Privacy Policy
This is a plain-language draft. It explains what Locates.io collects, why we collect it, who can see it and what choices you have. The final version may change before it takes effect.
Who we are
Locates.io runs a marketplace where franchised new-vehicle dealers trade units with each other, and Locates.io handles the terms, the agreement, part of the settlement and freight. In this policy, "we" means Locates.io.
Our postal address appears at the bottom of every email we send and will be listed here when this policy takes effect.
What we collect
About your dealership. Name, address, dealer code, rooftops, and the people at the store who use Locates.io.
About your users. Name, work email, phone (if you give it), role, and whether the person can sign agreements.
About your units. Vehicle details, VIN, invoice amount, listing price and status. Invoices you forward or upload are read to fill in your listing.
About your deals. Terms, prices, fees, freight charges, signatures, payment records and delivery records.
About freight. Pickup and delivery details for each load, condition reports, and photos of damage taken at pickup or delivery. These are the only photos on Locates.io.
From the website. If you fill in the contact form or sign up, we keep what you enter: for the contact form, name, dealership, role, work email, phone, rooftops, units per month, brands and your message; for a sign-up, your name, title, email, phone, company and the answers on each step (location, brands, lanes, equipment or volume).
Usage information. See "Product analytics and session recording" below.
Security information. Sign-in events and a salted hash of the IP address used to submit forms, for rate limiting and fraud prevention.
Why we collect it
- To run trades: listings, matching, terms, agreements, settlement and freight.
- To verify that every account belongs to a real franchised dealership.
- To keep a complete, append-only audit trail of every meaningful action.
- To respond to people who contact us.
- To understand how Locates.io is used, so we can improve it.
- To meet legal, tax and accounting obligations.
Who sees what
Other dealers. Until both dealers have signed an agreement, the other dealer never sees your name, address, city, dealer code, VINs or exact distance. They see the vehicle, a freight region, a distance band and an anonymous dealer profile. When both sides have signed, the sealed part of the agreement with both identities and the VINs is released to the two dealers on that deal only.
Each side sees only its own numbers. A buyer sees the buyer side of a deal; a seller sees the seller side.
Carriers see the pickup and delivery details they need to move a load, and no money.
Locates.io staff who run the marketplace can see what they need to operate it, including both sides of a deal.
Service providers that host our systems, send our email or provide product analytics process data on our behalf, under contracts that limit their use of it.
We do not sell your data. There is no dealer-to-dealer messaging, so nothing you send us is passed to another dealer.
Product analytics and session recording
We record product events inside Locates.io, such as "a listing was created" or "an offer was sent," to understand which features are used and where people get stuck. These events are designed not to include VINs, names, addresses, email addresses, exact prices or invoice data; amounts are recorded as ranges, if at all.
We may also use a third-party product analytics service, with session recording, to see how pages are used. When we do:
- Every form input is masked, and fields that show money, VINs or names are masked in recordings. Inside the app, all on-screen text is masked as well, only about half of sessions are recorded, and operator pages are never recorded.
- Users are identified to that service by a hashed ID and an account tier, never by email address.
- On the public website, analytics loads only after you accept analytics cookies.
- Inside the app, each user can turn on "Do not track" in their account settings to stop analytics for their user.
Email and calls
Every email we send includes an unsubscribe link and our postal address. An unsubscribe takes effect immediately.
Marketing email goes only to people who opted in. Submitting the contact form or a sign-up doesn't opt you in unless you tick the box.
Calls. If you ask us to stop calling, we stop cold phone outreach to your store across Locates.io. Trade matches can still reach you in the app or by email, because those are part of the service you signed up for. Saying no to an offer never restricts you in any way.
How long we keep it
We keep account, deal and audit records for as long as your account is open and afterward for as long as we need them for legal, tax and accounting purposes and to resolve disputes. Signed agreements and the audit trail are never edited. Website leads that don't become customers are deleted or anonymized after a reasonable period.
Security
Data is encrypted in transit. Access is limited to people who need it to run the service. Secrets and credentials are kept out of our code. Every meaningful action is written to an append-only audit trail.
Your choices
- Access and correction. Ask us for a copy of your personal information or to correct it.
- Deletion. Ask us to delete personal information we don't need to keep for legal or accounting reasons.
- Email. Unsubscribe from any email at any time.
- Calls. Ask us to stop calling.
- Analytics. Decline analytics cookies on the website, or turn on "Do not track" in your account.
To make a request, use the contact page.
Changes
If we change this policy in a way that matters, we'll tell account holders by email before the change takes effect.