DealerJet Privacy Policy
Last updated: October 14, 2026
1. Introduction
This Privacy Policy describes how DealerJet, a business registered in the Province of Ontario, Canada ("DealerJet," "we," "us," or "our"), collects, uses, discloses, stores, and protects personal information about you (the "Customer" or "you") when you use our software service (the "Service"), including the web dashboard at app.dealerjet.ca, the DealerJet Chrome extension, and related backend APIs. It also covers the information we receive when someone requests a demo through our website, dealerjet.ca.
DealerJet is committed to protecting your privacy and complying with the Personal Information Protection and Electronic Documents Act (PIPEDA), the federal Canadian privacy law that governs how private-sector organizations handle personal information in the course of commercial activity, as well as applicable provincial privacy laws and regulations where they apply.
This policy supplements, and is incorporated into, our Terms of Service.
2. Who We Are and How to Contact Us
For questions about this policy, your information, or to exercise any of the rights described in Section 11 below, contact our Privacy Officer (details in Section 16).
We will respond to all valid privacy inquiries within thirty (30) days as required by PIPEDA.
3. Information We Collect
3.1 Information You Provide Directly
When you create an account or use the Service, you or your team members may provide:
- Account information: your name, email address, and password, your dealership's name, and the plan you choose. Through onboarding and the Settings page you may also provide your dealership's phone number, street address, city, province, postal code, website, dealer registration (licence) number, and the address of your dealership's AutoTrader.ca or CarGurus dealer page. Some of these business details may be filled in automatically from your public dealer page (see Section 3.3).
- Authentication credentials: your password (stored only as an argon2id hash, the password hashing algorithm recommended by OWASP; we never store your plaintext password) and DealerJet session cookies. The Service does not store Facebook account credentials; the Chrome extension operates within your own signed-in Facebook session in your own browser, and we never receive or retain your Facebook password or any Facebook access token.
- Facebook account identifier: when a person posts a vehicle to Facebook Marketplace through the Chrome extension, we store the numeric Facebook account ID and the public display name of the Facebook profile used to post, and associate them with that person's DealerJet login. We also record the Facebook account ID with each listing posted and in our account event logs. We use this only to (a) attribute each listing to the team member who posted it, (b) make sure the Service manages ads only on the Facebook account that person posts from, and (c) enforce our terms against account sharing (each DealerJet login is tied to one Facebook posting account). We do not access your Facebook friends, messages, timeline, or any other Facebook data beyond what is described in this policy. You can switch to a different Facebook account from the Account page at most once every thirty (30) days (see Section 8.5 of our Terms of Service); contact us if you need it changed sooner.
- Payment information: your card details and your billing name and address are collected and stored by Stripe, our payment processor, on its own pages. We never receive your card number. We store your Stripe customer and subscription identifiers, your plan, subscription status and billing dates, whether a card is on file, and a record of each payment received (amount, currency, and date).
- Settings data: your dealership's settings, the dealership's sales contact name and phone, each team member's own optional sales contact name, phone, and extension (shown in the listings that member posts), warranty and financing text, compliance footer text, perks, and posting preferences (such as posting schedules and the automatic features described in Section 8.4 of our Terms of Service).
- Vehicle information: the vehicle details, history confirmations, and ad text you enter or edit.
- Customer support communications: any email or message you send us.
- Demo requests: if you request a demo through our website, the name, dealership, email address, and phone number you enter.
3.2 Information Collected Automatically
When you use the Service, we automatically collect:
- Activity data: records of what is done in your account, such as imports, posts and their results, ad links saved, Syncs, price updates, settings changes, and errors, with the time each happened. Our servers also keep request logs that record the pages and features requested. We do not use third-party analytics or advertising trackers.
- Security and account event logs: a record of significant account events, such as sign-ins (successful and failed), password resets, email changes, Facebook account binding and switching, plan changes, billing events, account deletion requests, and support-staff access. Each entry records the time and type of the event and related details; for events you trigger, such as signing in, it also records your IP address and browser user agent. Retained as described in Section 9 to support security review, fraud investigation, account recovery, and PIPEDA compliance.
- Device and connection data: IP address, browser user agent, and your time zone (used for your posting schedule). The Chrome extension also sends its version number and a random identifier it creates for your browser, which lets us coordinate work between the browsers on your team.
- Chrome extension activity: while Chrome is open, the extension checks in with DealerJet about once a minute so your dashboard can show that it is running and so it can pick up scheduled work. If an automated step fails, it may send us diagnostic details, such as the address of the page involved and short pieces of text from that page, so we can find and fix the problem.
- Cookies and similar technologies: see Section 10.
3.3 Information from Third-Party Sources
To provide the Service, we collect the following from other sources on your behalf:
- AutoTrader.ca: if your inventory is on AutoTrader.ca, our servers retrieve the vehicle listings published on your dealer page (such as year, make, model, trim, mileage, price, features, photos, description, and title status) and the public details of your dealership shown there (such as name, address, and phone numbers).
- CarGurus (cargurus.ca or cargurus.com): if your inventory is on CarGurus, our servers retrieve the vehicle listings published on your CarGurus dealer page (the same kinds of details, including each vehicle's VIN) and the public details of your dealership shown there. CarGurus does not let our servers read vehicle photo galleries, so the DealerJet Chrome extension, running in your browser or a team member's, opens your dealership's CarGurus pages in a background tab, reads the photos and descriptions of your vehicles, and sends them to us.
- NHTSA vPIC (US National Highway Traffic Safety Administration): publicly available vehicle specification data decoded from vehicle identification numbers (VINs). Only the VIN is sent, and no personal information is involved.
- Facebook: the DealerJet Chrome extension works inside your own signed-in Facebook session in your own browser, and only on Facebook Marketplace pages. It sends us: the Facebook account ID and profile display name described in Section 3.1; the link and ID of each ad posted through DealerJet, and of any ad you link to a vehicle; and, when you press "Sync with Facebook," details of the listings on your own Marketplace Selling page (such as each listing's title, price, listing date, status, and ID, including listings you did not post through DealerJet) together with information read from your ads to confirm which ad belongs to which vehicle (such as the title and mileage shown, and whether the year, make, model, price, and other details match). Section 8.4 of our Terms of Service explains when the extension acts automatically, including scheduled posting and price updates.
We do not collect information about end consumers (the buyers who message you about your listings). Buyer messages flow directly between you and the buyer through Facebook; the extension does not read them, and DealerJet does not access or store them.
3.4 Sensitive Personal Information
We do not knowingly collect sensitive categories of personal information (health, sexual orientation, religious or political beliefs, ethnic origin, etc.) and we ask that you not provide them.
4. How We Use Your Information
We use your personal information for the following purposes, each of which is supported by a recognized legal basis under PIPEDA (consent, performance of contract, or legitimate business purposes):
| Purpose | Examples |
|---|---|
| Provide the Service | Authenticate sign-ins, show your dashboard, import your inventory (when you ask and on the nightly schedule), generate marketplace descriptions, fill in and publish your Facebook listings, keep track of your ads, and update their prices when that feature is on |
| Bill and process payments | Charge subscription fees, send invoices and billing notices, manage billing disputes |
| Communicate with you | Send transactional emails (email verification, password resets, trial and billing notices, team invitations, account and Service notices), respond to support requests and demo requests |
| Improve the Service | Analyze how features are used, identify and fix bugs, build new features |
| Security and abuse prevention | Detect and respond to unauthorized access, account sharing, fraudulent activity, and Service abuse |
| Compliance with law | Respond to lawful subpoenas, court orders, regulatory requests, or PIPEDA access requests |
We will not use your information for materially new purposes without your consent.
5. Marketing Communications
We may send you product update emails, feature announcements, or promotional offers about DealerJet. We send these only if you opt in (for example, with the optional checkbox at signup), and they comply with Canada's Anti-Spam Legislation (CASL):
- Every marketing email includes an unsubscribe link.
- We honour unsubscribe requests promptly, and in any case within ten (10) business days.
- We identify the sender and provide contact information in every message.
You may opt out of marketing emails at any time. Operational and legally required communications (such as billing notices, security alerts, or notices of changes to our Terms) are not marketing and continue while you maintain an active account.
6. How We Share Information
We do not sell, rent, or trade your personal information. We share it only in the limited circumstances described below.
6.1 Service Providers (Sub-Processors)
We rely on the following third parties to operate the Service. Each processes information under its own terms and privacy commitments, and we share with each only what it needs to provide its service:
| Provider | Purpose | Location of Data |
|---|---|---|
| Stripe | Payment processing (card collection via Stripe Checkout, ongoing billing via the Stripe Customer Portal) | United States; Stripe is PCI-DSS certified |
| Render | Application hosting, database (PostgreSQL), server logs, and database backups | United States |
| Cloudflare | Domain name (DNS) services for dealerjet.ca, hosting of our public website, and Cloudflare Email Routing (which forwards mail sent to @dealerjet.ca addresses to our support inbox) | Global network |
| Resend | Outbound email delivery (email verification, password resets, billing and account notices, team invitations, and forwarding demo requests to us) | United States |
| Sentry | Error monitoring for our servers (technical reports about requests and jobs that fail) | United States |
Two other services receive limited technical information:
- Our dashboard pages load a styling library from Tailwind's public content delivery network (cdn.tailwindcss.com). As with any site your browser loads a file from, that network receives technical details such as your IP address and browser type.
- When someone requests a demo through our website, we send the IP address of that request to ip-api.com, an IP location service, to look up an approximate city and province.
This list is current as of the Last updated date. We may add or change providers in the future and will update this policy accordingly.
6.2 Third-Party Platforms You Authorize
When a vehicle is posted to Facebook Marketplace through the Chrome extension, the listing data (vehicle details, photos, description, and price) flows from our backend, through your browser, to Facebook. Facebook becomes the controller of that data once posted. Facebook's privacy practices are governed by Facebook's own policy, not ours.
6.3 Legal and Safety Disclosures
We may disclose your information when we have a good-faith belief that disclosure is necessary to:
- Comply with a lawful subpoena, court order, or governmental request.
- Enforce our Terms of Service.
- Protect the rights, property, or safety of DealerJet, our users, or the public.
- Investigate fraud, security issues, or abuse.
We will notify you of any legal request for your data unless prohibited from doing so by law.
6.4 Business Transfers
If DealerJet undergoes a merger, acquisition, financing, or sale of all or part of its business, your information may be transferred to the acquiring entity, subject to the protections of this policy. We will notify you of any such transfer and your options.
7. Where Your Information Is Stored (International Transfers)
Some of our service providers (including Stripe, Render, Resend, and Sentry) operate primarily in the United States. As a result, your personal information may be processed in or transferred to the United States.
We acknowledge that:
- Once your data is in another country, it is subject to that country's laws, including possible access by foreign government authorities under those laws.
- We use providers that maintain industry-standard security and, where possible, contractual safeguards to protect transferred data.
- You consent to these international transfers by using the Service.
If you are uncomfortable with international transfers, do not use the Service.
8. How We Protect Your Information
We use commercially reasonable administrative, technical, and physical safeguards to protect personal information against unauthorized access, disclosure, alteration, or destruction:
- Encryption in transit: all communication between your browser and our servers uses TLS (HTTPS), and our sign-in cookie is marked Secure and HttpOnly.
- Encryption at rest: our database and its backups are stored encrypted at rest by our hosting provider.
- Access controls: access to production systems is limited to authorized DealerJet personnel.
- Password storage: passwords are hashed using argon2id; we never store plaintext passwords.
- Logging and monitoring: sign-ins, account changes, and staff access are logged; unusual activity is investigated.
- Service providers: we use established providers and share with each only what it needs.
No system is perfectly secure. If you become aware of a security incident affecting your account, contact our Privacy Officer immediately.
8.1 Support Staff Access to Your Account
To help you when you request support, DealerJet support staff may need to access your account and view your data as you see it. When this happens:
- Access is limited to authorized DealerJet staff and is used only to diagnose and resolve the issue you have raised or a system problem affecting your account.
- Every staff access session is recorded in an audit log with the staff member's identity, the account accessed, and the time. These records are kept even if your account is later deleted.
- Support sessions are read-only by default; a staff member must take a deliberate, separately logged step to make any change on your behalf, and each change made is logged.
- Staff will not change your billing or delete your account through a support session. Deleting an account also requires the owner's password, which staff do not have.
- The staff member sees a clear on-screen notice while the session is active, and the session ends automatically after thirty (30) minutes.
You may ask us for a record of any staff access to your account at any time by contacting our Privacy Officer.
8.2 Data Breach Notification and Recordkeeping
In the event of a security breach involving your personal information, we assess whether it creates a real risk of significant harm (RROSH), the standard under PIPEDA. If it does, we will:
- Notify affected individuals as soon as feasible, describing the breach, the information involved, the steps we have taken, and what you can do to protect yourself.
- Report the breach to the Office of the Privacy Commissioner of Canada (OPC) as required by PIPEDA's mandatory breach notification rules, and notify any other organization or government institution that could reduce the risk of harm.
As required by PIPEDA, we maintain a record of every breach of security safeguards, whether or not it meets the RROSH threshold, and retain those records for at least 24 months. The OPC may request access to these records. Our internal breach-response procedure is documented separately for our operations team.
9. How Long We Keep Your Information
We keep your personal information only as long as necessary for the purposes for which it was collected, or as required by law:
| Data Type | Retention |
|---|---|
| Account and Customer Data | Kept while your account exists, including after a cancellation, so you can resubscribe and pick up where you left off. When the dealership owner deletes the account (Section 11.3), it is permanently deleted on the scheduled date. You can also ask us to delete it at any time. |
| Team member logins | Deleted when the dealership owner removes that person from the team, or when the account is deleted. |
| Security and account event logs (audit logs) | Kept while your account exists, for security review, fraud investigation, account recovery, and PIPEDA compliance, and deleted with the account. Records of support-staff access to your account, and a minimal record that the account existed and was deleted (business name, plan, and sign-up and deletion dates), are kept after deletion as accountability records. |
| Billing records | Kept by Stripe and in our own payment records, including after your account is deleted, for at least as long as Canadian tax law requires. |
| Server logs and error reports | Kept for a limited period under the retention settings of our hosting and error-monitoring providers. |
| Marketing email opt-outs | Kept as long as your account exists, so we keep honouring your choice. |
| Database backups | Deleted data can remain in our hosting provider's database backups until those backups expire. |
| Demo requests | Kept in our email inbox so we can follow up on the request. Our server logs record the dealership name and a partly hidden form of the email address, not your name or phone number, and keep them only for those logs' limited retention period. |
You may request earlier deletion as described in Section 11.
10. Cookies and Similar Technologies
Our full Cookie Policy lists every cookie the Service sets and why. We use the cookies needed to keep you signed in and secure, plus one that remembers how you sorted your inventory list. We use no advertising cookies, no cross-site tracking, and no analytics cookies, so we do not show a cookie banner. If we ever introduce advertising, analytics, or tracking cookies, we will ask for your consent first.
The cookies the Service sets are:
| Cookie | Purpose | Type | Lifetime |
|---|---|---|---|
dj_session |
Authentication session; identifies your signed-in account | Strictly necessary | 90 days after you last use DealerJet; removed when you sign out |
dj_csrf |
Cross-Site Request Forgery defense (double-submit token) | Strictly necessary | 90 days, extended while you are signed in and using DealerJet; replaced with a new one when you sign in or sign out |
dj_inv_sort |
Remembers the sort order you chose for your inventory list: the sort option's name with the ID numbers of your login and your dealership. Your choice is also saved with your account, so it follows you to every device | Preference | 1 year |
dj_imper |
Set only in a DealerJet staff member's browser during an audit-logged support session on your account (see Section 8.1); never set in your browser | Strictly necessary (staff only) | 30 minutes |
Using DealerJet includes the DealerJet Chrome extension: while Chrome
is open and you are signed in, its regular check-ins (Section 3.2)
count as use for dj_session and dj_csrf.
The dashboard also stores a few display preferences in your browser's own storage (for example, which sections you have folded). These stay in your browser and are not used to track you.
The DealerJet Chrome extension uses Chrome's extension storage
(chrome.storage.local and chrome.storage.session) to keep its
settings and working state on your device. That stored data stays on
your device; the extension sends us only the information described
in Section 3, as needed to carry out the actions described in
Section 8.4 of our Terms of Service.
We do not use third-party advertising cookies and do not participate in cross-site advertising tracking.
You can disable cookies in your browser settings, but doing so will prevent you from signing in to the Service.
11. Your Rights
Under PIPEDA, you have the following rights with respect to your personal information. Depending on your province of residence, you may have additional rights under provincial privacy law.
11.1 Right to Access
You may request a copy of the personal information we hold about you. We will respond within thirty (30) days at no cost (unless the request is unreasonable, in which case we may charge a reasonable fee with prior notice).
11.2 Right to Correct
If you believe information we hold is inaccurate, you may request correction. You can update most account fields directly on the Settings and Account pages; for other data, contact our Privacy Officer.
11.3 Right to Delete (Withdraw Consent)
You may withdraw consent for our use of your personal information at any time, subject to legal or contractual restrictions. In practice, this means deleting your account or your information:
- The dealership owner can delete the account from the Account page by re-entering their password and confirming. The subscription is cancelled so you are not charged again, and the account and its data are permanently deleted seven (7) days later, or at the end of the period you have already paid for if that is later. Until then you keep full access, and the owner can cancel the deletion.
- The dealership owner can remove a team member from the team, which deletes that person's login.
- You can also ask our Privacy Officer to delete your information.
Some data is kept after deletion as described in Section 9 (for example, billing records for tax purposes).
11.4 Right to Data Portability
You may request an export of your Customer Data in a structured, machine-readable format (JSON or CSV, your choice at the time of request). We prepare exports on request and will respond within thirty (30) days.
11.5 Right to Complain
If you believe we have not handled your information appropriately, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (30 Victoria Street, Gatineau, Quebec K1A 1H3; toll-free 1-800-282-1376; https://www.priv.gc.ca).
We encourage you to contact us first so we can attempt to resolve the issue directly.
11.6 How to Exercise Your Rights
Contact our Privacy Officer at the email address in Section 2. We may need to verify your identity before fulfilling certain requests (typically, a recent sign-in from your account email or a brief identity-verification exchange).
12. Children's Privacy
The Service is intended for licensed motor vehicle dealers and is not directed to children. We do not knowingly collect personal information from individuals under 18. If you believe a minor has provided us information, contact our Privacy Officer and we will delete it.
13. Automated Decision-Making and AI
Marketplace descriptions are generated by our own software from your vehicle data and saved settings, using built-in templates and rules. Where the Service labels this feature "AI," it refers to this built-in generator. No external AI service receives your data. If we add features that use an outside AI provider in the future, we will name the provider in the sub-processor table above and update this policy first.
This is assistive automation: every generated description can be reviewed and edited in the Service before it is posted. If Auto-publish or scheduled posting is on, listings are published without a further review step, under settings you control (see Sections 7.1 and 8.4 of our Terms of Service).
Some account decisions follow fixed rules that are applied automatically and are described in our Terms of Service, such as refusing signups from disposable email addresses (§4.5), pausing access when a payment fails (§5.4), and Founding Member eligibility and forfeiture (§5.1). We do not use profiling or AI to make decisions about you, and you can contact our Privacy Officer to ask for a person to review any such decision.
14. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will post the updated policy on this page with a new "Last updated" date. If a change is material, we will also tell you about it by email or in the Service. Your continued use of the Service after an update is posted means you accept the updated policy. If you do not agree to an update, you must stop using the Service and cancel your subscription.
If a change requires fresh consent under PIPEDA (e.g., a new purpose for using your data), we will obtain that consent explicitly before applying the change to you.
15. Provincial Variations
Some Canadian provinces have privacy legislation that overlaps with or supplements PIPEDA:
- Quebec: Loi sur la protection des renseignements personnels dans le secteur privé (Quebec's private sector privacy law, recently amended by Law 25, also known as Bill 64). If you are a Quebec resident or your dealership operates in Quebec, additional rights and obligations may apply, including expanded data subject rights and mandatory privacy impact assessments for certain activities.
- British Columbia and Alberta: PIPA (Personal Information Protection Act), which applies to provincially regulated organizations in those provinces.
- Other provinces: PIPEDA generally applies.
This policy is intended to comply with PIPEDA as the federal baseline. Where provincial law grants greater rights, those greater rights apply.
16. Contact
For all privacy-related inquiries, complaints, or requests, email the DealerJet Privacy Officer at info@dealerjet.ca. The same address handles general support.