Privacy Policy

AutoPosting Pro (“AutoPosting Pro,” “we,” or “us”) provides dealership-inventory and listing tools through our website and Chrome extension. This policy explains what information the service handles, where it is handled, how it is used, and the choices available to you. Questions or privacy requests can be sent to [email protected].

Information we collect

• Account and dealership information — your name, email address, hashed password, organization and dealership details, membership, settings, and license or subscription status. A phone number is optional and, if provided, is used for account support.
• Demo and business inquiries — when you submit the public request form, we save your name, email, optional phone number, dealership, website, message, the demo or general inquiry choice, and which AutoPosting Pro page opened the form. We use this information to respond to you and show the request in our private admin inbox. We email the request to our founder using Resend. Submitting a request does not create a customer account or subscribe you to marketing email.
• Billing information — Stripe processes payment-card details. We receive and store identifiers and records needed to manage the customer, subscription, plan, and payment status; we do not store full payment-card numbers.
• Vehicle inventory — information published on the dealership website, such as VIN, stock number, year, make, model, trim, price, mileage, colors, description, features, vehicle URLs, photos, and inventory status.
• Marketplace and listing activity — listing status, platform, timestamps, resulting listing links when available, queue state, attempts, errors, renewal or delisting results, and the vehicle associated with an action.
• Marketplace and Messenger information — when you use inbox or reply features, the extension may read bounded conversation information needed for that feature, including buyer display name, listing title, thread identifier, message preview, recent buyer and seller messages, whether a reply is waiting, drafts, reply history, notification state, and recent responder activity. It does not copy your entire Facebook account.
• AI inputs and results — the vehicle facts, dealership instructions, selected photos, scene or removal instructions, and bounded conversation context needed for the AI feature you request, together with generated captions, reply drafts, selector configurations, or edited-image results.
• Usage, support, and security information — login and activity timestamps, device or extension version, IP address received by our servers, feature usage, rate-limit information, scan progress, quality checks, errors, bounded diagnostic evidence, best-effort anonymous public phone/email-link activation counts grouped only by fixed channel and coarse acquisition source, and bounded UTC daily counts for fixed campaign codes registered by AutoPosting Pro.
• Optional Facebook and Instagram business connections — if you separately choose a legacy Meta connection, we receive the Pages, Instagram Business accounts, permissions, and access tokens that you authorize. This connection is optional and separate from the normal signed-in Chrome Marketplace workflow.

How the Chrome Marketplace and Messenger features work

Marketplace actions use the Facebook session that is already signed in to the same Chrome profile as the extension. The extension opens or reads the relevant Marketplace or Messenger pages and performs only the feature you enabled or initiated. The extension does not request Chrome’s cookies permission, does not ask for your Facebook password, and does not send your Facebook password, Facebook cookies, or Facebook session token to AutoPosting Pro’s servers as part of this workflow.

The Messenger reader uses a background connector tab created for AutoPosting Pro, rather than taking over a conversation tab you opened. Inbox monitoring and reply features are controlled separately. If you subscribe to Studio and AI replies are enabled in automatic mode, which is the default for Studio accounts, AI-generated buyer replies may be sent on your behalf through that connector tab without a separate confirmation for each reply. You can instead choose drafts mode, in which each AI reply remains unsent until you review its content and intended recipient and confirm the send, or take over an individual conversation to stop AI replies to that buyer. A first-response template that you write may also be sent automatically when you enable it. Replies you send from the phone remote always require your confirmation.

When an AI reply books a visit, we store the buyer’s Marketplace name, the conversation ID, the vehicle and the appointment time as a lead and an appointment in your account. We also email a calendar invitation with those details and your store’s address to the salesperson whose account booked the visit. The buyer is never emailed.

Sharing a business conversation with your dealership

Dealership message sharing requires each employee’s explicit acceptance. Dealerships require acceptance by default, and their owner or managers can choose optional sharing instead. In required mode, declining or withdrawing acceptance pauses business messaging. In optional mode, employees may decline message-body sharing and continue business messaging; vehicle-performance counts still sync. The employee can review this choice in the extension or the portal’s Business message sharing page.

After acceptance, the extension can refresh encrypted snapshots of vehicle-linked Marketplace business conversations assigned to that employee. Automatic sharing uses the exact conversation and inventory-vehicle linkage stored in the service; personal and unlinked chats are excluded. An employee can also explicitly share a selected conversation linked to a vehicle they posted. Each snapshot contains up to the latest 100 visible messages plus its buyer, listing, employee, and vehicle labels, and remains readable by authorized dealership owners and managers for 30 days after its latest sync. Sharing does not send replies or give managers control of an employee’s Facebook account. Stopping sharing removes that conversation snapshot and excludes it from automatic sharing; withdrawing acceptance removes the employee’s shared snapshots. Changes between required and optional policy require a new decision. Expired snapshots cannot be opened and are removed during subsequent sharing activity. Content-free audit records record sharing, access, and revocation.

Shared dealership photo edits

Requested AI vehicle edits may be saved in private cloud storage for reuse by active members of the same dealership. Saved results are associated with the dealership, inventory vehicle, original photo, and edit settings. A matching saved edit does not require another AI generation or credit. Access uses short-lived download links and current membership checks. New generations use the account’s existing included allowance or explicitly purchased shared credits; enabling sharing does not buy credits automatically. Source photos still go to the image-edit provider when a new generation is requested. Saved cloud edits follow the service retention practices described below and may be retained separately from a local Chrome copy.

A dealership on a plan with AI photo editing may upload up to five of its own background images, such as its lot or showroom. Each image is re-encoded without its photo metadata, stored privately for that dealership, shown only to its signed-in members, and sent to the image-edit provider with the vehicle photo when it is used for an edit. The owner or a manager can remove an image at any time, including after the plan changes or the feature is turned off, from the extension’s AI photo settings or by emailing [email protected]; vehicle photos already edited with it are kept.

How local inventory scanning works

After you grant permission for the dealership website, the extension can read its inventory listing and vehicle-detail pages in your browser. It extracts and normalizes vehicle records, follows same-site vehicle links, checks required fields and photo ownership, and uploads the resulting inventory candidate and quality evidence to AutoPosting Pro. This lets the reader work with sites that require a normal customer browser session.

Page HTML used during a local scan is normally processed in memory. Raw page HTML is not stored in the local scan database. If the service needs to build or repair a dealership-specific reader, the extension may send the rendered listing-page HTML to an authenticated AutoPosting Pro endpoint, subject to a 3 MB request limit. The server reduces that markup before sending a smaller, focused representation to an AI provider. When a reader cannot be built, a bounded reduced page snapshot and diagnostic trail may be retained for support and repair. Normalized vehicle records, page URLs, hashes, progress, and validation evidence may be stored locally and in the service.

AI providers and information sent to them

AutoPosting Pro makes these AI requests from its servers using service-owned credentials; provider API keys are not returned to the extension. Depending on the feature and server configuration:

• Z.AI (GLM) may receive vehicle facts, dealership-provided text or instructions, and requested channel context to generate captions. It may also receive a reduced page representation for reader configuration, or bounded vehicle, playbook, and conversation context for a buyer reply, only when OpenAI is not configured on the server or its account has no remaining credit. A Z.AI error, timeout, or rate limit does not cause a caption request to be sent to OpenAI.
• OpenAI may receive a reduced page representation and requested inventory fields to propose a structured reader configuration, or bounded vehicle, dealership, playbook, and recent-conversation context to write a buyer reply, with gpt-6-luna by default (gpt-5.6-luna for the reader configuration). It may receive the caption inputs described above only when Z.AI is not configured on the server or its account has no remaining balance. An OpenAI error, timeout, or rate limit does not cause a buyer-reply request to be sent to Z.AI. Our OpenAI Responses requests are configured with store: false.
• Black Forest Labs receives the selected vehicle image bytes, the requested backdrop and removal instructions, and a consistency seed to generate an edited image. When a dealership chooses one of its own uploaded background images, that image is sent with the vehicle image as a second reference image. It returns a provider-hosted delivery result that the extension downloads into browser-local storage.
• OpenAI may also receive small, re-encoded copies of a vehicle’s own inventory photos (never their web addresses) to label which ones show the whole vehicle from outside, when a dealership turns on automatic AI backdrops for outside photos. This request is also configured with store: false.

We use AI inputs to provide the requested feature, enforce usage limits, troubleshoot failures, and protect the service. Provider handling and provider-side retention are also governed by each provider’s applicable terms and privacy policy. The OpenAI store: false request setting describes our API configuration; it is not a promise that a provider keeps no security, abuse-prevention, or request metadata or that every provider deletes content immediately. Generated text and images should be reviewed for accuracy before they are used in a public listing. In automatic mode, AI buyer replies are sent without a separate review of each reply.

Remote support, presence, and commands

While the extension is signed in, it may send a bounded presence update so your authorized portal can show that the extension is available. That update can include extension version, demo state, queue state, up to 12 recent activity lines, and up to five pending reply drafts with shortened buyer, listing, question, and draft text. An authorized portal user can request a supported inbox scan or send one specifically approved reply after confirming its exact buyer, listing, and text. The phone remote can display inventory and photos, but Marketplace listing creation remains in Caption Studio on the signed-in Chrome computer so the final description and destinations can be reviewed there. Commands are tied to the same organization, audited, and executed by the extension through its existing browser session. Unclaimed remote commands expire after six hours, although related database and audit records may remain for operations, support, security, and accountability.

Information kept in your browser

The extension uses Chrome local, session, and sync storage and IndexedDB. Browser-local data can include authentication state, non-secret account display information, preferences, vehicle inventory, queue and posting state, captions, photo choices and order, scan jobs and validation records, edited-image bytes, and Marketplace or Messenger drafts, reply history, settings, and summaries. Messenger and Marketplace data is separated by AutoPosting Pro organization and member within the Chrome profile. Older unscoped messaging data is quarantined instead of being exposed to a newly signed-in account.

The extension’s developer inspector is off by default for ordinary customer scans. If enabled, or when an administrator deliberately runs an inspected support scan, it keeps a bounded, credential-scrubbed diagnostic trace in Chrome session storage; that trace is cleared when tracing is turned off and does not survive Chrome closing.

How we use information

We use information to authenticate users, maintain and verify inventory, prepare and manage listings, provide inbox and reply tools, generate requested AI content, meter plan usage, process billing, show progress and results, measure fixed-code arrival checkpoints for our registered campaigns and which acquisition channels produce checkout or public contact-link activations, provide support, diagnose failures, prevent misuse, and secure the service. For campaign arrivals, the normal site client submits only one fixed campaign code after a visible page matches the registered path and four campaign parameters. The server derives source and landing labels from that code. The application table stores only the UTC day, fixed code, and a count bounded at 5,000 per code per day; it has no per-event timestamp, raw URL or UTM value, account, organization, visitor or device identifier, or stored IP address. The request omits cookies and browser referrer. The request IP may be processed transiently into a short-lived HMAC rate-limit key, and ordinary Vercel infrastructure logs still apply outside this application counter. This measurement is separate from our first-touch attribution cookie. A recorded checkpoint means only that the endpoint incremented a registered key’s daily counter. It does not prove that the URL rendered, a link was clicked, a referring site sent the request, or a unique or human visitor, dealership, lead, signup, purchase, or customer exists and cannot be joined to an account. Direct or replayed requests, copied links, reloads, multiple tabs, automation, and previews may count, while blockers, hidden pages, network failures, request limits, and write failures may cause missed records. A count of 5,000 means at least 5,000 recorded submissions because the counter stops increasing at that cap. A public contact-link activation record contains only a fixed phone/email channel and coarse source category; it is not tied to an account, organization, visitor identifier, or stored IP address and does not prove that a call connected, an email was sent, or a qualified lead exists. We do not sell personal information. Unless you opt out (and, in the EEA, UK, Switzerland and Quebec, only if you choose Allow Meta), we use the website and purchase information described below to measure our own Facebook and Instagram ads. We do not use dealership inventory, Marketplace conversations, or Messenger conversations to build advertising profiles.

When we share information

If you explicitly allow Google Analytics in Cookie settings, Google also receives public-website measurement data, pseudonymous analytics identifiers, and standard request information such as IP address and browser/device details. Our tag is limited to allowlisted marketing pages, excluding sign-in, registration, customer/admin dashboards, the extension and free-text tools. Application-controlled events use canonical public paths without query strings or referring URLs, fixed interaction labels, selected plan/billing choices, and coarse acquisition-source categories. They do not send your account identifiers, email addresses, phone numbers, inventory records, typed form values, or Marketplace/Messenger messages.

This optional measurement covers page views, scrolling, public demo engagement, selected button/link activations, pricing choices, FAQs, sections viewed and checkout steps. Approved embedded-video measurement can include the public demo’s title, URL, provider and playback information. Automatic search, form, outbound-link and file-download collection is disabled in favor of application-controlled events. Google Signals, advertising personalization and automatic user-provided data collection are also disabled. A contact or download click does not prove a connected call, sent email or installation; a requested demo does not prove playback; and checkout creation is not payment. This integration does not send a Google purchase or successful-registration event. Google processes analytics data under its own Privacy Policy. You can decline or withdraw permission through Cookie settings without losing access to the service.

Meta ad measurement (on by default; opt out any time; opt-in in the EEA, UK, Switzerland and Quebec). We advertise on Facebook and Instagram, and Meta Platforms receives information so we can see which of our ads lead to sign-ups and paid subscriptions. In the United States and other places outside the European Economic Area, the United Kingdom, Switzerland and Quebec this is on by default and you can opt out at any time: press Opt out in the cookie notice, use Cookie settings → Turn off Meta, the “Your privacy choices” link, or the control under Your privacy choices. If your browser sends a Global Privacy Control signal, we treat it as an opt-out; an Allow Meta you choose while it is on is honored, and one chosen before you turned it on no longer applies. In the EEA, the UK, Switzerland and Quebec, and whenever we cannot determine where a visit comes from (including a visit from Canada whose province we cannot tell), nothing is sent unless you choose Allow Meta. Checkout links opened directly (for example from an email) without a visit to one of our pages in the previous 24 hours are not measured for Meta unless you have chosen Allow Meta. Your choice is saved in a first-party cookie for 400 days. While it is on, the Meta Pixel runs only on our public marketing pages and on the post-checkout welcome page in the browser that started that checkout (never on sign-in, the registration form, customer/admin dashboards, the extension or free-text tools) and sends page addresses including campaign parameters, page views, views of our homepage, ad landing pages and pricing, a Lead (with no form contents) on the thank-you page after you send us a question from our ad landing page, checkout starts with the selected plan, and the purchase amount, currency and plan after a paid checkout, along with your IP address, browser details and Meta’s _fbp/_fbc cookie identifiers. When our server connection to Meta is active and you start checkout, we keep those Meta identifiers, your IP address and browser user agent with your Stripe checkout session, and our server then sends Meta (through its Conversions API) the completed first purchase—or the confirmation of a free account’s email address, or a Lead when you send us a question or choose Continue with Facebook on our ad landing page—with your email address and account ID hashed with SHA-256, those identifiers, the amount actually paid and the plan. A short-lived ap_meta_checkout cookie lets only the browser that started a checkout report its purchase from the welcome page. Renewal payments are not sent. Meta processes the data under its own Privacy Policy and business terms, which can include measuring, delivering and improving our ads and helping us reach people who visited our site. Under California law this can count as “sharing” personal information for cross-context behavioral advertising; opting out stops further sending but cannot recall data Meta already received.

Continue with Facebook. If you choose Continue with Facebook on our ad landing page, Facebook sends us your name, your email address and an app-specific Facebook ID, only with your permission in Facebook’s own dialog. We save your name and email as a request to talk with us (the founder is emailed a copy), then open Stripe checkout with your email filled in. It does not sign you in, we never receive your Facebook password, and nothing is posted to your Facebook. We keep a one-way hash of the Facebook ID only to avoid saving the same request twice.

We disclose information only as needed to operate the service, follow your instructions, protect users and the service, or comply with law. Service providers can include Stripe for billing, Resend for transactional email, Vercel for hosting, Supabase for database services, OpenAI and Z.AI for the AI features described above, Black Forest Labs for requested image edits, and Facebook, Instagram, Marketplace, or Messenger when you direct the extension or service to interact with those platforms. These providers process information under their own applicable terms and privacy policies.

Retention and deletion

We keep cloud account, inventory, listing, usage, support, command, inquiry, and audit records for as long as reasonably needed to provide and secure the service, respond to business requests, maintain accurate business records, resolve disputes, and meet legal obligations. Not every cloud record currently has the same automatic deletion schedule. Public demo and business inquiries, checkout and public contact-link activation audit records currently use this general retention practice and do not have a separate automatic deletion deadline. Registered-campaign daily aggregate rows also follow this general retention practice; the admin report reads a rolling 90-day window, but rows are not automatically deleted solely because they become older than that report window. Unclaimed remote commands expire after six hours, but an expiration is not the same as deletion of the command or its audit trail.

The local inventory scanner automatically prunes eligible completed jobs and cached records after approximately 30 days and also applies count limits; active, resumable, and not-yet-submitted passing work can be kept longer. AI caption cache entries, edited images, and Marketplace or Messenger state can remain in the Chrome profile until they are replaced, deleted through an available extension control, cleared through Chrome, or removed with the extension. The extension includes a control to delete local Marketplace and Messenger data, including account-scoped and quarantined legacy copies. Signing out stops messaging automation and separates the next account’s data, but does not by itself delete every local vehicle, caption, photo, or scan record.

If you used the optional legacy Meta connection, disconnecting it stops future use of the stored Meta authorization and removes the connection data that AutoPosting Pro controls. Platform copies or public posts may also need to be removed through the platform itself.

Security

Passwords are stored as cryptographic hashes. Provider credentials and other server secrets are restricted to server-side systems, and organization checks are used to separate customer records. We use request limits, bounded payloads, validation, and audit records to reduce misuse. Data held inside Chrome is protected by Chrome and your device’s operating-system account; AutoPosting Pro does not separately encrypt every browser-local record. No service or transmission method can be guaranteed completely secure.

Your choices and rights

• You can choose whether to grant the extension access to a dealership website and can remove that site permission in Chrome.
• You can turn off inbox watching, reply automation, posting automation, and developer tracing in the extension.
• You can delete local Marketplace and Messenger data with the extension control, or clear all extension storage through Chrome.
• You can disconnect an optional Facebook or Instagram business connection and manage platform permissions in the relevant platform account.
• You may request access, correction, export, or deletion of personal information by emailing [email protected] from your account email. We may need to verify your identity and may retain limited records when required for legal, accounting, fraud-prevention, security, or dispute-resolution purposes. We will respond as required by applicable law.

Cookies and sign-in

Our website uses essential first-party cookies for sign-in and security. A first-party attribution cookie records how you first arrived so we can understand which channels bring customers to us. The separate registered-campaign arrival checkpoint does not read that cookie; its application payload contains only one fixed campaign code and omits cookies and browser referrer. Google Analytics is a separate opt-in choice and uses first-party analytics cookies with a 30-day expiration; its provider-side retention depends on the Google Analytics property settings. Withdrawing permission disables our integration and clears its accessible analytics cookies, but cannot recall requests already sent or automatically delete previously collected provider data. Existing cookieless Vercel Web Analytics and first-touch attribution remain separate. Meta ad measurement uses Meta’s _fbp/_fbc cookies, an ap_meta_consent cookie that stores an explicit choice and an ap_meta_region cookie that records which rule applies (on by default with an opt-out, or opt-in in the EEA, UK, Switzerland and Quebec); Google Analytics runs with its advertising features disabled. See our Cookie Policy for details. Email-and-password sign-in may use an email verification code; where Google or Apple sign-in is offered, we receive the basic account information needed to identify your AutoPosting Pro account, not your Google or Apple password.

Children

AutoPosting Pro is a business service and is not directed to children under 13. We do not knowingly collect personal information from children under 13.

Changes to this policy

We may update this policy as the product, providers, or legal requirements change. We will post the updated policy here and change the “Last updated” date. Material changes may also be communicated through the service or by email when appropriate.

This policy describes the product’s current technical behavior but is not legal advice. Have qualified counsel review it for the jurisdictions in which you operate.