Effective Date: July 1, 2026

DealerRock, LLC (“DealerRock,” “we,” “us,” or “our”) provides a cloud-based dealership management platform and related websites, applications, integrations, support, and professional services. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you visit dealerrock.com (the “Website”), use the DealerRock platform, communicate with us, or otherwise interact with our services (collectively, the “Services”).

This Privacy Policy applies to DealerRock’s own privacy practices. It does not replace the privacy notices or legal obligations of dealerships and other businesses that use DealerRock. When a dealership uses DealerRock to manage information about its customers, prospects, employees, inventory, transactions, or operations, the dealership determines why that information is collected and how it is used. DealerRock generally processes that information on the dealership’s behalf and according to its instructions.

1. Our Role and the Dealership’s Role

For information that a dealership or other subscribing business submits to or processes through DealerRock (“Customer Data”), the dealership is generally the business or organization responsible for the information, and DealerRock acts as its service provider or processor.

For information DealerRock collects for its own website, account administration, billing, sales, support, security, and business operations, DealerRock is responsible for determining how that information is used.

Dealerships are responsible for:

Providing any privacy notices required for their customers, employees, and users;
Having an appropriate legal basis or consent to collect and use Customer Data;
Obtaining and maintaining any consent required for email, SMS, marketing, or other customer communications;
Honoring opt-out, unsubscribe, and privacy requests relating to communications or records they control; and
Using DealerRock in compliance with applicable privacy, consumer protection, marketing, and communications laws.

2. Information We Collect

2.1 Website and Business Contact Information

When you visit our Website, request a demonstration, contact sales or support, submit a job application, register for information, or otherwise communicate with us, we may collect:

Name, business email address, phone number, employer, job title, and dealership location;
Information included in forms, emails, attachments, support requests, and other communications;
Demo, sales, implementation, and customer-success notes;
Job application materials and related communications; and
Information about how you heard about DealerRock or your interest in our Services.

Website form submissions may be stored in our WordPress hosting environment, sent by email to authorized DealerRock personnel, and entered into HubSpot when we use HubSpot for lead management.

2.2 DealerRock Account and User Information

When a dealership creates or administers a DealerRock account, we may collect:

User names, work email addresses, phone numbers, job titles, dealership locations, and account roles;
Login, authentication, account status, and permission information;
Support, training, implementation, and customer-success communications;
User activity, audit history, and records of actions taken within the platform; and
Device, browser, IP address, session, error, and security information.

2.3 Customer Data Processed Through the Platform

Depending on the dealership’s use of DealerRock, Customer Data may include:

Customer and prospect names, mailing addresses, email addresses, and phone numbers;
Lead records, communications, notes, quotes, deposits, deals, invoices, transaction history, and account activity;
Boat, recreational vehicle, and other unit information, including VINs, HINs, serial numbers, registration details, ownership records, options, pricing, and inventory history;
Work orders, estimates, service history, technician activity, warranty records, parts purchases, receiving records, and inventory information;
SMS message content, timestamps, participants, delivery information, and replies;
Underlying business data used to generate transactional emails and notifications;
Documents, images, attachments, electronic approvals, electronic signatures, and related audit information;
Payment status, payment method, transaction status, and related accounting or reconciliation information; and
User activity, access logs, audit trails, and security records.

2.4 Dealership Website Widgets and Messaging Tools

DealerRock provides website widgets, messaging tools, forms, and other communication features that Dealerships may make available through their websites or other digital properties.

When an individual submits information through a DealerRock-powered website widget or messaging tool, DealerRock may collect and process that information on behalf of the applicable Dealership.

Information collected through these features may include:

Name;
Mobile telephone number;
Email address;
Message or inquiry content;
Product, inventory, service, or other information associated with the inquiry;
Communication history and replies;
Date and time of the request;
SMS consent and opt-out status;
The method, source, and date through which consent was provided;
The disclosure or consent language presented when consent was provided;
Delivery, response, and messaging status information;
Website or page from which the request originated;
IP address, browser, device, and related technical information; and
Other information the individual chooses to provide.

DealerRock generally processes information collected through these tools as a service provider or processor on behalf of the applicable Dealership. The Dealership determines the purpose of the communication and how it will respond to or otherwise use the information, subject to applicable law.

Information submitted through a DealerRock-powered widget may be added to or associated with an existing customer, prospect, lead, service, transaction, or communication record within the DealerRock platform.

DealerRock may use third-party telecommunications and infrastructure providers, including Twilio, to transmit and manage SMS or MMS communications.

The Dealership is responsible for providing any additional privacy notice required for its own use of the information and for obtaining any consent required for communications it initiates through DealerRock.

DealerRock does not sell or rent mobile telephone numbers, SMS opt-in information, or messaging consent records to third parties for their own marketing purposes. DealerRock does not transfer an individual’s messaging consent from one Dealership to another DealerRock customer.

Individuals may withdraw consent to receive text messages by following the opt-out instructions provided in the applicable messages, including by replying STOP where supported. Questions concerning an inquiry or communication with a particular Dealership should generally be directed to that Dealership.

2.5 Payment Information

Stripe processes DealerRock subscription billing and ACH payments. Ecrypt / Preferred Payments supports payment processing integrations used by dealerships through the DealerRock platform.

DealerRock does not store full payment-card numbers, CVV values, or full bank-account numbers. DealerRock may retain payment tokens, the last four digits of an account or card, payment method, transaction status, payment status, invoice history, and related reconciliation information.

Payment processors may collect and process additional information under their own privacy notices, contractual terms, and legal obligations.

2.6 Authentication Information

DealerRock supports third-party authentication through Google Workspace and Microsoft 365. When you use one of these services to sign in, DealerRock receives the account and authentication information necessary to verify your identity and create or access your DealerRock session.

DealerRock does not use this authentication connection to access the contents of your email, contacts, calendars, files, or other Google Workspace or Microsoft 365 content.

We automatically collect certain technical information when you use the Website or platform, including:

IP address, browser type, device type, operating system, and approximate location derived from IP address;
Pages viewed, referring pages, links clicked, session activity, and feature usage;
Login, authentication, cookie, and session identifiers;
Application performance, diagnostics, errors, request timing, and security events; and
Other information collected through Google Analytics, Google reCAPTCHA, Microsoft Azure Application Insights, application cookies, and similar technologies.

2.8 Sensitive Information

DealerRock is not designed to collect and does not intentionally request Social Security numbers, Social Insurance numbers, full government identification numbers, driver’s license images, passport information, consumer credit application data, biometric information, health information, or precise geolocation data.

Dealerships and users should not upload sensitive information that is unnecessary for use of the Services or that DealerRock has not expressly agreed to process. If sensitive information is included in documents, attachments, notes, or other Customer Data, the dealership remains responsible for ensuring that it is collected and submitted lawfully.

3. How We Use Information

DealerRock may use personal information to:

Provide, operate, configure, maintain, and support the Services;
Create and administer dealership accounts and user access;
Authenticate users and protect account security;
Process subscription billing, payments, invoices, and account records;
Perform implementation, data conversion, training, troubleshooting, and customer support;
Transmit SMS messages, transactional emails, notifications, integrations, and other communications requested by a dealership;
Monitor availability, performance, errors, usage, and security;
Prevent fraud, misuse, unauthorized access, and other harmful activity;
Respond to inquiries, demo requests, support requests, and privacy requests;
Manage sales opportunities and customer relationships;
Improve existing features and develop new features using aggregated or de-identified information;
Comply with legal, regulatory, contractual, accounting, and tax obligations;
Establish, exercise, or defend legal claims; and
Carry out other purposes disclosed at the time information is collected or authorized by the applicable dealership or individual.

4. Dealership Communications Through DealerRock

DealerRock provides tools that dealerships may use to send SMS messages, transactional emails, invoices, service updates, notifications, and other communications. The dealership, not DealerRock, determines the recipients, content, timing, and purpose of those communications.

The dealership is responsible for obtaining and maintaining any legally required consent, providing required disclosures, and honoring opt-out or unsubscribe requests. Individuals with questions about a message sent by a dealership should contact that dealership directly.

5. Cookies, Analytics, and Similar Technologies

DealerRock uses cookies and similar technologies for login, authentication, session management, preferences, platform functionality, security, analytics, performance monitoring, and troubleshooting.

The Website currently uses Google Analytics and Google reCAPTCHA. The DealerRock application uses Microsoft Azure Application Insights and application cookies. These tools may collect technical, device, browser, IP address, usage, performance, and security information.

DealerRock does not currently provide a cookie preference banner on the Website. Google Analytics and reCAPTCHA may load when you visit the Website. Most browsers allow you to block, delete, or limit cookies through browser settings. Blocking certain cookies may affect Website or platform functionality.

DealerRock does not sell personal information or use Customer Data for third-party targeted advertising. We may introduce additional analytics, advertising, or remarketing technologies in the future. Before making a material change to our data practices, we will update this Privacy Policy and provide any notice or choices required by applicable law.

6. Google and Microsoft Authentication

DealerRock uses Google Workspace and Microsoft 365 only to support authentication and sign-in. We use the minimum information necessary to authenticate the user and maintain the DealerRock account and session.

DealerRock’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. How We Disclose Information

DealerRock may disclose personal information to the following categories of recipients when reasonably necessary to operate the Services:

Cloud hosting and infrastructure providers, including Microsoft Azure;
Payment and billing providers, including Stripe and Ecrypt / Preferred Payments;
SMS and email delivery providers, including Twilio and SendGrid;
Authentication providers, including Google and Microsoft;
Website, analytics, security, and lead-management providers, including SiteGround, WordPress, Google Analytics, Google reCAPTCHA, Microsoft Azure Application Insights, and HubSpot;
Customer-directed integrations, including QuickBooks Online, AppOne, manufacturer-data providers, inventory-feed providers, and other integrations enabled by or for the dealership;
Authorized DealerRock personnel, who may access information only as needed for implementation, data conversion, support, troubleshooting, security, administration, or other authorized business purposes;
Professional advisers, including attorneys, accountants, auditors, insurers, and security or compliance advisers;
Government authorities or other parties, when required by law, legal process, or a valid governmental request, or when reasonably necessary to protect rights, safety, property, or security; and
Parties to a corporate transaction, such as a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, subject to appropriate confidentiality protections.

Service providers may access personal information only as reasonably necessary to perform services for DealerRock or the applicable dealership and are expected to handle information under applicable contractual and legal obligations.

Current information about key subprocessors may also be available through DealerRock’s Trust Center.

8. No Sale of Personal Information

DealerRock does not sell, rent, license, or disclose personal information to data brokers, advertisers, or other third parties for their own marketing purposes. DealerRock also does not share personal information for cross-context behavioral advertising as those terms are defined under applicable U.S. state privacy laws.

9. Artificial Intelligence and Machine Learning

DealerRock does not currently use Customer Data, dealership customer information, SMS content, documents, attachments, support conversations, or other Customer Data to train general-purpose artificial intelligence or machine-learning models.

If DealerRock materially changes this practice, we will update this Privacy Policy before the new practice begins and will obtain any rights, authorization, or consent required by applicable law or contract.

10. Aggregated and De-Identified Information

DealerRock may aggregate or de-identify information so that it cannot reasonably be associated with a specific individual or dealership. We may use this information to analyze usage, measure performance, improve the Services, develop features, conduct security analysis, and support business planning.

DealerRock will not attempt to re-identify properly de-identified information except as permitted by law to test or validate de-identification methods.

11. Data Location and Cross-Border Processing

DealerRock serves customers in the United States and Canada. DealerRock’s production platform and application data are hosted in Microsoft Azure data centers located in the United States.

If you are located in Canada, your personal information may be transferred to, stored in, and processed in the United States. Information processed in another country may be subject to that country’s laws and may be accessible to courts, law-enforcement agencies, or governmental authorities under lawful process.

DealerRock uses contractual, technical, and organizational measures designed to protect information when it is processed by service providers or across borders.

12. Security

DealerRock maintains administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, and disclosure. These safeguards include, as appropriate:

Encryption in transit and at rest;
Role-based access controls and unique user accounts;
Permission-controlled access for authorized DealerRock personnel;
Logging, monitoring, and audit trails;
Cloud backup and recovery controls;
Vendor and subprocessor management;
Security testing and vulnerability-management practices; and
Incident-response and business-continuity procedures.

No system, transmission method, or storage environment can guarantee absolute security. Customers and users are responsible for protecting their credentials, limiting user access appropriately, and notifying DealerRock promptly of suspected unauthorized activity.

13. Data Retention

DealerRock retains personal information for as long as reasonably necessary for the purposes described in this Privacy Policy, to provide the Services, comply with customer instructions, satisfy legal and accounting obligations, resolve disputes, enforce agreements, and protect security.

Customer application data: Following termination of a dealership account, active application data is generally retained for 60 days unless the dealership directs DealerRock otherwise or a longer period is required for legal, security, billing, dispute-resolution, or contractual purposes.
Azure SQL backups: Database backups are generally retained for 30 days. Customer Data is not individually purged from an existing backup when a dealership leaves, but it expires as backups rotate out under the applicable retention schedule.
Application, security, and diagnostic logs: These records are generally retained for up to one year, subject to operational, security, legal, and technical requirements.
Website forms, demo requests, and job applications: These records may be retained until manually deleted or until DealerRock completes a valid deletion request, unless longer retention is required by law or for legitimate business purposes.
Billing and payment records: Stripe, DealerRock, and other payment providers may retain billing, transaction, tax, fraud-prevention, dispute, and accounting records for periods required by law or reasonably necessary for those purposes.
SMS and transactional communication records: SMS content and related records stored in DealerRock are retained as Customer Data. For transactional emails, DealerRock stores the underlying business data used to generate the communication, while SendGrid may store templates and delivery information under its applicable retention practices.

When retention is no longer reasonably necessary, DealerRock may delete, anonymize, or de-identify the information, subject to legal obligations and routine backup cycles.

14. Privacy Rights and Requests

14.1 Requests Concerning Dealership-Controlled Records

If your request concerns information maintained by a dealership in DealerRock—such as a customer record, lead, transaction, work order, service history, message, or unit record—please contact the dealership directly. The dealership is responsible for evaluating and responding to requests concerning the records it controls.

DealerRock will assist the dealership with a verified request when required by law, contract, or the dealership’s instructions.

14.2 Requests Concerning DealerRock’s Own Records

For requests concerning DealerRock’s Website, account, billing, sales, support, or other business records, contact privacy@dealerrock.com.

Depending on your location and applicable law, you may have the right to:

Request access to personal information;
Request correction of inaccurate information;
Request deletion of certain information;
Request a portable copy of certain information;
Withdraw consent where processing is based on consent, subject to legal and contractual limitations;
Object to or request restriction of certain processing;
Opt out of the sale or sharing of personal information, targeted advertising, or certain profiling where applicable; and
Appeal a decision or complain to an applicable privacy regulator.

DealerRock does not sell personal information or share it for third-party targeted advertising. We will not discriminate against an individual for exercising a privacy right provided by applicable law.

We may need to verify your identity, authority, residency, or relationship to the applicable dealership before completing a request. We may deny or limit a request where permitted by law, including when we cannot verify the requester, the information is subject to a legal exception, or DealerRock processes the information only on behalf of a dealership.

An authorized agent may submit a request where permitted by law, but DealerRock may require proof of authorization and may separately verify the individual’s identity.

15. Email and Marketing Choices

DealerRock does not currently use dealership Customer Data for DealerRock’s own marketing. If DealerRock sends its own marketing emails in the future, those messages will include an applicable unsubscribe mechanism. Transactional, security, billing, account, and service communications may still be sent when necessary to provide the Services.

For marketing or SMS communications sent by a dealership through DealerRock, contact the dealership directly to manage your preferences or opt out.

16. Children’s Privacy

The Services are designed for dealerships, businesses, and their authorized users and are not directed to children under 13. DealerRock does not knowingly collect personal information directly from children under 13.

If you believe a child under 13 has provided personal information directly to DealerRock, contact privacy@dealerrock.com. We will review the request and take appropriate action.

17. Third-Party Services and Links

The Services may contain links to or integrations with third-party websites, applications, payment providers, accounting systems, financing platforms, manufacturers, data providers, and other services. Those third parties may collect and process information under their own privacy policies and terms.

DealerRock is not responsible for the independent privacy practices of third parties that are not acting as DealerRock’s service providers.

18. Changes to This Privacy Policy

DealerRock may update this Privacy Policy to reflect changes in the Services, technology, legal requirements, vendors, or data practices. When we make changes, we will update the effective date at the top of this page.

If a change materially affects how we use personal information, we will provide additional notice when required by applicable law or contract. Continued use of the Services after an updated policy becomes effective is subject to the applicable agreement and law.

19. Contact Us

Questions, privacy requests, and privacy complaints may be directed to:

DealerRock, LLC
25 Town Center Blvd., Suite 104
Crestview Hills, KY 41017
United States
Email: privacy@dealerrock.com

If your request concerns information controlled by a dealership, please contact the dealership first and identify the dealership, record, transaction, or communication involved.

Privacy Policy