1. Information We Collect
To provide high-efficiency automotive studio services, CarDealerStudio collects:
- Account Credentials: Work email address, dealership name, company website, and display plate preferences when you register via Google OAuth or email sign-in;
- Customer Media: Vehicle photographs, lot shots, and digital assets you upload to the studio workbench;
- Billing Information: Payment transactions are handled directly through our PCI-DSS Level 1 certified billing partner, PayPal (PayPal Holdings, Inc.). CarDealerStudio never stores raw credit card numbers or CVC codes on our servers;
- Technical Logs: IP address, browser user-agent, operating system, and generation response latency for abuse prevention and service monitoring.
2. Processing of Vehicle Photographs & AI Inference
When you upload photos to CarDealerStudio:
- Strict Purpose Limitation: Your images are sent to our image-processing providers to generate indoor showroom photos and, when enabled, locate plate areas for branded dealer plates;
- Zero Public Disclosure: Photos are not indexed in public galleries, search engine crawlers, or shared with third-party automotive aggregators without your express action;
- Processing Purpose: We use uploads to fulfill your photo requests, not to train our own models. Image-processing providers handle data under their applicable service terms.
3. Zero Data Reselling Guarantee
Unlike legacy automotive syndication portals that monetize dealer data, CarDealerStudio does not sell, lease, or broker your dealership data, vehicle photos, or contact information under any circumstance. Our business model is 100% transparent SaaS software subscriptions and booster packs.
4. Third-Party Sub-Processors
We work exclusively with audited, industry-leading infrastructure providers:
- PayPal, Inc. (USA): Payment checkout, order settlement, and secure credit/debit card processing. PCI-DSS Level 1 certified;
- Cloudflare, Inc. (USA): Global CDN acceleration, DNS management, and edge DDoS protection;
- Supabase, Inc. (USA): Cloud database infrastructure and encrypted authentication management;
- Fal.ai (USA): Serverless visual diffusion processing and GPU inference.
5. Data Retention & Ephemeral Storage
Generated photos are stored temporarily for up to 24 hours. Download the photos you want to keep before they are removed from the server.
Generated photos older than 24 hours are automatically removed from server storage. Account profile settings remain saved until you request account closure. Payment and credit-ledger records and operational backups are retained as needed for billing, dispute handling, and recovery.
6. European GDPR Compliance & Your Rights
For users operating in the European Economic Area (EEA) and United Kingdom, you possess statutory rights under the General Data Protection Regulation (Regulation (EU) 2016/679):
- Right of Access (Art. 15): Request a copy of personal information we maintain regarding your account;
- Right to Rectification (Art. 16): Correct inaccurate dealer or business information;
- Right to Erasure / "To Be Forgotten" (Art. 17): Request the permanent deletion of your account and all associated imagery;
- Right to Restrict Processing (Art. 18): Restrict the processing of your data under specific conditions.
7. California Consumer Privacy Act (CCPA/CPRA)
California residents possess specific rights under the CCPA/CPRA. CarDealerStudio certifies:
- We do not "sell" personal information as defined by California law;
- We do not "share" personal information for cross-context behavioral advertising;
- You may exercise your right to know or delete data by contacting our compliance office without discriminatory pricing.
8. Cookies & Local Browser Storage
CarDealerStudio uses essential cookies and browser localStorage strictly for authentication persistence, session management, remembering your selected showroom preset and branded dealer plate styling, and enforcing the free trial. An essential HttpOnly cookie identifies the trial; server-side trial usage is limited to 3 photos, with an additional 3-photo limit per network address over 24 hours. Network addresses used for this trial limit are stored as keyed hashes. We do not deploy intrusive third-party cross-site advertising trackers.
9. Security Safeguards
We implement industry-standard 256-bit TLS/SSL encryption for all data in transit between your browser and our API endpoints. Internal infrastructure is protected by Cloudflare WAF, role-based database access (Postgres RLS), and API key segregation.
10. Contact Our Data Protection Officer
To exercise your privacy rights, request data erasure, or submit inquiries, contact our Data Protection Officer:
- Operator & Data Controller: Xia Heqi (doing business as CarDealerStudio)
- Official Website: https://cardealerstudio.com
- Privacy Inquiries: [email protected]
- Response SLA: We review privacy requests and respond according to applicable requirements.