Privacy Policy

Account information. Your email address, your name if you give it, and a securely hashed version of your password. We never store your password in readable form.

Payment information. When you buy credits, our payment provider Commas (FanBasis) handles your card details. We don’t receive or store full card numbers. We keep a record of each purchase: the amount, date, status, and the provider’s reference, so we can show your history and handle refunds.

Usage and billing records. How many vehicles you’ve scanned, your credit balance and ledger, your connected extensions (with the browser name, version, and the IP address last seen), and basic security logs such as sign-ins and admin actions.

Technical information. Your IP address and request information, used for security, rate-limiting, and fraud prevention.

Support messages. What you send us when you ask for help.

The DealerDrop browser extension runs in your browser. Most of what it touches never leaves your device:

• Stays on your computer: the vehicle inventory you scan (details and photo links), your posting queue and history, your Facebook group settings, description templates, and preferences. These are stored locally in your browser, not on our servers.
• Sent to our servers, only to run the Service: your account sign-in token, and — for billing — a vehicle identifier (the VIN, or a one-way code derived from the vehicle’s page address) plus its color text, which our server matches to a Marketplace color and returns. We don’t receive your scanned photos, descriptions, or full vehicle records.
• We never receive your Facebook login. The extension acts inside your own signed-in Facebook session in your browser. It doesn’t see, collect, or store your Facebook username or password.

• To create and run your account and let the extension sign in.
• To meter and bill credits, process payments through Commas, and show your usage and payment history.
• To provide support and respond to you.
• To keep the Service secure: prevent fraud and abuse, rate-limit requests, and investigate security events.
• To send essential account emails (confirm your email, reset your password, important account or billing notices). We don’t send marketing email without your consent.
• To meet legal and accounting obligations.

We rely on the legal bases of performing our contract with you, our legitimate interest in running and securing the Service, your consent where required, and compliance with the law.

We don’t sell your personal information and we don’t share it for advertising. We share it only with:

• Service providers that run the Service for us, under contracts that limit their use of it: our hosting and database provider (Vercel and Neon), our payment provider (Commas / FanBasis), and our email provider (Resend).
• Legal and safety: when we’re required by law, or to protect our rights, our users, or the public.
• Business transfer: if DealerDrop is involved in a merger, acquisition, or sale of assets, with notice to you.

We use an essential cookie to keep you signed in. We also use Meta Pixel, provided by Meta Platforms, Inc., on pages across the site to measure visits and understand the effectiveness of our advertising. Meta Pixel may read or store cookies and receive information such as your IP address, browser and device details, the pages you visit, and page-view and registration events. Meta may use this information under its own privacy policy, including to measure or personalize advertising.

You can review Meta’s Privacy Policy for details about how Meta processes information.

We keep account and usage data while your account is open. Payment and billing records are kept as long as the law requires for accounting and tax. Security logs are kept for a limited period. When you delete your account, we remove your personal details promptly and keep only the records we’re legally required to retain (such as payment history), in a minimized form.

• Access and update: view and change your profile, see your usage and payments, and manage connected extensions in your dashboard.
• Delete: delete your account from your dashboard. This removes your personal details and signs out every browser and extension.
• Email: essential account emails are required while you have an account; there’s no marketing email to opt out of.
• Local data: clear the extension’s local data from its settings, or by removing the extension.

Depending on where you live (for example, the EU/UK or California), you may have additional rights to access, correct, delete, or port your data, and to object to certain processing. To exercise any right, email support@dealerdrop.tech. We don’t sell or “share” personal information as those terms are defined under California law.

We protect your data with measures including: passwords hashed with a strong algorithm (argon2id), sign-in and extension tokens stored only as one-way hashes, encrypted connections (HTTPS), rate limiting and account lockout, payment crediting only through a verified provider signature, and a strict content-security policy. No system is perfectly secure, but we work to keep your information safe and will notify you of a breach where the law requires.

DealerDrop is a business tool and isn’t directed to children. We don’t knowingly collect information from anyone under 18. If you believe a minor has given us information, contact us and we’ll delete it.

We operate from the United States, and your information is processed there. If you use DealerDrop from another country, you understand your information is transferred to and processed in the U.S.

We may update this policy. If we make a material change, we’ll notify you by email or in the dashboard before it takes effect. The “last updated” date above always shows the current version.

Questions, or want to exercise a privacy right? Email support@dealerdrop.tech. For general help, see our support page.