Privacy Policy

1. Who we are

CommandLot ("CommandLot," "we," "us," or "our") is a dealership operations platform operated by George Boulos as a sole proprietor, based in Bellingham, Washington, United States. This Privacy Policy explains how we collect, use, store, share, and protect information when you use our website at commandlot.com and our application at app.commandlot.com (together, the "Service").

By using the Service, you agree to the practices described in this policy. If you do not agree, please do not use the Service.

2. Information we collect

Information you provide

• Account information — name, email address, password, dealership name, and role when you create or are invited to an account.
• Content you create — posts, captions, images, videos, schedules, notes, and other content you upload or generate in the Service.
• Communications — messages you send us for support or inquiries.

Information collected automatically

• Usage data — pages viewed, features used, actions taken, and timestamps.
• Device & log data — IP address, browser type, device type, and operating system.

3. Data accessed through Meta and Google

When you connect a third-party account to CommandLot, you authorize us — through that platform's official login and permission screen — to access specific data on your behalf. We only request the access needed to provide features you have chosen to use, and we never receive your third-party passwords.

Meta (Facebook & Instagram)

If you connect a Facebook Page or Instagram Business account, we access data via the Meta Graph API to let you publish and manage content and community interactions. Depending on the permissions you grant, this may include:

• Your Facebook Pages and linked Instagram Business accounts (names, IDs, and profile details).
• The ability to publish posts and read post engagement on your behalf.
• Comments and messages on your Pages and Instagram account, so you can view and respond to them.
• Basic insights and metrics for content you publish.

Our use of information received from the Meta APIs adheres to the Meta Platform Terms and Developer Policies, including limitations on how that data may be used and shared.

Google (Business Profile & Analytics)

If you connect a Google account, we access data via Google APIs to provide reputation and analytics features. Depending on the permissions you grant, this may include:

• Google Business Profile — reading and replying to reviews, and reading or updating your business information.
• Google Analytics (GA4) — read-only access to your website traffic and conversion metrics for reporting.

4. How we use information

• Provide, operate, and maintain the Service and the features you connect.
• Publish and schedule content, and surface engagement, reviews, and analytics you request.
• Authenticate you and keep your account secure.
• Respond to support requests and communicate about the Service.
• Improve, troubleshoot, and develop new features.
• Comply with legal obligations and enforce our Terms of Service.

5. How we share information

We do not sell your personal information. We share information only in these limited circumstances:

• Service providers — trusted vendors who host our infrastructure and databases and process data on our behalf under confidentiality obligations.
• The platforms you connect — when you publish content or reply to a comment or review, that action is sent to the relevant platform (Meta, Google) as you direct.
• Legal reasons — when required by law, subpoena, or to protect the rights, safety, and security of CommandLot, our users, or others.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this policy.

6. Storage, security & retention

Data is stored on managed cloud infrastructure located in the United States. We protect access tokens for connected accounts using strong encryption (AES-256-GCM) at rest, and we transmit data over encrypted connections (TLS).

We retain information for as long as your account is active or as needed to provide the Service. When you disconnect an account or delete your data, we delete the associated access tokens and platform data as described below, except where retention is required by law.

7. Your rights & choices

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, and to object to or restrict certain processing. Residents of California (CCPA/CPRA) and the EU/UK (GDPR) have specific rights, including the right not to be discriminated against for exercising them. To exercise any right, contact us using the details below and we will respond as required by law.

8. Disconnecting & deleting data

You can disconnect any connected account at any time from the Connections page in the app. Disconnecting immediately revokes CommandLot's stored access token and stops any further access to that platform.

• You may also revoke CommandLot's access directly from Meta Business Integrations or your Google Account permissions.
• To request deletion of your CommandLot account and all associated data, email us at boulosg83@gmail.com and we will process the deletion.

9. Children's privacy

The Service is intended for business use and is not directed to individuals under 18. We do not knowingly collect personal information from children.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

11. Contact us

If you have questions about this Privacy Policy or how we handle your data, contact us: