Privacy policy

1. What we collect

• Your account. Your email address, first and last name, mobile number, your dealership’s name and website, and your role in a dealership account, including invitations and requests to join one. Your password is handled by our sign-in provider; we never see it or store it in readable form.
• People a dealership invites. When a dealership administrator invites someone to their team, they give us that person’s name, email address and role, and whether they will post. We use this only to email the invitation and to show it in the dealership’s dashboard. If an invitation isn’t accepted, we delete the person’s name and email address within 30 days after it expires or is withdrawn. An invitation that is never sent, because the dealership’s plan never started, is withdrawn and deleted 30 days after it was made.
• The private beta waitlist. When you join the waitlist on our website, we collect your email address and where you came from, such as the share link or campaign you followed. We work out your dealership from your email address’s domain, and we give you a share link of your own. If you invite a coworker by email, you give us their email address; we use it only to send them one invitation from you, and we keep it so we never send them a second one.
• Your dealership’s inventory. When you connect a dealership website, we collect the vehicle information and photos that the dealership publishes on that public website, such as year, make, model, price, mileage, VIN, stock number and photos. This is information about vehicles, not about you.
• Listings you prepare. The changes you make to a vehicle’s listing, such as price, description and photo choices, the listings you start posting, and the link to each Facebook Marketplace listing you publish from OpenList, with the date you published it. When you click Generate, the vehicle’s details, your name and your writing prompt are sent to OpenAI to write the description.
• Billing. If you subscribe, our payment processor, Stripe, collects your card and billing address. We receive and keep your plan, your subscription status, and Stripe’s customer and subscription identifiers. We never receive your full card number. A dealership account’s plan, seats, invoices and card summary (brand, last four digits and expiry) belong to the dealership, and every administrator of that dealership can see them.
• Technical information. Your IP address and basic request details, such as time, result and a request identifier. We use these to keep the service secure and to limit abuse; they are kept in our hosting providers’ logs. We do not use advertising cookies or trackers, or anything that follows you to other websites. When you use the waitlist page, we count the visit once you scroll, tap or type, and where it came from: which website sent you (its name only, not the full address) or which of our links you used. When you join, we keep the same with your sign-up. On the waitlist page only, we also use PostHog to see how visitors use the page: the pages and buttons used, how far you scroll and how long the page is open, your type of device and browser, your approximate country, and recordings of the page with everything you type hidden. PostHog does not get your email address or your name, and we do not keep your IP address there. We use no cookies or browser storage for any of this. The dashboard keeps your sign-in session in your browser, with the time of your last activity, so you stay signed in until you sign out or go 2 hours without activity. It also remembers one display preference, grid or list view. When you sign in, sign up, recover a password or join the waitlist, Cloudflare Turnstile checks that the request comes from a person; Cloudflare processes your IP address and basic browser information to do this.

3. How we use it

• To provide the service: creating and securing your account, collecting your dealership’s inventory, preparing your listings and filling in the Facebook form.
• To send account and service emails: email confirmations, password resets, dealership invitations, alerts about your inventory and listings, and billing notices.
• To run the private beta waitlist: showing your place in line, emailing you about the beta and when your dealership opens, and sending the invitation you ask us to send a coworker. Every waitlist email has an unsubscribe link, and we stop emailing an address that unsubscribes, bounces or reports spam.
• To manage subscriptions, a dealership’s seats, and posting allowances.
• To keep the service secure, prevent abuse and fix problems.

We do not sell personal information, and we do not use it for advertising.

Text messages. We ask for your mobile number when you sign up so we can text you about your listings, for example when a vehicle you listed sells or its price changes. These texts haven’t started yet. When they do, every text will name OpenList, and you can stop them at any time by replying STOP or turning them off in Settings. We don’t send marketing texts without your separate consent.

Marketing email. We send marketing email only with your consent, and every marketing message includes an unsubscribe link.

5. Where it is stored

Your information is stored and processed in the United States by the providers above. While it is there, it may be accessed by courts and authorities under United States law.

6. How long we keep it

We keep your information while your account is active. When you ask us to delete your account, we delete or anonymize your personal information within 30 days, except billing records, which we keep as long as tax law requires. Vehicle information from a dealership’s public website may be kept for other members of that dealership.

We keep waitlist information, including a coworker’s address you invited, while the private beta waitlist runs, and delete it within 90 days after the waitlist ends unless you have signed up. You can ask us to delete yours sooner by emailing support@tryopenlist.com.

7. Your choices and rights

You can see and correct your name and mobile number in Settings. You can ask us for a copy of your personal information, ask us to correct or delete it, or withdraw your consent, by emailing support@tryopenlist.com. We reply within 30 days. Withdrawing consent may mean we can no longer provide the service.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada. In Quebec, you can also contact the Commission d’accès à l’information.

8. Security

All connections to OpenList are encrypted. Passwords are handled by our sign-in provider, photos are kept in private storage, access to systems is limited to the people who need it, and repeated failed sign-ins are blocked. No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify you and the Privacy Commissioner as the law requires.

9. Children

OpenList is a business tool for adults. It is not directed at anyone under 18.

10. Changes

We will post any changes here and update the effective date. If a change is significant, we will also tell you by email before it takes effect.