LEVELSDEALER OS

LEVELS DEALER OS · LEGAL

Privacy Policy

Last updated October 29, 2026

This policy explains what personal information Levels Dealer OS collects, how we use it, who receives it, and the choices you have. It is written in plain English on purpose. Where a feature is optional, not yet switched on, or does less than it will later, we say so. It describes the product as it is built today, and we update it when the product changes.

For dealership customers: the short version

If you contacted, bought from, financed with, or consigned a vehicle to a dealership that uses Levels, here is what matters most.

1. Who we are and what this policy covers

Levels Dealer OS is a software platform for independent used-car dealerships. We call the platform "Levels Dealer OS" or simply "Levels".

This policy covers personal information handled through:

This policy does not cover the dealership's own practices outside our software. Each dealership is a separate business with its own privacy notice. Each dealer website we host also shows a short privacy page and a text-messaging page for that dealership. Those pages describe the dealership's program in short form. They incorporate this policy for everything Levels does with your information, and if the two ever differ, this policy governs Levels' practices. This policy also does not cover third-party sites you reach by clicking a link, such as CARFAX, AutoCheck, or Google Maps, or the ChatGPT product itself.

2. Who this policy is about

We handle information about five groups of people:

  1. Dealership staff. Owners, managers, salespeople, lot and service staff who use Levels. The dealership is our subscriber.
  2. Dealership customers. People a dealership deals with: shoppers, leads, buyers, borrowers, co-buyers, finance applicants, consignors, test drivers, and job applicants — and the people a buyer or an applicant names as a personal reference or as their landlord. Dealerships enter this information, import it, or collect it through the websites and links we host.
  3. Website visitors. Anyone who browses a dealer website we host, even without submitting a form.
  4. AI-assistant shoppers. People who use an AI assistant such as ChatGPT to search a participating dealership's inventory through our connector.
  5. Prospective dealerships and people who contact Levels. Dealership businesses we market to (including dealerships whose websites a Levels dealership tracks in Market Watch) and dealerships whose public listing pages Levels itself reads, as Section 10.10 describes, businesses whose website is read in our check of a candidate website (Section 10.10), people who join a waitlist, and people who register a Levels account.

3. Dealerships are in charge of their customers' data; Levels is their service provider

The dealership decides. A dealership decides what to collect from its customers, which features to turn on, which outside systems to connect, and how long to keep records. Under privacy laws, the dealership is the "business" or "controller" for its customers' information. Levels is the dealership's "service provider" or "processor".

What that means for us. We process dealership customer information only to run the software the dealership has chosen to use. We follow the dealership's instructions. We do not combine one dealership's customer records with another's. We do not use dealership customer information for our own marketing. We do not sell it.

What that means for the dealership. The dealership is responsible for giving its customers any notices and getting any consents the law requires. That includes credit-authorization language, text-message consent, call-recording notices, and permission to publish a customer's photo. Levels builds consent steps into the software where we can, but the dealership is responsible for using them correctly.

Where Levels acts on its own behalf. We are the controller of information about dealership staff accounts, dealership billing, platform security and audit logs, aggregate product usage, our own marketing to dealerships (including the Market Watch site records described in Section 4), our own reading of prospective dealerships' public listing pages (Section 10.10), our check of a candidate website (Section 10.10), the shopper profiles created through our AI shopping layer (Section 7), and our own part in the credit-check notice described in Section 9.1.

4. Information we collect from dealerships and their staff

Account information. Full name, work email, phone number, role (owner, manager, sales, lot, service), department, and a password we store only as a one-way hash. The dealership's owner may assign each staff member a credit-data access level, and each staff member sets their own 4-digit deal-vault PIN, which is stored as a hash.

Business information. Dealership name, street address, lot addresses and map coordinates, phone numbers, website, timezone, business hours, dealer license number, sales-tax registration numbers, and, for text-messaging registration with carriers, the legal business name, EIN, business type, and an authorized representative's name, email, and phone.

Connections to other services. If a dealership connects QuickBooks Online, a credit-report provider, a Google Business Profile, Craigslist, a DMS lead-import address, or Keys.app, or its CarGurus statistics, we store the credentials or tokens needed to use that connection. If a dealership enters its own lenders, we store each lender's name, program rules, and submission email address. If a dealership uploads a lender's rate sheet, we store that PDF privately for that dealership, together with the lender details and rates taken from it, which the dealership checks and saves: the lienholder and contact addresses, the lienholder identification code, named contacts at the lender, the states it lends in, the credit score model it uses, and its rate tables, rate adjustments, term and loan-to-value limits, fees, and dealer compensation. A rate sheet is a business document between a dealership and a lender and holds no consumer information. QuickBooks, credit-provider, and Google tokens and CarGurus credentials are encrypted at rest.

Activity and audit records. We record who did what inside the platform. For sensitive actions we also record the IP address and browser type. Examples include viewing a credit report, revealing a full SSN or license number, printing a full SSN on a credit application, changing a vehicle price, signing a document, exporting tax records, and accepting a locksmith agreement. Staff who clock in and out share their phone's location at that moment so the dealership can see whether the punch happened on the lot.

Device diagnostics. When the in-app license or VIN scanner fails to read a barcode, it may send the failed image and device details (camera resolution, browser type, app version) to a diagnostics area on our own servers that only the dealership's owners and managers can open. Diagnostic images are deleted after 30 days.

The receipts line. A dealership can set aside one of its phone numbers for its staff to text photos of receipts and of vehicles' emissions test reports. We keep each such text in that dealership's records: the phone number it came from, its words, the photo, what our own server read from the photo, and what the line answered. A text from a number the dealership does not know is kept the same way, up to a limit, and waits for an owner or manager to accept or deny it.

Billing. Plan tier, billing cycle, trial dates, and promo code. Subscription fees and prepaid bundles are charged to a payment card the dealership keeps on file with Stripe, our payment processor. Card details are entered on Stripe's own pages and go directly to Stripe under Stripe's privacy policy; Levels stores only the card brand, last four digits, and expiration to show the dealership, plus Stripe's customer, subscription, and invoice references. The dealership chooses auto-pay (charged on the due date) or an emailed invoice. Stripe emails receipts and invoices to the dealership's billing email. If a dealership signs up through another dealership's referral link, or with a referral code from a card someone gave it, we record which dealership or person referred it, to apply the referral's credits and pay any referral fee; for a person who refers dealerships for a fee we keep their name, phone, email, code, and the fees owed and paid.

How we record where a prospective dealership's details came from. For each business detail we hold about a dealership we are not yet working with — its name, phone, email, website, address, or licence number — we also record where that particular value came from, when we last saw it, and how many times we have seen it. Sources include a state's published licence list (with the batch and date), a list an operator imported, the dealership's own public website, an edit a Levels operator made, a correction the dealership itself made to its profile, and, for a website address, a lookup by Levels, described below. We keep the earlier values as well as the current one, so a business can be told not only what we hold but where it came from. We also work out and store a location key (state, ZIP, house number, and street) so that two records of the same physical lot can be recognised as one, and we look up map coordinates and the county for each prospective dealership's business address using the US Census Bureau's geocoder, to which we send the house number and street, city, state, and ZIP code and nothing else about the business; a result that falls outside the state the licence names is discarded rather than stored, a result whose ZIP code differs from the one we hold is set aside for a person to check rather than placed on the map, and with each lookup we record the address the geocoder matched, or that it found none. Levels staff see these records on an internal map, which is not shown to dealerships or to the public. The same internal map shows Levels staff where each Levels dealership's stores are and whether its subscription is active, in trial, or lapsed. Where a value was corrected by the dealership or entered by a person, later automatic observations do not overwrite it — they are recorded as a disagreement for a person to review.

Prospective dealerships. Levels markets to dealership businesses. We obtain business contact details (dealership name, phone, email, website, address, license number) from public dealer directories and similar sources. We may text, email, or message these businesses from Levels' own number and email address. We log the outreach and whether a demo link was opened. Replying STOP to Levels' own number stops our texts. Every marketing email we send a dealership carries Levels' mailing address and a one-click unsubscribe link; using it stops Levels' outreach email to that address, including for any other dealer license listed under the same address. A business marked do-not-contact is not contacted by text, call, or email. An opt-out is recorded against the contact detail itself, not against one record, so it covers every license we hold that shares that number or address.

Finding a prospective dealership's website. Many licence lists give no website, so we may look for one. Candidate addresses come from open business-listing data published by the Overture Maps Foundation (its places data, from sources it publishes under the CDLA Permissive 2.0, Apache 2.0 or CC0 1.0 licence), matched to our records on our own computers (none of our records is sent to anyone for this), from a website column in a list an operator imported, and from addresses Levels looked up with a web search and checked against the phone number or street address we hold; a Levels operator authorises each save of an address found by that search. Levels reads a candidate website from the open data or the imported list itself (Section 10.10) and saves the address without a person only when the site's home page, or a contact, about, location, directions or hours page it links to, shows — in the page's text, not in scripts, comments or parts marked hidden — the phone number we hold for that business together with its street address, a distinguishing word of its name, or cars for sale, or its street address and ZIP code together with distinguishing words of its name (a word of the name in the site's own web address counts too). Anything less certain is not saved by the check: a Levels operator may approve an address the check confirmed, and otherwise enters a website only as their own edit; pages on the directory, marketplace, review and social sites we list are not saved. Until a person at Levels has looked at an address saved this way, we show that business no logo, listings or figures from the site, take no contact details from it, and send no report about it. We also record, with the reason, whether a licensed dealer is a car dealership (judged from its name, the open data's category, what the candidate website lists or what a website we looked up sells, or decided by a Levels operator) and save a website only for one.

Market Watch site records. We also learn about dealership businesses through Market Watch. We keep the same kind of record when Levels itself reads a prospective dealership's website (Section 10.10). When a dealership using Levels adds another dealership's website to Market Watch, we may keep a record of that business: its public website address, which also serves as the record's name, and the public inventory information Market Watch collects from that website, such as the vehicles listed, when they appear on and leave the site, and their price changes. From each tracking dealership's own Market Watch entry we use only the website address it added, when it started tracking and whether it still does, and the name it typed, which we use only to recognize a Levels dealership's own website and do not store in the record. We use a dealership's Market Watch entries this way only once this change applies to that dealership, as the change notice at the top of this policy describes. We do not use the tracking dealership's customers, leads, deals, messages, or other records for this. If we already hold a record with the same website, such as a record from a state dealer license list, we add the site to that record; if the website is a Levels dealership's own site, or the name typed for it is a Levels dealership's name, we note only that it belongs to that dealership. We keep no record for a page on a shared website, such as a Facebook page or a Craigslist search. We may contact the business about Levels as described above. Levels staff can see internally which Levels dealerships track a website and since when. We never tell a tracked dealership which Levels dealerships track it. A text, email, in-app message, or support-desk reply that Levels staff send through our HQ tools is refused if it names a Levels dealership that tracks or has tracked that business's website, or gives that dealership's web address, whether it is sent to the record that holds the website or to another record or support contact that is, or may be, the same business. These are records about businesses, not information about consumers. When a dealership stops tracking a website, we keep the record and stop counting that dealership as tracking it.

Business contact details read from those websites. For a business we hold a record for, we also read the business contact details that its own website publishes, as Section 10.10 describes: business names, business phone numbers with the department and extension each is listed under, business email addresses, street addresses and coordinates, opening hours, the business's own social profile links and logo, any dealer licence number printed on a page, and other web addresses for the same business. We record where each detail was published and when, and we keep the details we decided not to use together with the reason. Staff and team pages are excluded and are not fetched, and we do not collect information about named individuals from these sites. Where one website describes more than one location, we keep a separate record for each location and note that they share a website; we do not combine them into one business. A contact detail read from a website is not verified and is not permission to contact anyone: the rules in Sections 5 and 7 still decide whether we may call or text a business.

A preview for a prospective dealership. We may show a prospective dealership a preview of how its website could look on Levels. Levels makes the page; it is labelled as a preview by Levels, shows only that dealership's own name, logo and public listings, is not published or offered to search engines, and opens only with the link we give that dealership. The preview is an illustration — not the dealership's website and not an offer of particular terms. It links to the dealership's Levels guest page; anyone the link is passed to can open these pages. The link stops working after 90 days, and at once if the dealership asks us to stop or becomes a customer. The page itself carries a control that tells Levels to stop reading the dealership's website and to delete what the preview was made from; Section 12 says what is deleted. A website address typed into the guest page is a request: we go on reading the website we already hold for that dealership until a Levels operator confirms the new one.

A report for a prospective dealership. We may send a prospective dealership a report about its own website: by email — after a calendar month ends, or when a Levels representative sends one covering the days we have read its website so far — or as a link a representative gives it. The email is plain text, says in its first line that it is an advertisement from Levels, carries a link to the report page, Levels' mailing address and a one-click unsubscribe link, and uses no click or open tracking. We send it to an email address on that dealership's record: from a list we imported, its own website, a Levels representative, or typed into its Levels guest page and released by a Levels representative. We send one email per address for each report, even when several dealer licences share the address, and never more than one marketing email to an address in seven days. Levels makes the report page; its figures are worked out by fixed rules and do not change once the report has been sent or its link given out. It shows that dealership's own name, city and logo; counts from the days we read its website, such as the listings we read, the listings we first recorded or no longer read, and the lower listed prices we read; a description of Levels features; a link to the preview described above; and a button that opens the dealership's Levels guest page. Where we read no listings, it carries the preview only. The page is unlisted: it is not offered to search engines, and anyone holding the link can open it. When the link is opened in a browser we keep the time it was first opened and a count of openings; pressing the claim button is noted on the dealership's record; a stop request is kept with its time, IP address and browser type. The link stops working after 90 days, or sooner if we stop reading the website, the website we hold changes, we withdraw the link, or the dealership asks us to stop or becomes a customer. The page carries the same stop-and-delete control as the preview. The unsubscribe link stops our outreach email to that address and, within about an hour, our reading of that dealership's website.

Support access by Levels staff. Authorized Levels employees can enter a dealership's workspace to provide support. Inside, they see what the dealership's owner sees, including customer records. Every support entry is limited to one hour, is written to a permanent audit log, and shows a visible "HQ support session" banner in the app.

5. Information dealerships collect about their customers through Levels

The dealership chooses which of these features to use. This section describes what each feature collects.

Contact and lead information. Name, phone, email, the vehicle you asked about, your message, a preferred appointment time, the amount you offer if you send the dealership an offer on a vehicle, and how you found the site (search terms, campaign, referring site). Leads also arrive from marketplaces the dealership advertises on, such as CARFAX, CarGurus, AutoTrader, Cars.com, Edmunds, TrueCar, and Facebook, by email to a dealership address we host. A dealership can also give an advertising site its own phone number (for example, the number in its Craigslist ads). When you call or text that number, the call or text is marked with that site, and unless you are already one of the dealership's open leads, your phone number is added to its leads with that site as the source (each dealership can switch this off for a number).

Price alerts. Name and phone or email, plus the vehicle you asked to watch. The dealership texts or emails you a link right away and again each time the price drops, until the watch is turned off.

Appointments. Name, phone or email, chosen time, notes, and any reason you give for cancelling. You receive confirmation and reminder messages with a link to reschedule or cancel, except as this paragraph says below for a visit you arrange from your account on the dealership's website. You can ask for a visit there. Where the dealership has posted hours you can book, you book an open time on its calendar right away. Where it has not, you pick a day and a time, with a note of up to 300 characters if you like; a time that has already passed is refused, and the time you pick is a request until the dealership confirms it and puts it on its calendar, or answers that the time doesn't work, and you then pick another. A note you write is shown, like a message (below), only to the dealership's owners, managers, and sales staff; it is never put in an alert, on a task, or on the dealership's calendar. Such a visit is booked with the name, phone number, and email address the dealership has on file for you, not with anything typed, and the booking page in your account asks for no texting consent: a consent to texts is taken from it only where you signed in with that very phone number. Once the dealership has started your deal, you arrange a visit with the dealership. When you are booked, we send you a message saying so, with the time, the dealership's address, and a link to your account (Section 9.4). A time you booked on the dealership's calendar can be changed or canceled in your account, and its reminders carry a link to reschedule or cancel; a visit the dealership confirmed from your request is changed by contacting the dealership.

Financing and credit. Everything on a credit application: name, phone, home phone, email, date of birth, marital status, Social Security number, driver's license number and state, current and previous address, housing status and payment, a landlord or mortgage holder, employer, job title, time on the job, monthly income, a second job and a previous employer, other income and its source, a co-applicant's details, down payment, and the vehicle. The application also asks for these, and a dealership's staff can also record them on it: your name in its parts (first name, middle name or initial, last name, and suffix); the kind of housing at your current address (rent, a mortgage, owned outright, with family, military housing, or other); your previous address's street, city, state, and ZIP code, with its kind of housing and monthly payment; and, for your job and for a second job or other income, the kind of employment (such as full-time, part-time, temporary, military, retired, self-employed, or unemployed) and how the income is paid (such as W-2 wages, self-employment, fixed income, or military pay). Prequalification requests collect similar identity fields plus a self-reported financial profile. Section 9.1 explains how this data is protected and when a credit bureau is contacted.

Identity documents. A dealership may scan your driver's license at the counter for a test drive or a sale. The barcode is decoded on the device to capture your name, address, date of birth, license expiration, and whether the license is marked limited-term. A photo of the front of the license may be stored privately for identity verification. A dealership may also ask you to send photos of the front and back of your license from your account ("Documents the dealership asks for" below). See Section 9.2.

Deals and signed paperwork. Vehicle, price, taxes and fees, payments, trade-in details, co-buyer details, and the documents you sign. E-signatures are drawn on screen and stored as images with the evidence described in Section 9.6. The signed packet is delivered to you, the dealership, and the salesperson, and once it has been delivered to you, you can also open it by signing in to your account on the dealership's website. Paperwork of a sale the dealership imported from its earlier system is not shown in your account.

References and landlord. On a deal, and most often a financed one, a buyer may give the dealership personal references and their landlord: each person's name, address, and phone, and a reference's relationship to the buyer — up to ten references. Staff enter them on the deal or on the buyer's finance application at the desk, or Levels reads them off an authorization to contact references that the dealership imports from its previous system, or you type them in your account when the dealership asks you for references; what you type is kept with that request and added to your finance application — and, once the dealership has started your purchase, to the purchase's references, unless a signed page already prints them — only when a member of the dealership's staff accepts it. They print on the authorization the buyer signs, which lets the dealership and the lender it assigns the contract to contact those people if the buyer cannot be reached. Levels does not text, call, or email a reference or a landlord, and does not add them to the dealership's customer or lead records.

In-house loans and payments. If the dealership finances you directly, we store the loan terms, a payment ledger, and reminders sent to you. Payment records include the amount, method (cash, check, card in person, or link), and any signed receipt. See Section 9.7 for what we do and do not handle about payment cards.

Payments to another lender. When a lender other than the dealership financed your purchase, the dealership's staff may record what they tell you about paying that lender: who you pay (the lender or the company that services the loan), the payment, how often, how many payments, the first payment date, the last four digits of your loan account (the whole account number is never stored), and the lender's payment website, phone number and instructions. A member of its staff confirms them against your contract or the lender's welcome letter before your account shows any of them; we record who saved them, who confirmed them, when, and a fingerprint of the contract terms they were confirmed against (a short code worked out from those terms, not the terms themselves), and a change to any of them, or to your contract's terms, means they are shown again only once confirmed again. The dealership may also keep, for each lender, where that lender's customers pay, checked by its owner or a manager; that is never shown to you by itself. We do not contact the lender, and we receive nothing from it.

Your account on the dealership's website. You can sign in with a one-time code sent to the phone number or email address the dealership has on file for you; there is no password. Right after you submit an application or a prequalification, the confirmation screen's View My Application button can open that one application on that device for 24 hours without a code — only on the device that submitted it, only once, and only within 30 minutes; anything more needs a code. We send a code only to a number or address that is on the dealership's records — on a purchase, on a credit application or a prequalification you submitted, or on an application link the dealership sent you — and the screen reads the same whether or not it is. A code works for 10 minutes and for five tries; at most one is sent a minute and five a day to the same number or address. Signed in, you see your purchases from that dealership, where the paperwork of a purchase stands (Being prepared, Ready to review, Awaiting your signature, Signed — waiting on your co-buyer, Signed — waiting on the dealership, or Complete — read from the signing records; a sale the dealership imported from its earlier system, cancelled or archived shows none) and the pages you are asked to sign (never a co-buyer's own copy of a form), which you can open from there once the dealership has reviewed your deal and it is ready for your signature (Section 9.6), your signed copies once the dealership has delivered your signed paperwork to you (never the paperwork of a sale it imported from its earlier system), your applications and where each one stands, in plain words read from the dealership's records (for example, "Application submitted" or "Under review"), and when it was last updated, the financing options the dealership publishes to you for an application (Section 9.1), the documents the dealership asks you for and where each stands (Needed, Uploaded, Under review, Accepted, or Needs attention, with the dealership's reason), and, if the dealership finances you directly, your loan balance, payment history, and the payment button (not for a sale that was cancelled). Once the dealership marks a purchase complete — which a member of its staff can do only when every signature is in, no page waits to be signed again and nothing you said isn't right on the deal is still open, and not for a sale it imported from its earlier system, a wholesale sale, or a cancelled or archived one — that purchase shows as My Vehicle & Financing: the vehicle, the day you bought it (the date your purchase agreement shows), the dealership's phone, address and posted hours, your signed documents, and your payments: for a loan from the dealership, the loan as above and the first payment date of your contract; for a loan from another lender, only the payment details a member of the dealership's staff confirmed ("Payments to another lender" below), and until then a line saying the dealership will add them; for a cash sale, none. Your account never shows another lender's balance or whether a payment reached it, and the lender's payment website opens on the lender's own site. If you opened your account straight from the confirmation screen, without a code, you are asked to sign in with a code to see those payment details. If a page of the purchase is opened for your signature again afterwards, your account shows where that paperwork stands — and does not say the purchase or its paperwork is complete — until it is signed. If the dealership takes the mark back, the purchase shows as it did before. Apart from the photos and files you send yourself ("Documents the dealership asks for" below), your account never shows your Social Security number, date of birth, or driver's license number. From your account you can also choose one of the financing options the dealership published (Section 9.1), ask the dealership for a next step — a visit ("Appointments" above), your paperwork online once you have chosen an option, a car from its listed inventory for an application that names none, or updated options when yours have expired — or send it a message. Each request is recorded with the sign-in it was made from and kept with your file: it is not deleted when it is answered or taken back, but closed as done or canceled, and you can take back a request that is still open, or a visit time the dealership answered doesn't work. A message you write (up to 1,000 characters; the screen asks you not to include your Social Security number or bank details), and a note you add to a visit, are shown to the dealership's owners, managers, and sales staff — not to its other staff, and not to Levels staff in a support session (Section 4); they are never put in an alert or on a task. A car you ask for is put on your application by the dealership; your request does not change the application. For each option you choose and each thing you ask for, the dealership gets one task on its Tasks board and an alert, sent to your own salesperson if one is assigned and otherwise to its sales team, by text or email as each staff member's own alert settings say — for requests of the same kind on the same application, at most one alert an hour; the task and the alert carry your first name and what you asked for, never an amount, a rate, a lender, your message, or your note. The dealership's lot and service staff see such a task only if it is assigned to them, and a support session can see your requests but cannot answer them. Your account shows the option you chose, each request you made (a message as you wrote it), and where each stands. You can withdraw an application with Withdraw this application: the application is marked withdrawn, once, and this cannot be undone from your account; your open requests for it and any upcoming visit you booked or asked for from your account are canceled, so no reminders of that visit go, and the dealership is told; a visit the dealership booked itself stays until the dealership changes it. From then on nothing more from that application is sent to a lender or to the dealership's dealer management system — a submission waiting to go is held, and the Levels Fill tool (Section 9.1) types none of it into that system — no credit report is pulled for it, no new option is published on it, and no deal is started from it. Your account then reads "You withdrew this application". The withdrawn application stays in the dealership's records, and an application you make later starts a new, separate file. The dealership's staff can see what your account shows for the application or prequalification on their file, when you last used it, and which status messages we sent you and by text or email; they can send you the link again, to a phone number or email address on that application or prequalification, and can end your sign-in on every device. When a phone number or email address is on records under more than one name, you pick yourself by first name after the code, and you see only the records under that name; this keeps each person's records apart on the screen, but anyone who can read messages sent to that number or address can sign in as any of them. A number or address that is on the dealership's purchases, credit applications, or financing requests under more than five names cannot be used to sign in from the website. Signing out ends your sign-in on that device and the browser's access to your documents' pages; after Sign out everywhere, another device that had your documents open can still open those pages for up to four hours. Your account shows each application or prequalification under the phone number or email address you gave on it; if you used different ones, sign in with each to see each.

Documents the dealership asks for. The dealership may ask you for documents, for example a driver's license (front and back), recent pay stubs, proof of residence, a work permit, proof of insurance, a bank statement, the names and phone numbers of references, or a Social Security card or letter. Its requests appear in your account on its website under Documents we need, each with what it is for, how to take it, and a day it is due if the dealership gave one. For each page you send a photo or a file — a PDF, PNG, or JPEG of up to 10 MB; other kinds of file are refused before they are read — and then press Send; until you do, you can take a page back. Before a photo is stored, our server saves it again without its location and other camera data. We do not keep the name your phone or computer gave a file; each page is known by its page number. What you send is stored with the dealership's credit file for your application, outside the public website, with the sign-in it came from. You can open your own pages while you are signed in to your account; if you opened your account straight from the confirmation screen, without a code, you can see, send, or change only what you added there. At the dealership, its owners, managers, and sales staff whose credit-data access is at the summary level or higher can open them once you have pressed Send, and its other staff cannot open them or see them listed; a Levels support session can open them as Section 4 describes. Every opening, yours and the dealership's, is recorded with who opened it, when, the IP address, and the browser type before the file is sent. The dealership may accept a page or ask you for a new one with a reason you read in your account; a page you take back, or one the dealership asks you to replace, is marked so and kept, not deleted. Only the dealership's owner or a manager can ask for a Social Security card or letter, and only with a reason the dealership records or a lender's requirement linked to the request; it opens only for staff whose credit-data access is at the full level or higher. References you type are kept with the request and added to your finance application — and, once the dealership has started your purchase, to the purchase's references — only when a member of the dealership's staff accepts them. If you already sent a document of the same kind on another of your applications with the dealership in the last 60 days and the dealership accepted it, the dealership may use that copy instead of asking you again; it uses only a document of yours, never one of another person who shares your phone number or email address. Sending a document runs no credit check, sends nothing to a lender, and does not change your application or where it stands. Separately, for a sale with no credit file, and for requests already sent that way, the dealership may still ask through a private link, where you upload the documents; only the dealership's staff can open them.

Communications. Texts you exchange with the dealership, including photos you send; calls to and from the dealership, including recordings, voicemails, and transcripts; and emails we send on the dealership's behalf. See Sections 9.3 and 9.4.

Trade-ins and consignments. Name, phone, email, vehicle year, make, model, VIN, mileage, condition, photos you upload, lien and payoff information, and, for consignments, the price you hope for and the signed consignment agreement. Your signed consignment agreement, which shows your name, contact details, vehicle, signature, IP address, and device, and the photos you upload are currently stored at unlisted web addresses on the dealership's site that anyone holding the exact link can open. We are moving these behind signed links.

Test drives. Who took which vehicle, when it left and returned, the odometer, the dealer plate used, and your name and address from your license. If you authorize it, your phone's location during a solo drive. See Section 9.5. Dealerships may print state-required plate audit records from this log. If the dealership turns it on, a few minutes after the vehicle is returned (never between 8pm and 8am the dealership's time) we text the phone number given at check-out a private link asking how the drive went: a happy or unhappy face, an optional comment, and whether you are still interested in the vehicle. We do not send it if the vehicle has since been sold or if that number was asked in the past week, and replying STOP stops it. Your answer goes to the dealership: it is kept with the test-drive record and the dealership's record of your inquiry, and it may be passed to the salesperson or the dealership's managers so they can follow up. You can change your answer for 14 days. If you answer that the drive went well, the page may offer a button to see the dealership's price for that vehicle (only where the dealership has turned this on, and not if you said the vehicle is not for you). Pressing it opens a purchase order for the vehicle: the newest one the dealership already prepared for you that is still in effect, or otherwise one prepared at that moment from the vehicle's listed price with the dealership's fees and tax, which the dealership honors through the date shown on it. It is saved in the dealership's records with the contact details the dealership already holds for you, the dealership is told that you asked, and the dealership can see when you open that page. A purchase order is not a sale, a payment, or a hold on the vehicle. Another test drive. When a vehicle comes back, the dealership may start your next test drive with the license it scanned for an earlier drive instead of scanning it again: we copy that drive's record of your license — the number, which stays encrypted and is not decrypted to do this, its expiration date, the license photo, and your name and address — onto the new drive, which records that it came from the earlier one. We do this only within 90 days of the drive at which your license was last scanned, only while the license has not expired, and not while you are out on another of the dealership's vehicles; to change the name or address, the dealership scans your license again. For two hours after a vehicle is checked back in, a page on the dealership's website — opened from the drive's authorization page, from the follow-up page, or from a QR code the salesperson shows you — lists the dealership's vehicles that are listed for sale and free for a drive right now, with each one's photo, year, make, model and trim, mileage, and price, and lets you ask to drive one, with an optional note of up to 200 characters. One request can be open at a time. A request records the drive it came from, the vehicle, your note, which of those ways you opened the page, a scrambled (hashed) form of the page's link, and when you asked; then who at the dealership answered and when, the short reason the dealership gave if the answer is not yes, and, if accepted, the drive it became; if the dealership starts your next drive at the desk while a request is open, that request is recorded as accepted, with that drive. The request appears on the dealership's screens, and the salesperson from your drive (or, if they are no longer with the dealership, its owners and managers) is alerted as the dealership's staff alerts are set — by text, email, or a held summary — with your name, the vehicle, and your note. The page shows the dealership's answer; we do not text or email you about a request. A request nobody answers within 30 minutes lapses, and you can ask again within the two hours, up to six requests in all.

Delivery photos. After a sale, the salesperson may take a photo of you with your new vehicle and upload it through a link we text them. Photos uploaded this way are published on the dealership's public website "happy customers" section with your first name and vehicle by default. Staff can remove a photo from the gallery or delete it at any time. Levels does not collect your consent for this publication; the dealership is responsible for asking your permission before uploading, and you can ask the dealership or us to remove a photo.

Job applications. Name, phone, email, and experience you describe on a dealership's careers page.

Records imported from the dealership's old systems. A dealership may upload its existing customer and lead lists into Levels. We keep the original rows for the dealership's reference. We carry over any opt-out flags in the file and never treat an imported record as having opted in.

Your customer file. Dealership staff see one combined file for you that brings together your leads, deals, loans, messages, calls, appointments, documents, credit prequalification tier, and website activity linked to you.

The dealership's vendors. When a dealership sends a vehicle to an outside repair shop, requests a tow, or asks a title agency for a status check, we text or email that vendor the vehicle's stock number, VIN, year, make, model, and the dealership's notes. A title-status request also includes the customer's name.

6. Website visitors: cookies, local storage, and linking browsing to a person

What we store in your browser. Dealer websites do not use third-party analytics cookies, advertising cookies, or tracking pixels. (One frame a dealership can switch on runs another company's script, and what that company stores inside it is its own; see "Third-party resources the site may load" below.) They do store a few values in your browser's own storage:

What we record about your visit. As you browse, the site sends events to our servers: page views, searches, filters, vehicles viewed, photo swipes, price-breakdown opens, and button clicks such as "call" or "text". Each event carries your random visitor ID, the session key, and the source of the visit. We do not store your IP address or browser type with these browsing events; we use your IP address in memory only to limit abusive traffic. We do record your IP address and browser type when you give a consent, sign something, choose a financing option in your account, or open a document you sent from your account, as Sections 5, 9.1, 9.5, and 9.6 describe.

How browsing gets linked to you. This is the part most sites do not explain, so we will. Your browsing is anonymous until one of two things happens:

  1. You submit a form on the site (a lead, price alert, application, prequalification, or trade-in). At that moment your visitor ID is linked to the record you created, including the vehicles you looked at before you submitted the form.
  2. The dealership texts you a link to a vehicle and you open it on your phone. The link carries a signed one-time token. Opening it links that phone's browser to your customer record.

Once linked, dealership staff can see which vehicles you viewed, how many times, and when, and your earlier and later browsing under that visitor ID is attributed to you. The dealership may use this to follow up, for example by texting you about a vehicle you viewed several times, subject to the consent rules in Section 9.4. If several people identify themselves on the same browser, we stop attributing that browser's activity to any one person.

Your choices. Clearing your browser storage, or using a private window, resets the visitor ID. Replying STOP to a dealership's texts stops texts from that number. You can ask the dealership to remove browsing history from your file.

Third-party resources the site may load. Depending on the dealership's design choices, your browser may load fonts from Google Fonts, video players from YouTube (in privacy-enhanced mode), and links to Google Maps for directions. When those load, Google receives your IP address and browser type under Google's privacy policy. Vehicle history buttons open CARFAX or AutoCheck with the vehicle's VIN; those sites see your visit under their own policies. If the dealership has switched on CarGurus' deal rating, opening a vehicle — on its own page, or as the details shown over the inventory list — also loads a frame that asks CarGurus for that vehicle's deal rating. CarGurus receives the vehicle's VIN and listed price, your IP address and browser details, and may store its own data in that frame, under CarGurus' privacy policy. The frame is separate from the rest of the page, and CarGurus' script cannot read anything else on it. The frame is loaded only on the dealership's live website, and only for a vehicle that has a VIN and a listed price; if CarGurus does not rate the vehicle at the level the dealership chose, nothing is shown.

Search engines. Dealer websites are public and indexable. They publish the dealership's name, address, phone, and live inventory, and the "happy customers" section described in Section 5.

7. Shopping through an AI assistant (ChatGPT connector)

Levels offers an AI shopping layer that lets AI assistants search participating dealerships' inventory. This layer is off by default. It works only for dealerships that have opted in, and only for the capabilities each dealership has switched on (inventory search, lead creation, messages, appointments, prequalification, trade-ins).

Browsing is anonymous. Searching inventory, comparing vehicles, and estimating payments do not require your identity. We keep a session record with a hashed IP address, browser or client type, locale, your search criteria, and your location if you provide a ZIP code or coordinates. Sessions expire after 30 days.

Contacting a dealership requires verification. Before anything reaches a dealership, you verify a phone number or email address with a one-time code. On success we create a Levels shopper profile (name, phone, email, verified dates). This profile is held by Levels at the platform level, not by any one dealership, so you can contact several dealerships without re-verifying. Dealerships see it only through the leads, messages, and appointments you send them. You may also link your shopper profile to the assistant through an OAuth connection.

What the dealership receives. When you ask to be contacted, send a message, submit a trade-in, or confirm a test drive, we create a normal lead in that dealership's CRM marked as coming from the AI assistant. The dealership gets your name, contact details, your message or note, and a structured summary of what you were looking for. We never store or forward the conversation transcript.

What the assistant receives. The assistant receives inventory and dealership details, payment estimates, your verified name, and, when you confirm an appointment, the appointment details including your phone or email. If you start a prequalification from the assistant, you complete it on the dealership's secure Levels page, never in chat. Afterward the assistant may receive only the status, a Levels planning tier, the bureau name, and, if the dealership has chosen to display scores, your score and score range. It never receives your Social Security number, date of birth, address, income, or credit report.

OpenAI is not our service provider. Your conversation with ChatGPT is handled by OpenAI under OpenAI's privacy policy and your own ChatGPT data settings. The information we return to the assistant goes to OpenAI at your direction, as part of the product you chose to use. Levels receives only the tool requests the assistant sends to our connector.

Disconnecting. You can disconnect a linked Levels shopper profile by removing the Levels connection in your AI assistant's settings, which revokes the assistant's access tokens. Your shopper record, and any leads, messages, or appointments you sent to a dealership, remain unless you ask us at admin@levels.dealer to remove the record.

Records we keep. Verification codes are deleted one day after they expire. Per-request records are kept in a log that strips out names, phone numbers, emails, and free text. Shopper profiles and saved vehicles are kept until you ask us to delete them; deletion requests are carried out manually by Levels staff, and we confirm to you when they are complete.

8. How we use information

We use personal information to:

We do not use dealership customer information to build profiles for advertising. Levels does not train AI models on your data, and Anthropic is contractually barred from training on what we send it. Information returned to ChatGPT is subject to OpenAI's policies and your own ChatGPT settings (Section 7).

9. Sensitive information

9.1 Social Security numbers, credit checks, and credit reports

Consent comes first. A credit check never runs without your affirmative agreement, recorded on your prequalification or credit application before the bureau is contacted. For a prequalification, you must accept a written notice that names the dealership as the party requesting the check, identifies Levels Tech LLC as the service provider that transmits the request to the bureau on the dealership's behalf, and names the credit bureau that will be used. We store the exact notice text you saw, its version, the time you agreed, your IP address, and your browser type. For a full credit application, you give a separate written authorization on the website form, on a link the dealership texts or emails you, or on paper that the dealership attests to. Prequalification consent is not treated as authorization for a full credit pull; the dealership must obtain that separately.

Permissible purpose. Credit reports are obtained under the Fair Credit Reporting Act for the purpose you request: a prequalification you initiate, or a credit application you submit in connection with buying or financing a vehicle. Testing a dealership's bureau connection never pulls a consumer file.

Levels' role. Levels holds the account with the credit-reporting provider so that each dealership does not need its own, and requests the report as the dealership's agent under your written instructions and the dealership's certification of its purpose. The report is delivered only to the dealership you dealt with. Levels does not review, use, resell, or combine credit reports for any purpose of its own, and complies with every obligation the Fair Credit Reporting Act places on it in this role. A dealership may instead connect its own credit-provider account.

Soft inquiries. Website prequalifications are soft inquiries. They do not affect your credit score. The notice you accept says so and states that a prequalification is not an application for credit.

Who runs the check. When a dealership has enabled credit features and a live credit-report provider is connected, we send your identity to CRS Credit API (StitchCredit), an authorized reseller that fronts Experian and Equifax. The dealership chooses which bureau. The check returns a FICO Auto score and report. If the dealership has not enabled credit features, your request is recorded as pending and the dealership's finance team follows up with you directly.

What we send to the bureau. Name, date of birth, full Social Security number, current address, phone, email, and, when available, your IP address and browser type, which the provider uses for fraud detection.

How your SSN is handled.

How your credit report is handled. The bureau's raw response is scrubbed of your full SSN and date of birth, then encrypted with AES-256-GCM before storage. A normalized version of the report (score, factors, tradelines, and related data) is stored in readable form inside the dealership's isolated database partition, protected by the access controls below, per-user credit-access levels, and audit logging, but it is not separately encrypted. Every request to the bureau, every report view, and every access-level change is written to permanent audit logs that include the staff member, time, IP address, and browser type.

Who at the dealership can see it. The dealership's owner assigns each staff member a credit-access level: none, summary, full, or admin. "Summary" sees only a tier such as Prime or Near-Prime. "Full" sees the score and factors. "Admin" can additionally open the encrypted raw file after entering a personal PIN, and that view is logged and watermarked.

What you see. After a prequalification you can open your result through a link that works for 72 hours. Your account on the dealership's website shows where your application stands in plain words; its status screens do not show your credit score, and a prequalification is shown as a soft check, never as a lender's approval. When the dealership publishes financing options to you, their terms are shown only in your account: each option as the dealership entered it, whether it is an approval, a conditional approval or an estimate, the day it is good through, and the one the dealership recommends with its reason. An option is shown as an approval only while the lender's answer the dealership recorded for it still stands, or, for financing the dealership provides itself, when its owner or a manager published it and the dealership still offers that financing; when that answer is withdrawn or replaced, or the dealership stops offering its own financing, the option is shown as being updated, without its terms. An option marked as an estimate is not an offer of credit or a lender's approval. Viewing options runs no credit check and sends nothing to a lender. Where a dealership's file holds records of more than one person (for example when two people used the same phone number), its options are shown to no one until the file is about one person's own submitted application, and then only to that person. In your account you can go ahead with an option that has not expired and is not being updated by pressing Continue With This Option. We record which option you chose, which version of it, when, and from which sign-in: the sign-in itself, the phone number or email address you signed in with, your IP address, and your browser type. Choosing an option is not signing anything and is not a loan: it runs no credit check, sends nothing to a lender, a lender network, or the dealership's dealer management system, and does not change your credit application. The dealership is told that you chose an option (Section 5). You can choose a different option until the dealership starts your deal; after that, talk to the dealership to change it. If the dealership revises the option you chose, the earlier version is kept, your choice still names the version you chose, and your account shows the earlier and the new terms side by side; you go on with the new terms only by pressing Continue With the Updated Terms, which is recorded the same way, or you choose a different option. When the dealership starts your deal from the option you chose, the deal records which option it was started from, and the dealership's deal screen is filled in from that option's terms for its staff to check. While your result is still available — within those 72 hours, or sooner if the dealership keeps results for a shorter time — you can reopen it from your account, and it shows what the dealership chose to show on it. Reopened on the device that just submitted it, you can go on to your application from it as from the original link; reopened after signing in with a code, it is for viewing only. The dealership decides whether the result shows your score and the factors that affected it. A dealership can also turn on an estimated annual percentage rate, which is off unless it does: where it is on, your result shows a range of estimated rates worked out from your score, the vehicle, the term, and the amount financed against the rate sheets the dealership's lenders gave it, labeled as an estimate and not an offer of credit, with no lender named. Estimates are not a decision and no lender sees them.

Where the tier goes. Your prequalification tier is copied onto your lead and any later credit application, appears in alerts to the dealership's sales staff, and is visible on your customer file. If you started from an AI assistant, see Section 7 for what the assistant receives.

Sending your application onward. If the dealership has connected its own dealer management system (DealerCenter), its staff can send your application to the dealership's own lead-import address by email, in a standard lead format. Nothing is sent until a staff member reviews the application and presses Send, and never without your recorded credit authorization; a send made while email delivery was not yet live goes once it is, unless the application changed in the meantime, in which case it waits for another review. The email carries your name, phone, email, and address, and the rest of your application as a note on the lead: your home phone and marital status; your housing and address history, including your landlord or mortgage holder and your previous address; your employment history and income, including a second job, a previous employer, and any other income and its source; your co-applicant's details, if you have one; the names, relationships, and phone numbers of your references; the vehicle, your down payment, and any trade-in; and the time you authorized a credit check. The same information goes by email to one of the dealership's own lenders when its staff send your application there. These emails never include your Social Security number, your date of birth, or your driver's license; where the dealership's own system needs your Social Security number or date of birth, its staff enter them there themselves or, where the dealership uses Levels Fill (below), have that tool type them. Submission to lender networks such as CUDL is not switched on today; when it is, it will require your recorded credit authorization and the dealership's opt-in.

Levels Fill. Levels supplies a browser tool, Levels Fill, that types a credit application into the credit application screen of a dealership's own account at its dealer management system (DealerCenter), a company the dealership has chosen. It is off for every dealership unless Levels has made it available to that dealership and the dealership's owner has switched it on. Where it is on, a staff member the dealership allows, whose credit access is at the summary level or higher, pairs one browser with Levels, opens your record or a new, empty record on that screen, enters a personal PIN, and chooses your application, which must be one that staff member has opened in Levels and that carries your recorded credit authorization. To make that choice, Levels shows that browser a list of those applications, each with the applicant's name, the day it was received, and the last four digits of the Social Security number on file; for the one chosen it also shows the last four digits of the driver's license number, the state of the license, and who entered each of the two numbers and when. On the staff member's press, Levels then releases your application's answers to that browser, encrypted for it alone: your name, date of birth, current and previous address, housing, phone numbers, email, and employment and income. Your full Social Security number and your full driver's license number are released separately, decrypted at that moment, and only after the tool reports that the record open on the screen carries your name and that its Social Security number box is empty. The tool types these into that screen from the staff member's own browser; for a fill, Levels' own servers send that system nothing. The tool does not save or submit the screen, run a credit check, or tick a consent box. To find the right boxes, to make sure the record open on the screen is yours, and to check what it typed, the tool reads that screen: its labels and the names its code gives its boxes; the dealership account name it shows; the name on the open record; what its Deal Type and ID State lists show; whether its Social Security number box is empty, and the last four digits of a number already in it; whether its "No SSN/ITIN?" box is ticked; and the boxes it has an answer for. On a record that carries no name, and on one whose name the tool typed or may have typed, it also reads whether each other box of the applicant's section holds anything. And it reads how the page is drawn around those boxes (which lists and messages are open, and what covers a box), so that it stops when the page changes under it. It reports back to Levels which boxes it typed or left, whether it typed your name itself, the web address of the screen, that account name, and its own version, and it passes on what the staff member answers when it asks them something (for example, that a record whose date of birth differs from your application's is still yours), never what a box holds. The tool stores nothing of your application: what it keeps in the browser is its pairing with Levels (an identifier, a signing key, and a counter). Until the tab is reloaded or closed it remembers scrambled checks of the boxes it typed or read, never what they hold, and, for the two numbers, their length and last four digits. While its report is open, its panel also holds your application's other answers in memory, to show what Levels has beside a box that differs; it writes none of them to storage. We record each release: the staff member, the browser, the time, the application, the system it was for, which items were released, what the tool reported, and what the staff member answered. A release of your Social Security number or license number is also logged like a reveal, and daily limits that the dealership's owner can change apply to such releases. A release saves no readable copy of either number at Levels. What is typed is then on the dealer management system's own screen, which may act on it as it does when a person types, under that company's terms with the dealership.

Retention. Consent records, bureau request logs, report views, and reveal logs are append-only and cannot be edited or deleted by dealership staff. We keep credit application data and reports for as long as the dealership's account is active and afterward as required for legal and FCRA compliance. Stored reports are not automatically deleted today.

9.2 Driver's license scans and images

Why. Dealerships scan licenses to verify identity before a test drive or sale, to warn about expired licenses and licenses that expire within a year, to tell the salesperson working a purchase when a limited-term license expires within a year (credit unions often ask for proof of residency, a valid work permit, or a Social Security card then), to fill required deal paperwork, and to keep the plate-audit records some states require. A license scanned for a test drive may be used again, without being scanned again, for another test drive at the same dealership within 90 days, while it has not expired (Section 5, "Test drives").

How. The barcode on the back of the license is decoded on the device itself; nothing is sent to a cloud scanning service. A photo of the front is compared to the barcode on the device to check that they match. Only the match result is kept, and whether the front says the license is limited-term, not the text read from the photo. If the scanner cannot read the barcode, the failed image, which may show your license, is uploaded to a diagnostics area on our own servers that only the dealership's owners and managers can open; it is deleted after 30 days.

What is stored. Your name, address, date of birth, license expiration, and whether the license is marked limited-term are stored with the test drive, deal, or lead. Your license number is encrypted, with only the last four digits and issuing state readable. The full number is decrypted only to fill required deal paperwork or when an authorized staff member reveals it on a credit application, which is logged. The front-of-license photo is stored in a private area that only that dealership's logged-in staff can open. Photos of your license that you send from your account when the dealership asks for them (Section 5) are documents on the dealership's credit file: they are stored without their camera data, open for you and for the staff Section 5 names, and are not deleted on the 90-day schedule below.

Deletion. Scanner photos are deleted from the live system 90 days after capture; using a license on file again for another test drive does not extend that. Failed-scan diagnostic images are deleted after 30 days. A license photo attached directly to a deal record is kept with the deal. Decoded identity fields and the encrypted license number are kept as part of the transaction record. See Section 12 for how backups affect deletion.

9.3 Call recordings, voicemails, and transcripts

Each dealership has phone numbers provisioned through our telephony provider, Twilio. When you call a dealership line, the greeting states that the call may be recorded. Calls forwarded to staff are recorded, and voicemails you leave are recorded and transcribed. If the number you called is one the dealership gave to an advertising site (Section 5, "Contact and lead information"), the employee who answers may first hear that site's name, and your name if the dealership already has it, before you are connected; you hear ringing meanwhile.

When the dealership calls you through Levels, whether a salesperson clicks to call, a new web inquiry triggers an immediate call-back, or the call is part of a call campaign, both sides of the call are recorded and transcribed. Recording cannot be turned off for these calls. Our system speaks the recording notice to the dealership employee before your line is dialed; the system does not play a notice to you. The dealership is responsible for telling you at the start of the call that it is being recorded where the law requires your consent, and you may hang up or ask the dealership to call you from a line that is not recorded.

Recordings are stored with Twilio and transcribed by Twilio's transcription service. The full transcript, labeled by speaker, is stored with the dealership's call log and shown to its staff. Dealership staff play recordings through short-lived signed links; the raw storage address is never exposed. Recordings and transcripts are kept for as long as the dealership's account is active and afterward as needed for legal purposes.

If you call and no one answers, the dealership's line may automatically text you back once, at most once per hour.

9.4 Text messages, consent, and STOP

Texts come from the dealership's own number, not from Levels. There are two kinds.

Texts about something you asked for. When you give a dealership your mobile number on a form, in a signed agreement, or by texting it first, the dealership may text you about that request: replies from staff, links you asked for (applications, signing, payments, appointments, photo uploads), the one-time code you ask for to sign in to your account (we keep only a scrambled form of it that cannot be turned back into the code, and the dealership's message history says only that a code was sent), appointment and payment reminders, price-drop alerts for a vehicle you asked to watch, and a review request after a purchase. After you submit a prequalification or an application we send one message with a link back to your status page — unless your submission joined an application already on file: by text only if you ticked that form's texting box, otherwise by email; it says that we received it and nothing about amounts, decisions, or you. The dealership can send you that link again; it texts it only if your number has a texting consent on file with the dealership, and otherwise emails it. When the dealership publishes new financing options to you, we send one message, at most one an hour, with a link to them in your account: it says that your financing approval is ready to review when what your account then shows is an approval, and otherwise that there's an update on your application; it names no lender and no amount. It is texted only if your number has a texting consent on file with the dealership, and otherwise emailed, and it is not sent when the dealership revises an option. When the dealership revises the option you chose, we send you a different message, one for each revision: that the terms of the option you chose were updated and that you should review them, with a link to your account; it names no lender and no numbers. When the dealership marks your application approved and tells you, the message says that your financing approval is ready to review, with a link to your account, only when your account shows such an approval — and then it is that same message, at most one an hour, texted only if your number has a texting consent on file with the dealership and otherwise emailed; otherwise it says there's an update on your application, with a link to pick a time to come in, and goes by text to the phone number on your application, or else by email. When the dealership confirms a visit you asked for from your account, or you book an open time there, we send one message that you're booked, with the day and time, the dealership's address, and a link to your account; when the dealership answers that the time you asked for doesn't work, we send one message asking you to pick another time, with a link to your account. These messages, and the one about a revision, go only to a phone number or email address on your own record with the dealership, and each is sent at most once; each is texted only if your number has a texting consent on file with the dealership, otherwise emailed, and not sent at all when there is neither a number that may be texted nor an email address. Reminders of such a visit, the day before and on the day, go out as for other appointments, texted only if your number has a texting consent on file with the dealership and otherwise emailed, and only to the phone number or email address the visit was booked with, which are your own record's. When the dealership asks you for documents in your account, we send one message, however many it asked for in that request; one when the dealership asks you for a new copy of a document; and one when everything it asked for is in. While something it asked for is still needed, we send at most two reminders for each request, on the second and the fifth day after it, or the morning before the day it is due as one of the two, never between 8pm and 8am the dealership's time, and none after you withdraw the application, the dealership closes it, the application is no longer active, the due day has passed, or your purchase's paperwork is complete or the dealership has marked your purchase complete, or while the dealership's account with us is switched off. None of these messages names a document or a file; each says only that something is needed, needs another look, or is in, with a link to your account. When you asked for your paperwork online and the dealership has never sent you a signing link for that deal, we send one message, once, a short while after your deal becomes ready for your signature, that your paperwork is ready to review and sign in your account, with a link to it (never for a purchase the dealership has marked complete) — never between 8pm and 8am the dealership's time; it names no vehicle, no amount and no lender, and it is texted only if your number has a texting consent on file with the dealership and otherwise emailed. When the dealership marks your purchase complete, we send one message, once for that purchase, that your purchase records are in one place in your account, with a link to it, except when it marks past sales together — then no message is sent for them, ever; if the mark happens between 8pm and 8am the dealership's time, the message goes after 8am (if the dealership's account with us is switched off then, when it is back on, within 7 days of the mark), and not at all if the dealership takes the mark back first; it names no vehicle, amount, date, lender or account number, and no second one is sent if the dealership takes the mark back and marks the purchase complete again. They go only to a phone number or email address on your own record with the dealership, texted only if your number has a texting consent on file with the dealership, otherwise emailed. The dealership's staff whose credit-data access is at the summary level or higher are told when you send a document, by an alert that carries your first name and no document's name.

Marketing texts. A dealership may send marketing texts (for example new arrivals, price drops on a model you named, trade-up offers, service reminders, or a follow-up about a vehicle you viewed on its website) only if you have given that dealership prior express written consent to receive marketing texts sent with automated technology. Consent to marketing texts is never a condition of buying, financing, or servicing a vehicle. Message frequency varies. Message and data rates may apply.

STOP and HELP. Reply STOP to any text to stop texts from the dealership number that sent it. Our messaging provider blocks further texts from that number to yours. Levels does not currently record a STOP reply on your customer file, so if the dealership uses more than one number, reply STOP to each, and a STOP does not stop calls or email. To stop those, or to have your record flagged as opted out across the dealership's numbers, tell the dealership or write to us at admin@levels.dealer. Reply HELP for help. Opt-out flags carried over from a dealership's previous system are honored for reminders, alerts, marketing messages, and staff-typed texts, but are not currently applied to automatic missed-call text-backs or texted application, authorization, and receipt links.

Do-not-call. Calls placed through the dialer and immediate call-backs are not made to numbers marked do-not-call in the dealership's records. Call campaigns built from lead lists do not currently apply the do-not-call flag; the dealership is responsible for excluding those numbers before starting a campaign.

Automated replies. If the dealership turns on automatic replies, for all hours or only between 8pm and 8am its time, a text you send it may be answered by one automatic text, marked "(automatic reply)" after the dealership's name. It is a fixed note: that your message was received; that it has been passed to the dealership's team, which is said only when an alert about your text has actually gone to a member of its staff; the hours the dealership posted for that day, where it posted opening and closing times; and "Reply STOP to opt out." No AI model writes or chooses this reply, and nothing from the dealership's records about you is put into it. When your text names one vehicle by its stock number, its VIN, or a link to its page on the dealership's website, the software may also compose an answer about that vehicle from the vehicle's own record and show it to the dealership's staff under your text; it does not send that answer to you. An automatic reply is never sent in answer to STOP or another opt-out message, to a number that has opted out of the dealership's texts or is marked do-not-call, or when a member of its staff has texted you, called you, taken your call, or marked your message as handled in the last 12 hours.

Who at the dealership is told about your text. Whether or not an automatic reply goes, the software alerts the dealership's staff when you text it (a bare STOP, START, or HELP alerts no one). The alert goes by text message and email, through the providers in Section 10.2, to a staff member the dealership's records tie to you, such as the one who last texted you or the salesperson assigned to your inquiry; otherwise to whoever the dealership chose for texts nobody else is handling, which is every one of its salespeople unless it chose one named person or its owner only; and, when none of those could be told, to its owner. If your newest record with the dealership is a purchase recorded more than 30 days ago and you have made no new inquiry in the last 30 days, the alert goes first to a staff member who has been in touch with you in the last 12 hours or texted you in the last 14 days, and otherwise to the dealership's owners and managers. When a text that reports something urgent, such as a breakdown, an accident, or a theft, goes to the salespeople or to the named person, the owner is told too, unless the owner has switched alerts off. The alert carries your name if the dealership has it, or your phone number; up to the first 160 characters of what you wrote; and a few words from the dealership's records about your dealings with it (for example that you bought or test-drove a certain vehicle, or that a credit application is on file, never an amount). It never carries a photo you sent, and what the software recognizes as a Social Security number, a date of birth, a driver's license number, a payment card number, or a bank account number is replaced with dots, though it may not recognize every way of writing one. An alert can be held, by a staff member's own alert settings, outside the dealership's posted hours, or when several texts arrive close together, and then reaches that person later in a summary; when a person cannot be told, the alert passes to the next. If every one of these people has alerts switched off, no alert is sent.

Texts waiting for an answer. A dealership may switch on a list of customer texts that no one on its staff has answered; it is off unless the dealership switches it on. Where it is on, a text of yours that is waiting for a person is listed for the dealership's staff with your name or number, when you wrote, and how long you have waited. It stays listed until a member of the staff has dealt with it, for example by texting or calling you or by marking it handled, or, failing that, until seven days after your last text. After a wait the dealership sets (30 minutes of its open hours unless it chose another), a reminder may go to its owner, to the person it named for such texts, and to the staff your text is with; a reminder holds your name or number and how long you have waited, never your words. The alert about your text then also carries a link, a separate one for each staff member it goes to, with which that person can mark your text handled without signing in. Until that link expires, 72 hours after the last alert that carried it, anyone holding it can open a page that shows your name or number, when you wrote, and how long you have waited, and can take you off the list; the page shows none of your words.

Immediate call-backs. If the dealership enables it, submitting a web inquiry with your phone number can trigger an immediate call that connects you to the first available salesperson. If no one answers, or it is after hours, you receive a text instead.

Every text sent or received is stored with your number and the message content in the dealership's records.

9.5 Location during a solo test drive

This feature is off unless a dealership turns it on. When it is on and you take a vehicle out alone, the dealership may text you an authorization link. The page shows you the dealership, the vehicle, the check-out time, and the salesperson, and asks you to authorize the drive and share your location while it is active.

Nothing is collected until you tap the authorization button. We record the time, your IP address, and browser type for that tap. Your phone then sends its position roughly every 5 seconds while the page is open, and the page asks your phone to keep its screen on while it shares; a phone that locks its screen stops sharing until the page is open again. We accept positions only while the drive is open, meaning until the vehicle is checked back in or 6 hours pass, and we cap collection at 4,500 points per drive. When the drive ends, the page stops sharing and the link no longer accepts positions; for two hours after the vehicle is checked back in, the page offers a button to ask the dealership for another test drive (Section 5, "Test drives"). While the drive is open, the dealership's staff can watch the vehicle's position on a map as it arrives; afterwards they can view the route. From the positions we work out roughly how far the vehicle went; staff see that distance, and at check-in it can fill in the vehicle's odometer reading, which is recorded as an estimate unless staff enter what the odometer shows. Your phone's own speed reading is sent with each position when the phone provides one. From the speeds we work out the drive's average and top speed, and staff see whether, and for how long, the vehicle held a speed over a limit the dealership sets. If the dealership turns it on, and the vehicle holds a speed over that limit, we text the phone number given at check-out asking the driver to slow down, at most once every 10 minutes and three times per drive; the authorization page says so before you agree. Route data is kept with the test-drive record.

9.6 E-signature evidence

Before you sign anything electronically, you agree to conduct the transaction electronically under ESIGN and UETA. We record that agreement, and for every step of the signing process (link sent, packet opened, document viewed, document signed, documents delivered, a copy you save or download) we record the time, the channel (in person or remote), your IP address, and your browser type. A signing link made when you open your paperwork from your account is recorded as a link sent, with when it was made and that you signed in with a one-time code sent to your phone or email (shown masked); the steps after it are recorded as above. We store your signature and initials as images — drawn on screen, or your typed name rendered as a signature if you choose "Type it", and when your screen saw which, we record which — your typed legal name, and a cryptographic hash of each document. A Certificate of Completion listing this evidence is appended to the signed packet. These records are append-only and cannot be altered by dealership staff.

Signing links are short addresses that the dealership can cancel; a cancelled or replaced link stops working, even on a page that is already open. Once the dealership has reviewed your deal and it is ready for your signature, Review and Sign in your account opens your signing link: the one the dealership texted or emailed you while it still works, otherwise a new one that works for 7 days. Opening it from your account never cancels a link the dealership sent you, and a link the dealership sends you later replaces the one your account made. A link the dealership cancels stops your account from opening one until the dealership sends you a new link or reviews your deal again. If the dealership turns it on, a signing link opens only after you enter a one-time code we send to the phone number (or, without one, the email address) the dealership already has for you. We store a salted hash of the code, never the code itself, and the code is not kept in the dealership's message history. When the code is entered we record that it was, on which device, and by which channel to which masked destination, and the certificate lists it. If the dealership turns on signing reminders, a signing link the dealership texted or emailed you that still has documents waiting for you is followed by up to four reminders, by the same text or email the link came by (a link made from your account is followed by none), never between 8pm and 8am the dealership's time, each linking the same signing link; replying STOP to a text stops them, and each reminder sent is listed on the certificate. While you sign, the dealership can see which document you have open and how many you have signed. Before the contract, your signing link — or the dealership's screen, when you sign there in person — may show your deal's key figures, taken from the contract itself; we record that you confirmed them (in person, with the staff member there as the witness), or — if you tell us something isn't right — your note, and the dealership is told and must look at the deal again before you can sign. When your finished paperwork is delivered, we keep that exact PDF and its fingerprint; your download — from the link we sent you or from your account, which records it as a copy you saved, with its fingerprint — serves that same file while nothing on the deal has changed, and anyone holding a copy can check on the dealership's site whether it is unaltered — the check runs on their own device and the file is never uploaded. If you would rather sign a document on paper, the dealership prints it with its fingerprint and a code on each page and records when it was printed and by whom; once you have signed it in ink, the dealership's staff attach a scan of the signed page. We keep that scan in the dealership's private storage with its fingerprint, record the document as signed on paper with the staff member who attached it as the witness, and print the scan in the document's place on the signed packet. If the dealership keeps its own signing tablet, the staff member at the desk can send your paperwork to it; your signing there is recorded as in the dealership, on the store's tablet, with that staff member as the witness, and when you finish (or the tablet sits untouched for a while) it returns to its welcome screen and your signing link stops working, so the next person to use the tablet cannot open your paperwork.

9.7 Payment cards and bank accounts

Online deposits and portal payments are processed by Stripe on Stripe's own checkout page. Your card number, expiration date, and security code are entered on Stripe's page and go directly to Stripe under Stripe's privacy policy; Levels never receives or stores them. Levels receives from Stripe only the payment's status, amount, and Stripe's reference numbers, which we store on the deposit or loan record so the payment appears on your account and a receipt can be sent to you. Bank (ACH) payments are not offered yet.

No page operated by Levels asks you for card or bank details. If a page ever does, it will name the payment processor that receives them, and we will update this policy first. Payments the dealership collects in person are recorded by its staff.

9.8 Financial privacy (Gramm-Leach-Bliley Act)

Dealerships that arrange or provide financing are financial institutions under the Gramm-Leach-Bliley Act. Credit applications, loan records, income, Social Security numbers, and credit tiers are "nonpublic personal information" under that law. Levels receives this information from dealerships only as their service provider. We use it solely to provide the services the dealership has chosen; we do not disclose it to anyone else except as the dealership directs, as this policy describes, or as the law permits or requires; and we maintain a written information security program with the administrative, technical, and physical safeguards described in Section 13. Our agreement with each dealership contains the service-provider commitments required by the FTC Safeguards Rule.

10. Who receives personal information

We share personal information only with the parties below, only for the purposes described, and only to the extent the dealership has enabled the relevant feature. Each provider handles data under its own privacy policy and our agreement with it.

10.1 Hosting and infrastructure

10.2 Messaging and telephony

10.3 Credit reporting and lending

10.4 The dealership's own systems and vendors

10.5 QuickBooks Online (Intuit)

A dealership may connect its own QuickBooks Online company. Here is exactly what that connection does.

10.6 Keys.app

Keys.app is a locksmith and key-parts network integrated into Levels for dealerships that use it. Keys.app is operated by Keys Inc., doing business as Keys, a separate company under common ownership with Levels, which makes it an affiliate of Levels; it handles what it receives under its own privacy policy, and Levels uses Keys.app data only for the dealership's key and locksmith jobs. When a dealership looks up keys, orders parts, or books a locksmith, we send Keys.app the dealership's name, phone, email, lot addresses, the requesting staff member's name, the vehicle's VIN and description, key part numbers, shipment tracking, and any notes the staff member types. Customer identity, license data, and deal information are never sent to Keys.app. Payments to Keys.app are made by the dealership on a Stripe-hosted checkout page operated by Keys.app; Levels stores only the payment status.

10.7 Payments

10.8 AI providers

10.9 Marketplaces and listing sites the dealership chooses

10.10 Vehicle data, maps, and web resources

10.11 Levels personnel

Authorized Levels employees may access personal information to operate, secure, and support the platform, as described in Section 4. Access is logged.

We may disclose personal information when required by law, subpoena, or court order, to protect the rights and safety of people, or to enforce our agreements. If Levels is involved in a merger, acquisition, or sale of assets, personal information may transfer to the successor, who will be bound by this policy.

11. We do not sell or share personal information

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not place advertising cookies or pixels on dealer websites or on levels.dealer.

Because some data flows can look like sales, here is how we see them:

We treat a Global Privacy Control signal from your browser as a request to opt out of the sale or sharing of your personal information. Because dealer websites and levels.dealer do not sell or share personal information, that request is already honored and nothing on the site changes. We do not respond to "Do Not Track" browser settings, which have no standard meaning.

12. How long we keep information

Default rule. We keep personal information for as long as the dealership's account is active, and afterward as needed for legal, accounting, tax, and compliance purposes. Many records in Levels are append-only audit trails and cannot be edited or deleted by dealership staff.

Specific deletion schedules that run automatically:

Records with no automatic deletion. Leads, customer files, deals, signed documents, license photos attached to a deal, loans and ledgers, messages, call logs with recordings and transcripts, website activity, consent and audit logs, the record of each account sign-in code we sent (to which masked number or address, when, and how many tries — never the code) and of each sign-in to your account (when, the kind of device, the IP address, when it ended, and who at the dealership ended it), and of each status message we sent about your application (which kind, by text or email, when, and whether it went — never its words beyond the dealership's message history), every financing option a dealership drafted or published for you (each published version exactly as it was published, never changed, with when it was published, replaced or withdrawn and by whom), each choice of an option you made in your account and each time you accepted updated terms (which option and version, when, and the sign-in, phone number or email address, IP address, and browser type it came from; a choice is never changed, and a new choice is a new record), each request you made there (with the sign-in it came from; a request is closed as done or canceled, not deleted), the withdrawal of an application, each request for a document the dealership made in your account and each page you sent for it (with the sign-in it came from, and each opening of it; a page you took back or the dealership asked you to replace is marked and kept, not deleted), credit application data and reports, the references and landlord a buyer gave, the payment details a dealership recorded for a loan from another lender (with who saved and confirmed them and when; of the loan account, only its last four digits), where a lender's customers pay as a dealership recorded it, when a purchase was marked complete and by whom, AI-assistant shopper profiles, the business contact details read from public dealership websites, website candidates, the results of their checks and the dates of the visits, and our record of what kind of dealer a business is are kept under the default rule until deleted at the dealership's or your request, or as required by law. When a dealership asks us to stop reading its website, candidates for that website that are still open are closed and the details their checks recorded are emptied; we keep that a check was made, its outcome and the dates of the visits. A business contact detail a website stops publishing is marked as no longer published and kept, because a record that simply forgets a phone number cannot show that it changed. The map coordinates, county, matched address, and location key we work out for a prospective dealership's business address are kept with its record under the same rule. Access, correction, and deletion requests are fulfilled manually by our staff from the underlying records; there is currently no self-service export or delete button.

Listing observations of prospective dealerships' websites. Listing observations Levels made of a prospective dealership's website are kept as the Market Watch site record for that website (Section 4). If the dealership asks, we stop reading its site and delete the observations Levels made, unless a Levels dealership tracks the same website — then they remain that dealership's Market Watch record and we only stop our own reading. The logo copy and the photo addresses are deleted when the dealership asks us to delete, even if a Levels dealership tracks the same website, and 30 days after we stop reading the site for any other reason. Preview links expire after 90 days. Report links expire after 90 days. When a dealership asks us to delete, the content of every report we built for it is erased. We keep the record that a report was sent — to which record, when, and whether its link was opened — and the email we sent, which carries up to three figures from the report, stays in our message log with our other outreach messages. Otherwise a report's content is kept with the dealership's record. Deleted items leave our backups as those backups expire.

Backups. We make a full copy of the database once a day (at 09:30 UTC). The seven most recent copies are kept on the application server in a directory readable only by the service account the application runs as, and every copy is also uploaded to Amazon S3, where it is stored server-side encrypted and kept for the retention period configured on that storage bucket. Uploaded files (photos, documents, license images) are copied to Amazon S3 every six hours; deletions are deliberately not propagated, so a file removed from the live system, including a license photo deleted on schedule, remains in that copy until we remove it by hand. The server configuration that holds our encryption key is not part of any backup. Separately, our database hosting provider (Amazon RDS) keeps its own automated snapshots of the database for 14 days.

13. Security

We use the following measures. No system is perfectly secure, and we cannot guarantee that unauthorized access will never occur.

14. Your privacy rights

14.1 Rights under California law (CCPA/CPRA) and other state laws

If you live in California, you have the right to know what personal information we collect and how we use and disclose it, to access it, to correct it, to delete it, to receive it in a portable format, to opt out of sale or sharing (we do neither), to limit the use of sensitive personal information (we use it only to provide the services you requested), and not to be discriminated against for exercising these rights. Residents of other states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others, have similar rights, and we honor them.

Some information handled through Levels, such as credit reports and credit application data, is governed by federal laws such as the Fair Credit Reporting Act and the Gramm-Leach-Bliley Act and may be exempt from state privacy laws. We will still route your request as described below.

14.2 Requests about information a dealership holds

For information a dealership collected about you (leads, deals, applications, messages, documents), the dealership is the business responsible for deciding how to respond. Contact the dealership using the details on its website. Because deletions and exports from Levels are carried out by Levels at the dealership's direction, you may also send your request to us at admin@levels.dealer; we will confirm receipt, forward it to the dealership within 10 business days, and carry out the dealership's instructions. Consent records, audit trails, and signed transaction documents must be retained by law and cannot be deleted on request.

14.3 Requests about information Levels holds directly

For information Levels controls (your Levels shopper profile from an AI assistant, a waitlist signup, a dealership staff account, or Levels' marketing to your business), contact us at admin@levels.dealer or by mail at Levels Tech LLC, 5151 N Oracle Rd Ste 125, Tucson, AZ 85704.

14.4 How we handle requests

We will verify your identity before acting, usually by confirming control of the email or phone number on the record. You may use an authorized agent if you give the agent written permission and we can verify your identity. We respond within 45 days, and we will tell you if we need more time. If we deny a request, we will explain why, and you may appeal by replying to our decision. We do not charge for requests unless they are excessive or repetitive.

14.5 Marketing choices

Reply STOP to stop texts from the dealership number that sent them, or from Levels' own number. Dealership marketing emails are sent at the dealership's direction; ask the dealership to stop them, or write to us and we will flag your record as opted out. Levels' own product-update emails to dealership owners can be stopped by replying or writing to admin@levels.dealer.

15. Children

Levels and the dealer websites we host are not directed to anyone under 18. Buying or financing a vehicle requires an adult. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided information through Levels, contact us at admin@levels.dealer and we will delete it.

16. Changes to this policy

We may update this policy as the product changes. The current version is always available at https://levels.dealer/privacy, and that page is linked from every dealer website we host, from the ChatGPT connector, and from our QuickBooks app listing. We will post each new version there with a new effective date. For material changes, we will email dealership owners before the change takes effect. Dealerships are responsible for updating their own customer notices when our practices change.

17. Contact us and governing law

This policy is governed by the laws of Arizona, and any dispute about it will be brought in the courts of Pima County, Arizona, without regard to conflict-of-law rules.