice provider may be recorded and transcribed. The voice provider keeps the recording under the dealership’s account. CarCortex keeps the transcript, a summary and a link to the recording for the dealership.
Google user data
A dealership can connect its Gmail account to CarCortex. This section explains what happens to that data.
What we access
When the owner connects Gmail, CarCortex asks Google for two permissions: to send email from that account, and to read its email. CarCortex reads new messages that arrive after the connection. It keeps replies in conversations it started with buyers and sellers and, when the dealership has the Concierge answer email, new messages from people writing to the dealership and lead emails about its listed cars. Newsletters, promotions and other automated mail are skipped and not stored.
CarCortex sends the emails the dealership sends through it: replies to buyers, and messages to sellers once the owner approves them. We store the connected email address, the credentials Google issues (encrypted), and the messages that belong to a conversation: the sender, the subject and the text.
How we use it
Only to provide the features the dealership turned on: reading buyers’ and sellers’ replies and lead emails, and sending replies. The text of these messages is processed by AI model providers to draft replies and summaries for the dealership.
What we never do with it
- We do not use it to develop, improve or train generalized AI or machine-learning models.
- We do not sell it.
- We do not use it for advertising.
- We do not transfer it to anyone else, except the service providers that help us provide these features (such as our hosting and AI model providers), to comply with the law, or as part of a merger, acquisition or sale of assets with the dealership’s consent.
- No one at CarCortex reads it, except with the dealership’s permission, when it is needed for security (such as investigating abuse), to comply with the law, or for our internal operations once it is aggregated and anonymized.
Disconnecting
The owner can disconnect Gmail in Settings at any time. CarCortex then revokes its access and deletes the stored credentials. You can also remove its access in your Google Account’s security settings. Messages already filed in a conversation stay in the dealership’s records until the dealership’s data is deleted.
CarCortex's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
How we share information
We share personal information only as described here.
Service providers
We use service providers to run the website and the service, and share with them what they need for that work.
| Service provider | What it receives |
|---|---|
| Cloud hosting and database (United States) | Everything on our website and in the service, to host and run them. |
| Email delivery | Demo requests (sent to our own inbox) and account emails, such as invitations and password resets. |
| Scheduling | Your name, your email and anything you enter when you book a demo. |
| AI model providers | The content an agent works on: listing text, the dealership’s settings and notes, and buyers’ and sellers’ messages and calls. |
| Email, voice, text messaging and messaging apps (the dealership’s own accounts) | Email addresses, phone numbers, messages and calls, to deliver them, under the dealership’s own agreements with those providers. Alerts and the daily digest go to the messaging account the dealership connects. |
| Listing and market data, and public VIN and recall records | Search terms such as a make, a model and a ZIP code, listing links, and a vehicle’s VIN. |
| Uptime monitoring and logs | Our servers’ technical logs, which can include IP addresses, email addresses and account IDs. |
| Backups | Copies of our database and of each dealership’s files. |
The dealership
The owners and staff of a dealership see its data in CarCortex, including conversations, leads and the audit log.
Legal and safety
When the law requires it, or to protect the rights, property or safety of CarCortex, our customers or others.
Business transfers
If we are involved in a merger, acquisition or sale of assets, personal information may transfer to the new owner, and this policy continues to apply to it.
Cookies and browser storage
- Website: we set no cookies of our own and use no analytics or advertising trackers. The embedded scheduling tool may set its own cookies inside its frame.
- App: one cookie keeps you signed in. The app also remembers display preferences, such as the color theme, in your browser’s storage. It uses no analytics or advertising trackers.
Security
- The website and the app use encrypted connections (TLS), and so do the app’s database connections.
- Passwords are stored only as scrypt hashes. Sign-in sessions, invitations and password-reset links are stored only as hashes too.
- Credentials for connected accounts are encrypted with AES-256-GCM.
- Every record belongs to one dealership, and every request is checked against the signed-in person’s dealership. Only owners can invite staff, export the data or delete the dealership.
- At CarCortex, access is limited to the people who need it to run the service.
No method of storing or sending information is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal information, we will notify you as the law requires. If you think your information or account is at risk, email privacy@carcortexai.com.
How long we keep information
We keep personal information only as long as we need it for the purposes in this policy, or as the law requires.
| Information | How long we keep it |
|---|---|
| Demo requests | As long as we need to schedule the demo and follow up with you. Then we delete them from our inbox. If you become a customer, we keep what we need to set up and run your account. |
| Website technical logs | For a limited time set by our hosting provider, for security and operation. |
| A dealership’s data: accounts, settings, business records, conversations, usage records and the audit log | For the life of the dealership’s account. The owner can delete the dealership and all its data from Settings at any time. |
| Credentials for connected accounts | Until the account is disconnected or the dealership is deleted. |
| Server logs | For a limited time, for security and troubleshooting. |
Deleting a dealership in Settings removes its data from our database and its files from our servers. Copies already in our backups remain until those backups are deleted in the ordinary course. We may keep information longer when the law requires it, or to resolve disputes and enforce our agreements.
Your privacy rights
Wherever you live in the United States, you can ask us to exercise the rights below. If you are a California resident, you have these rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the CCPA). Other states give their residents similar rights.
Your rights
- Know and access: ask what personal information we have collected about you, where it came from, why we use it and who we share it with, and get a copy.
- Delete: ask us to delete personal information we collected from you, subject to the exceptions the law allows.
- Correct: ask us to correct personal information that is inaccurate.
- Portability: get your information in a portable, commonly used format. A dealership’s owner can also export all of the dealership’s data as a file from Settings.
- Opt out of sale or sharing: we do not sell or share personal information, as the CCPA defines those terms, and we have not done so in the past 12 months.
- Limit the use of sensitive personal information: we use sensitive personal information only to provide the service, so we do not use it for any purpose that this right covers.
- Non-discrimination: we will not treat you differently for using any of these rights.
How to make a request
Email privacy@carcortexai.com and tell us which right you want to use. If your request is about information we handle for a dealership, contact the dealership (see Information we handle for dealerships).
How we verify requests
We verify your identity by matching information you give us with information we already hold, for example by asking you to reply from the email address we have on file. We use what you give us only to verify the request.
Authorized agents
Someone else can make a request for you. We will ask the agent for your signed permission, and we may ask you to verify your identity with us directly, unless the agent holds a valid power of attorney.
How long we take
We confirm that we received your request within 10 business days and respond within 45 days. If we need more time, we will tell you why, and take up to 45 more days.
Global Privacy Control
We treat a Global Privacy Control signal from your browser as a request to opt out of the sale and sharing of your personal information. We do not sell or share personal information, so there is nothing more to switch off.
California disclosures
This table describes the categories of personal information we collected in the past 12 months, where they came from, why we use them and who receives them. For completeness, it includes information we handle for dealerships as their service provider.
| Category | Examples | Sources | Why we use it | Disclosed to |
|---|---|---|---|---|
| Identifiers | Name, email address, phone number, IP address, account ID. | You; the dealership; buyers and sellers who contact a dealership or whom it contacts; public marketplace listings; your browser. | Providing the service; demo requests; accounts and account emails; security. | The dealership; service providers (hosting and database, email delivery, scheduling, AI model providers, voice and text messaging, monitoring and logs, backups). |
| Customer records (Cal. Civ. Code § 1798.80(e)) | Name, phone number, email address, and how a buyer describes their work and finances. | You; buyers. | Providing the service; passing a buyer’s financing interest to the dealership. | The dealership; hosting and database, AI model providers, backups. |
| Commercial information | Cars a buyer asks about, cars a seller lists, deals, inventory, appointments, financing interest, the service’s usage and costs. | The dealership; buyers; sellers; public marketplace listings; licensed market data. | Providing the service, including valuations and booking; showing spend and enforcing the daily spend cap. | The dealership; hosting and database, AI model providers, listing and market data, backups. |
| Internet or other electronic network activity | IP address, browser, pages requested, sign-in times, the audit log of actions in the app. | Your browser or device; your use of the service. | Security; keeping the website and the service running; the dealership’s audit log. | The dealership (its audit log); hosting, monitoring and logs, backups. |
| Audio and electronic information | Message content; call transcripts and summaries; a link to call recordings kept by the dealership’s voice provider. | Buyers and sellers, through the dealership’s connected accounts. | Providing the service: answering, summarizing and filing conversations for the dealership. | The dealership; hosting and database, AI model providers, voice and text messaging, backups. |
| Professional or employment information | Your role, dealership, number of rooftops and current DMS or CRM; a buyer’s work, as they describe it. | You; buyers. | Demo requests; accounts and roles; passing a buyer’s financing interest to the dealership. | The dealership; email delivery, hosting and database, AI model providers, backups. |
| Inferences | Summaries of what a buyer is looking for and what the dealership should follow up on. | Created by the agents from conversations. | Providing the service: leads and follow-ups in the dealership’s inbox. | The dealership; hosting and database, AI model providers, backups. |
| Sensitive personal information | Account login credentials: your email and password, and the credentials for accounts a dealership connects. | You; the dealership. | Signing in and connecting accounts, only to provide the service. | Hosting and database, backups. Passwords are stored only as hashes, and credentials encrypted. |
Selling and sharing
We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We have no actual knowledge of selling or sharing the personal information of anyone under 16.
Sensitive personal information
We collect account login credentials only to let people sign in and connect accounts. We use sensitive personal information only to provide the service, as the CCPA allows, and never to infer characteristics about anyone.
Retention
How long we keep each category is described in How long we keep information.
Children
CarCortex is a service for businesses and is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, email privacy@carcortexai.com and we will delete it.
Changes to this policy
We may update this policy as CarCortex or the law changes. We will post the new version on this page with a new effective date, and tell customers by email about material changes. This version is effective October 4, 2026.
Contact us
For questions or requests about this policy or your personal information, email privacy@carcortexai.com. For anything else, email hello@carcortexai.com.
CarCortex, carcortexai.com