Privacy Policy

1. Our Role

For data a dealership submits to run its operations (deals, leads, employee and performance data, and customer contact and deal information), the dealership is the controller of that data and Commissioned 41 acts as its processor — we handle that data to provide the Service on the dealership’s behalf. For account, billing, and marketing information, Commissioned 41 is the controller.

2. Information We Collect

• Account information — name, email, role, and login credentials.
• Dealership operational data — deals, leads, inventory, goals, and team data, including employee names, performance metrics, and compensation figures entered into the Service.
• Customer information entered by the dealership — such as names, contact details, vehicle and trade information, and deal/finance details used to complete transactions.
• Usage and device data — log data, device and browser information, and how the Service is used, to keep it secure and reliable.

3. How We Use Information

We use information to provide, secure, maintain, and improve the Service; to authenticate users and enforce permissions; to generate reports and AI-assisted features; to provide support; to process payments; and to comply with legal obligations. We do not sell personal information.

4. AI Processing

When you use AI-assisted features, the content and relevant dealership information needed for your request may be sent to third-party AI services. These include OpenAI, directly or through Vercel AI Gateway; Google models may be used through configured Gateway fallback routing. Document scanning and some other AI features use Anthropic when enabled and configured; Anthropic may also be enabled as an assistant fallback. The provider used depends on the feature and service configuration. Submitted content is processed to generate responses, extract document fields, or support assistant memory.

Assistant notes may be retained with dealership records to support continuity. General coaching lessons may also be retained in EILA’s shared playbook across Commissioned 41 products; the playbook is intended for general lessons rather than identifiable customer records. Do not submit information you are not authorized to process through these features.

Scanning can involve both AI extraction and document storage. License and insurance images attached to a lead, and sorted jacket PDFs filed with a deal, are retained as described below; saving extracted fields does not mean that the original file is never stored.

5. How We Share Information

We share information with service providers (subprocessors) that help us operate the Service under confidentiality and data-protection obligations: hosting and delivery (Vercel), database and authentication (Supabase), AI processing and routing (OpenAI, Anthropic, Vercel AI Gateway, and Google when used by configured Gateway routing), payment processing (Stripe), voice synthesis for the assistant (ElevenLabs), text-message delivery (Twilio), and email delivery (Resend). We may also disclose information to comply with law, enforce our Terms, protect rights and safety, or in connection with a merger or acquisition. We do not sell your data.

6. Data Retention

We retain Customer Data for as long as the account is active or as needed to provide the Service, and afterward as required for legal, accounting, or legitimate business purposes. A dealership may request export or deletion of its Customer Data as described below.

Document retention depends on the feature. Images attached to leads and filed deal-jacket PDFs are held in private Supabase storage, with access restricted by dealership and record permissions. Filed jacket PDFs have a 90-day retention window. The default cleanup window for on-file license and insurance images is 180 days, but service configuration may set a different window. Files are eligible for scheduled cleanup after their applicable window; deletion can be delayed if cleanup does not complete. Retained extracted fields and assistant notes follow the Customer Data retention described above. Contact your dealership or privacy@commissioned41.com about the applicable document window or an export or deletion request.

7. Security

We use technical and organizational measures to protect information, including encryption in transit and at rest, access controls, tenant isolation between dealerships, and role-based permissions. Because dealership deal records can include consumer financial information covered by the Gramm-Leach-Bliley Act, we maintain a written information security program consistent with the FTC Safeguards Rule expectations for service providers, and will support our dealership customers’ own Safeguards obligations. No system is perfectly secure, but we work to safeguard data and to limit access to those who need it to operate the Service.

8. Your Rights and Choices

Depending on your location, you or your dealership may have rights to access, correct, export, or delete personal information. Because dealerships control the data they submit, individuals (such as employees or customers) should direct requests to their dealership, which we will support as processor. You may contact us using the details below.

9. Children

The Service is intended for businesses and is not directed to children under 18. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Policy from time to time. Material changes will be posted here with an updated date and, where appropriate, communicated to you.

11. Contact

Commissioned 41, LLC · Georgia, USA · privacy@commissioned41.com