Privacy Policy

Account and authentication information. When you create an AutoLens account or sign in (from the extension or the web app), we collect your name, email address, dealership name, and password. Passwords are transmitted over HTTPS and stored only as salted bcrypt hashes — we never store or log plaintext passwords. If you choose “Sign in with Google”, we receive your name, email address and Google account identifier from Google instead of a password. After sign-in, a session token and your basic profile (name, email, dealership, and the contact phone number you provided, if any) are stored locally in the extension via Chrome’s storage API so you stay signed in.

Dealership team members. When an owner or manager invites a colleague, we collect that person’s name, email address and role, and send them an invitation email. A salesperson may be given their own text-messaging number. If a dealership or salesperson connects a Google or Microsoft calendar, we store an encrypted access grant and read only busy/free times.

Billing. Payment details are entered directly with Stripe. We receive your subscription status, plan and invoice records, never your full card number.

Vehicle listing data (website content). When you activate the extension on an inventory webpage, AutoLens reads the visible vehicle listing details from that page: title, year, make, model, trim, VIN (if shown), price, mileage, description text, image URLs, and the dealership name, address, and contact details shown on the page. Extracted listings are held locally in the extension and, when you sign in or click sync/post, are also sent to your AutoLens account on our servers so your inventory is available in the AutoLens web dashboard. A dealership may instead connect an inventory feed from its dealer management system, which AutoLens retrieves directly. AutoLens stores links to vehicle photos, not copies of them; photos are fetched only when you post a listing. Vehicle photos can show licence plates or people — please review photos before posting them publicly.

Facebook Marketplace listing statistics. If you use the extension to post listings, it periodically reads the performance statistics of your own Marketplace listings (views, saves, shares, message counts) and your seller account’s summary statistics from your own Facebook seller pages, in your own Facebook session, and sends them to your AutoLens account so the dashboard can show how your listings are performing. To keep each Facebook account’s daily posting limit and to match posts to listings, it also records the numeric identifier of the Facebook account that published each listing and the listing’s Marketplace identifier. It does not read your Facebook messages, friends, feed, or any other Facebook content.

Information about vehicle shoppers (processed for dealerships). When someone texts a dealership’s AutoLens number, chats on a dealership’s AutoLens inventory page, or is entered by dealership staff, AutoLens stores, on the dealership’s behalf: their name, phone number and email address (when given), the messages exchanged, the vehicle they asked about, appointments, any trade-in details they describe, notes and tags added by staff, an automated priority score, their messaging consent and opt-out records, their preferred language, and — for dealerships in Brazil — the CPF and address details the dealership records. Shoppers receive a link to a notice describing this, and can use our data request form.

Security information. To protect accounts and detect abuse, we record the first part of the IP address and the browser type for each signed-in session, and IP addresses in a security log for events such as failed sign-ins and data-request activity.

Locally stored data. The extension stores listing drafts, the posting queue, user preferences (for example price markup, default location), the session token, and sync timestamps locally in the browser via the Chrome storage API.

Cookies and browser storage. The web app and our website use the following:

Chrome Web Store data-type categories. In the categories used by the Chrome Web Store’s privacy disclosures, the extension collects: personally identifiable information (name, email address, dealership name, and contact phone number you provide), authentication information (your password at sign-in, which is never stored in plaintext, and the resulting session token), and website content (the vehicle listing details you choose to extract, and the aggregate statistics of your own Facebook Marketplace listings).

Information we do not collect. The extension does not collect or transmit your web browsing history, the content of pages where you have not activated it (other than the Facebook pages described above), keystrokes, mouse movements, health information, precise geolocation, or payment card numbers (payments are handled by Stripe in the web app). The extension contains no third-party advertising, analytics, or tracking SDKs.

We use the information described above only to provide and protect AutoLens:

• Authenticate you and keep you signed in to your AutoLens account.
• Populate listing drafts you can review and edit inside the extension.
• Generate AI listing descriptions you request (see Section 3).
• Pre-fill Facebook Marketplace’s listing form when you initiate a post, including appending your chosen contact phone number to the description.
• Sync your extracted inventory and your listings’ Marketplace performance statistics to your AutoLens account so they appear in your dashboard.
• For dealerships using the inbox: receive and send text and chat messages, reply to shoppers with the AI Responder, book appointments, and organize leads — on the dealership’s instructions and in line with its messaging-consent settings.
• Bill subscriptions and send account, billing and security emails.
• Provide support, maintain security, and prevent abuse of the service.

AutoLens does not use collected data for advertising, audience building, user profiling, behavioral targeting, credit decisions, or any purpose unrelated to providing the service. We do not sell personal information and we do not use your data, or shoppers’ data, to train machine-learning models. The Chrome extension’s single purpose is turning your dealership inventory into Facebook Marketplace listings and tracking them.

AutoLens uses AI models provided by Anthropic. Anthropic processes this information to return a result and does not use it to train its models.

• Listing descriptions. Vehicle details are sent to write a description, which you can edit before posting.
• AI Responder. When a shopper texts or chats with a dealership, the AI may reply automatically or, depending on the dealership’s settings, draft a reply for staff to approve. It uses the shopper’s first name, the recent messages of that conversation, and the dealership’s settings and inventory. The first automated text in a conversation says it comes from the dealership’s virtual assistant, the web chat says so on screen, and the AI never claims to be a person. A shopper can ask for a person at any time.
• Automated organizing. The AI may tag an enquiry, give it a priority score, move it to an early pipeline stage, propose or book a visit, or hand the conversation to staff. These help staff decide what to do; no decision with a legal or similarly significant effect on a shopper is made by automated means alone, and dealership staff can review and change all of it.
• Safety. If a message suggests someone may be thinking about suicide or self-harm, or about harming someone else, automated replies stop for that person, a short message with crisis-line information is sent, and dealership staff are alerted to follow up personally.
• Staff tools. AI drafts follow-up messages and estimates vehicle values (using public web search results) when staff ask. AutoLens does not process photos with AI.

On your device. Drafts, the posting queue, preferences, and your session token are stored locally via Chrome’s storage.local API, which is isolated to the extension and not accessible to websites. They persist until you sign out, clear them, or uninstall the extension.

On our servers. Your account profile, inventory, listing statistics and dealership conversations are stored in the AutoLens database, hosted on Railway in the United States. All communication between the extension, the web app, and our API uses HTTPS/TLS encryption in transit. Section 5 lists every service provider and where it is located.

How long we keep it. Information is kept while it is needed to provide the service, and is deleted or anonymized automatically on this schedule:

Messaging opt-out (“STOP”) records are kept for as long as needed to honour the opt-out, because deleting one would allow messages to resume. Billing records held by Stripe are kept as required for tax and accounting.

Deleting data. Deleting a lead in the dashboard deletes the shopper’s record, conversations and messages, removes their details from our audit log, cancels any appointment AutoLens added to a connected calendar, and asks our Canadian text-messaging provider (Twilio) to delete its copy of the messages. An owner can close the whole account in Settings → Billing: the subscription is cancelled immediately, everyone is signed out, and the account and all of its data are permanently deleted 30 days later (so a mistaken closure can be reversed by contacting us in that time). Listings you published to Facebook stay on Facebook until you remove them there. Locally stored extension data is removed when you uninstall the extension.

We do not sell, rent, or trade user data. We never transfer user data to advertisers, ad networks, data brokers, or resellers, and we never use or transfer it to serve personalized, re-targeted, or interest-based advertising, or to determine creditworthiness or for lending purposes.

User-initiated transfers to Facebook. When you choose to publish a listing to Facebook Marketplace, the listing content you have reviewed (vehicle details, photos, description, contact number) is submitted to facebook.com through your own Facebook session. This transfer happens only when you initiate a post and is subject to Meta’s Privacy Policy.

Service providers (sub-processors). We share data with the following providers only as needed to operate AutoLens, under agreements that restrict their use of the data to providing services to us:

Outside Canada. Most of these providers store or process information outside Canada, mainly in the United States. While it is there, it is protected by our agreements with them but may be accessible to the courts, law-enforcement and national-security authorities of that country.

Legal compliance. We may disclose information if required to do so by law, subpoena, or other legal process, and only to the extent required.

Business transfers. If AutoLens is acquired, merged, or its assets transferred, user data may be transferred as part of that transaction. This Privacy Policy will continue to apply, and we will provide notice before user data becomes subject to a different privacy policy.

On the public pages of autolenstudios.com (our marketing site — not the signed-in dashboard, and not the Chrome extension) we use Google Ads conversion tracking and, where enabled, Google Analytics to understand whether our advertising leads people to request a demo or start a subscription. This places Google cookies in your browser and tells Google which of our marketing pages you visited, the identifier of the ad you clicked, and standard browser and device information. When you submit our demo form or complete a signup, we tell Google only that a conversion happened — we never send Google your name, email address, phone number, or any account or customer data. The tag is not loaded for visitors in Brazil.

Product analytics. On the same public pages we use HeyCatch to understand how visitors move through the site — which pages they view, which buttons they click, and which campaign or link brought them. HeyCatch stores a random visitor identifier in your browser; it is never told your name, email address, phone number, or any account or customer data, it does not record your screen or keystrokes, and it stops at the dashboard sign-in. Web addresses are stripped of everything except campaign parameters before they are sent. The same Brazil exclusion, privacy signals, and opt-out below apply.

Demo requests. When you ask for a demo we store what you enter in the form (name, work email, dealership, and any optional details) together with the campaign that brought you to our site (for example utm_source / utm_campaign and the ad click identifier), so we can follow up and know which campaigns work. Demo requests are deleted automatically after 12 months.

Your choices. We honour your browser’s Global Privacy Control and Do Not Track signals — when either is on, the Google tag does not load and HeyCatch sends nothing. You can also opt this browser out below, and manage Google’s own ad settings at adssettings.google.com. Opting out never affects your ability to use AutoLens.

All traffic between the extension, the web app, and our API is encrypted in transit with HTTPS/TLS. Passwords are stored only as salted bcrypt hashes, and connection credentials for calendars and other services are encrypted at rest. Access to production data is restricted to authorized AutoLens personnel, and every state-changing operation on our servers is recorded in an audit log. Local extension storage is protected by the browser’s built-in isolation between extensions and websites. Keep Chrome and the AutoLens extension up to date to receive security patches.

To detect a stolen sign-in, each signed-in session records the general network it was opened from (the first part of the IP address only, never the full address) and the browser type and operating system (never the full browser identifier). If both change at once, we ask you to confirm your password before sensitive actions. This information is kept only for the life of the session and is deleted when you sign out, change your password, or the session expires (at most 90 days).

If you use AutoLens. You can, at any time:

• Sign out of the extension, which removes your session token from the device.
• Clear all AutoLens-stored local data through Chrome’s extension management page (chrome://extensions) or by uninstalling the extension.
• Review and delete synced listings and leads from your AutoLens dashboard.
• Cancel your subscription yourself in Settings → Billing, or close your account there (owners) to have it and all of its data deleted as described in Section 4.
• Request a copy of your data, correction of inaccurate data, or deletion by contacting us at the address in the “Contact” section. We respond within 30 days.
• Disable individual host-website access from the extension’s permissions screen in Chrome.

If you contacted a dealership. You can ask the dealership for a copy of your information or for it to be deleted, or use our data request form — we send a one-time code to your phone or email to confirm it is you. Reply STOP to any text to stop messages from that dealership.

These controls implement the rights of access, correction, deletion, and objection under applicable privacy laws, including Canada’s PIPEDA, Alberta’s PIPA, Quebec’s Law 25, the GDPR, the UK GDPR, and the CCPA/CPRA. If you are not satisfied with our response you may complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.

The AutoLens — Website to Marketplace extension uses the following Chrome permissions:

AutoLens’s use and transfer of information received through the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Specifically:

• We only use data to provide or improve the extension’s single, user-facing purpose.
• We only transfer data as necessary to provide that purpose (to the service providers listed above), to comply with applicable law, to protect against abuse, or as part of a merger or acquisition with prior notice.
• We do not use or transfer data for serving advertisements.
• We do not use or transfer data to determine creditworthiness or for lending purposes.
• We do not allow humans to read user data unless we have your affirmative agreement, it is necessary for security or support purposes, it is required to comply with applicable law, or the data is aggregated and used for internal operations.

AutoLens is intended for use by adults working with dealership inventory. It is not directed to children under 13, and we do not knowingly collect data from children. If you believe a child has used the extension and you wish to raise a concern, contact us using the details below.

We may update this Privacy Policy from time to time to reflect changes to the extension, the service, applicable law, or industry guidance. When we make a material change, we will update the “Effective date” above and, where appropriate, surface a notice inside the extension or the web app. Continued use after an update constitutes acceptance of the revised policy.

If you have questions about this privacy policy, or want to exercise any of the rights described above, contact:

Privacy Officer, AutoLens LTD
support@autolenstudios.com