Your Privacy Matters

Understand how we manage personal data, cookies, analytics, and online privacy rights for website visitors and customers.

Last Updated: May 21, 2026

Effective Date: July 1, 2004

Version: v2.0

1. Introduction

This Privacy Policy describes how Metzger Enterprises LLC d/b/a AutoRevolution, including its subsidiaries and affiliates, a Texas Limited Liability Company ("Company," "AutoRevolution," "LotPix," "Vehicle Image Studio," "Forward2Phone," "IIManager," "we," "us," or "our"), respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, store, process, retain, and safeguard personal information with the Company's software-as-a-service platform, including website hosting, CMS, CRM, marketing, analytics, applications, SMS communication, artificial intelligence tools, mobile applications, APIs, cloud infrastructure, integrations, and related technology used for vehicle photography, inventory merchandising, dealership operations, and automotive retail workflows (collectively, the "Services").

This Privacy Policy applies to enterprise customers, including automotive dealerships, dealer groups, reseller organizations, auction groups, OEM-affiliated entities, fleet operators, and other authorized business customers ("Customer"), as well as individuals authorized by Customer to access or use the Services ("Authorized Users").

"LotPix", "Vehicle Image Studio", "IIManager", and "Forward2Phone" are products owned and operated by AutoRevolution, a business-to-business (B2B) software-as-a-service (SaaS) company designed solely for use by licensed automotive businesses, including dealerships, dealer groups, resellers, auctions, and fleet operators. It is not intended for consumer, personal, or household use, and may only be accessed and used through the AutoRevolution platform and its authorized systems.

This Policy applies to users across the United States and Canada and is designed to comply with applicable laws including This Privacy Policy is designed to comply with applicable U.S. federal and state privacy laws, including but not limited to the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), Virginia Consumer Data Protection Act ("VCDPA"), Colorado Privacy Act ("CPA") including AI Act, Texas Data Privacy and Security Act ("TDPSA"), Connecticut Data Privacy Act ("CTDPA"), and other applicable laws.

1.1 Audience & Use

Licensed vehicle dealers, dealer groups, resellers, auctions, fleet operators, and OEM-affiliated entities only
Authorized employees, contractors, and agents of Customer
Not intended for consumer or household use
Not intended for minors under 18
No consumer accounts are knowingly created or supported

The Company does not knowingly collect data from minors.

2. Scope and Applicability

2.1 Scope

This Privacy Policy applies to personal information collected:

Through our Services and SaaS platform;
Through websites, applications, or systems hosted for dealerships, clients, or customers ("Hosted Sites");
Through communications, integrations, transactions, events, and business relationships.

Each party shall comply with all applicable federal, state, local, and international laws, regulations, ordinances, rules, and governmental requirements applicable to its performance under this Agreement and its use or provision of the Services.

Without limiting the foregoing, Customer is solely responsible for ensuring compliance with:

Privacy and consumer protection laws;
Data protection and security laws;
Export control and sanctions laws;
Automotive dealer and advertising regulations;
Employment and workplace laws;
Surveillance, image capture, and biometric privacy laws (including BIPA where applicable).

Customer is solely responsible for determining legality of its use of the Services.

Company does not provide legal advice or compliance certification.

2.2 Role of the Company

Depending on the context of processing:

AutoRevolution acts as a "data controller" when determining the purposes and means of processing personal information for its own business operations.
AutoRevolution acts as a "service provider" or "processor "when processing personal information on behalf of dealerships or other clients.

Customer determines the purpose and means of processing Customer Data. Company acts solely as a service provider / processor.

Customer = Controller / Business
Company = Processor / Service Provider

Customer is solely responsible for lawful basis, consents, employee access control, and compliance with applicable law. Customer administrators control employee accounts and may access usage data and activity logs. Employees must direct privacy requests to their employer (Customer).

LotPix operates on iOS and Android platforms provided by Apple and Google.

Device-level telemetry may be processed by operating system providers under their own privacy policies.

This Privacy Policy does not apply to:

Third-party websites, services, or platforms not controlled by AutoRevolution
Dealerships, and clients using our platform (their policies govern their practices)

3. House of Brands & Platform Structure

Metzger Enterprises LLC d/b/a AutoRevolution operates multiple products or brands:

Data may be processed across internal systems;
Shared infrastructure may support authentication, billing, analytics, security, and service delivery;
Each product may have different features, but centralized data governance applies.

4. Categories of Personal Information Collected

We collect the following categories of personal information:

4. Information We Collect

4.1 Identifiers and Account Information

Name
Email address
Mailing address
Phone number
Business address and contact information
Dealership name and entity details
Dealer license numbers
IP address
Device identifiers
Online identifiers
Employee accounts, roles, and permissions
Account credentials
User credentials and authentication data
Account history

4.2 Vehicle Photos & Media

Vehicle photos and videos
Inventory merchandising media
Image and photographic data
Upload timestamps and logs
EXIF metadata
Capture event records

4.3 Vehicle Inventory Data

Vehicle Identification Number (VIN)
Make, model, year, and trim
Mileage and vehicle condition
Pricing data
Buyer's Guide and sticker data

Vehicle inventory data is generally not considered personal information unless it is linked to an identifiable individual.

4.4 Customer Records and Commercial Information

Billing and shipping addresses
Transaction records and transaction history
Products or services purchased, obtained, or considered
Preferences and interactions
End User Data processed on behalf of customers
Payment-related metadata processed by third-party payment providers

4.6 Geolocation Data

GPS location (when enabled)
Approximate location derived from IP address
Approximate location derived from device settings
Approximate location derived from photo metadata
Dealership lot metadata

Location data may be embedded in photos or videos if enabled through device settings.

4.7 Communications and Audio, Electronic, or Visual Information

Support requests
Training interactions
Email communications
Chat transcripts
Support logs
Communications with our team
Call recordings for quality assurance purposes
Images and vehicle photos submitted through our platform

4.8 Device Permissions

Camera access
Photo library access
Microphone access (for video capture)
Location services access (optional)

4.9 Financial Information (If Applicable)

Credit application data
Income information
Employment information

4.10 Professional or Employment Information

Business name
Job title
Dealership affiliation

4.11 Inferences and Profiling Data

Preferences
Interests
Characteristics
Behavioral insights derived from use of our Services

4.12 Aggregated and De-Identified Data

We may use anonymized, aggregated, or de-identified information for analytics, performance improvement, product development, security monitoring, system optimization, and other lawful business purposes.

4.13 Sensitive Personal Information (CPRA Definition)

We may collect limited categories of sensitive personal information, including:

Precise or approximate geolocation (if enabled and permitted by law);
Account login credentials;
Financial/credit related information related to transactions (if submitted).

We use Sensitive Personal Information only as reasonably necessary to:

Provide Services;
Prevent fraud and ensure security;
Process transactions;
Legal compliance.

You may have the right to limit use of sensitive data under applicable law.

5. Sources of Personal Information

We collect personal information from:

You directly (forms, communications, account creation);
Your employers, organization, or business partners;
Automated technologies (cookies, pixels, analytics tools);
Third-party partners, service providers, and integrations (dealerships, marketing providers, data integrations, social media);
Subprocessors acting on our behalf;
Billing and payment information (via third-party processors);
Device identifiers;
Publicly available sources;
End User Data (Processed on Behalf of Customers);

We do not control the content or purpose of Customer Data.

6. Purposes for Processing Personal Information

We process personal information only as reasonably necessary to provide, operate, maintain, secure, improve, and support our Services, and for the following purposes:

Vehicle inventory photography, merchandising, and inventory management workflows.
Inventory listing creation, publication, optimization, and management.
Buyer's guide, window sticker, and related vehicle documentation generation.
Provide, operate, maintain, and improve the Services.
Process transactions, payments, and fulfill contractual obligations.
Create, authenticate, manage, and secure user accounts.
Generate, process, manage, and track leads and customer relationship management (CRM) activities.
Deliver marketing, advertising, promotional communications, and campaign measurement activities, subject to applicable consent requirements.
Personalize content, features, and user experiences where permitted by law.
Conduct analytics, reporting, performance tracking, research, and product development activities.
Provide SMS, email, and other communication services.
Respond to inquiries, customer support requests, onboarding activities, and administrative communications.
Detect, prevent, investigate, and respond to fraud, unauthorized access, security incidents, and illegal activities.
Maintain platform security, monitor system performance, perform debugging, and improve system reliability.
Develop new products, services, features, and offerings.
Comply with applicable laws, regulations, legal obligations, and enforcement requests.

Where required by applicable law, we process personal information based on one or more legal grounds, including contractual necessity, legitimate business interests, consent, and compliance with legal obligations.

We collect, use, retain, and process personal information only to the extent reasonably necessary and proportionate to achieve the purposes described in this Privacy Policy and consistent with applicable law.

7.1 Categories of Cookies

Strictly Necessary - required for operation;
Performance/Analytics - measure usage;
Advertising - personalize content.

7.3 Opt-Out Options

Browser settings to block cookies (may affect functionality);
Device-level controls;
Mobile device advertising ID settings for opt-out;
Google Analytics opt-out tools ( Browser Add-on);
Global Privacy Control (GPC) signals (honored where required);
Cookie Preference Banner;
AutoRevolution Opt-Out Request Form.

8. Disclosure of Personal Information

We may disclose personal information to:

8.1 Service Providers (Subprocessors)

Hosting providers;
Analytics providers;
CRM systems and database providers;
SMS and communications vendors;
Advertising and marketing providers;
Payment Processors;
IT Services.

8.2 Advertising and Marketing Partners

We may "sell" or "share" personal information (as defined by applicable law) for targeted advertising purposes.

Customer is solely responsible for compliance with FTC Used Car Rule and all applicable dealership laws.

8.3 Business Partners

When jointly offering products or services

Automotive dealerships;
Marketing and integration partners;
Reseller Partnerships.

8.4 Legal and Compliance

When required by law enforcement or regulatory authorities to protect rights and safety;
To enforce rights or prevent harm.

8.5 Corporate Transactions

In connection with mergers, acquisitions, restructuring, or asset sales

8.6 Internal Use

Infrastructure and operations;
Security and analytics;
Product improvement.

10. Use of Cookies and Tracking Technologies

We use:

Essential cookies;
Pixels;
Session replay technologies and tools;
Advertising cookies;
Analytics cookies and tools.

These technologies help us:

Understand user behavior;
Deliver targeted advertising;
Improve our Services.

Please see our Cookie and Tracking page for more information.

Global Privacy Control (GPC):

We recognize and honor Global Privacy Control (GPC) signals as valid opt-out requests where required by law.

11. Artificial Intelligence (AI), Automated Decision-Making, and Governance

11.1 Artificial Intelligence (AI)

We may incidentally capture images that include individuals.

We:

Do not use facial recognition;
Do not sell biometric data;
Obtain consent where required;
Retain only as necessary;
Delete securely.

11.2 Automated Decision-Making

We use automated systems, including artificial intelligence, to:

Analyze user behavior;
Personalize content and communications;
Optimize and improve marketing performance.

These activities may constitute "profiling" under applicable laws.

Your Rights:

You may opt out of profiling or automated decision-making that produces legal or similarly significant effects by contacting us;
Request information about automated processing.

11.3 AI Governance

We implement safeguards to:

Reduce bias;
Monitor system performance;
Enable human oversight where appropriate.

12. Data Retention

Data is retained as long as your account exists or as needed to provide Services, comply with legal obligations, resolve disputes, or enforce agreements.

Account data: duration of relationship + up to 36 months;
Lead data: up to 24 months;
Analytics data: 12-26 months;
Marketing data: up to 24 months after last interaction;
Financial/transaction data: up to 7 years;
Legal/compliance data: as required by law or to protect rights;
SMS data: 4 years (TCPA compliance).

Biometric data (if any) is retained:

Only as long as necessary for the purpose collected;
Or as required by law;
Then permanently deleted.

Retention periods may vary based on legal obligations and business needs. We may retain data longer where required by law. We delete or anonymize data when no longer needed.

Customer Data is governed by contract.

13. International Data Transfers

Data may be processed outside the United States and in other jurisdictions where AutoRevolution, its affiliates, employees, contractors, and service providers operate. This includes the transfer and processing of information across locations necessary to support the operation, maintenance, security, and delivery of the Service.

Where required by applicable law, appropriate safeguards are implemented to ensure that such transfers comply with relevant data protection requirements.

Your information may be processed in jurisdictions with different privacy laws.

14. Your Privacy Rights

Requests for End User Data must be submitted to the relevant customer (Dealer), who acts as the Data Controller for such data.

Depending on your location and subject to applicable law, individuals may have the following rights:

Right to Access personal information;
Right to Correct inaccuracies;
Right to Delete personal information;
Right to Opt Out of sale/sharing;
Right to Opt Out of targeted advertising;
Right to Opt Out of profiling;
Right to data portability.

Appeals

If your request is denied, you may appeal by contacting us at:

Email: compliance@autorevolution.com

15. Canadian Privacy Rights

Canadian residents have rights under applicable privacy laws, including access and correction rights.

16. Your Privacy Rights (Multi-State)

Depending on your state of residence, you may have the following rights:

Access your personal information;
Correct inaccurate information;
Delete your personal information;
Obtain a copy (portability).

Sensitive Data Rights

Limit use of sensitive data;
Withdraw consent (where applicable).

Opt out of:

Sale of personal information;
Sharing for targeted advertising;
Profiling in furtherance of significant decisions.

How to Exercise Your Rights:

Submit a request via:

Web form: Opt Out Request Form;
Email: compliance@autorevolution.com.

We may verify your identity before processing requests.

Appeals:

If your request is denied, you may appeal by contacting:

Email: compliance@autorevolution.com

17. State-Specific Privacy Rights

17.1 California (CCPA / CPRA)

Right to know, delete, correct;
Right to opt out of sale/sharing;
Right to limit sensitive data use.

17.2 Texas Residents (TDPSA)

Access, delete, correct;
Opt out of targeted advertising and profiling.

17.3 Virgina Residents (VCDPA)

Access, delete, correct;
Opt out of targeted advertising;
Right to appeal decisions.

17.4 Colorado Residents (CPA + AI Act 2026)

Opt out of profiling;
AI transparency rights.

17.5 Connecticut Residents (CTDPA)

Sensitive data consent;
Profiling opt-out.

17.6 Utah Residents (UCPA)

Access and opt-out rights.

17.7 Other States (Oregon, Montana, Tennessee, Indiana, Kentucky, Rhode Island, Connecticut, Oregon, Delaware, Iowa, Indiana, Tennessee)

Similar rights including:

Access;
Deletion;
Opt-out of targeted advertising.

Specialized Laws

Illinois Biometric Information Privacy Act (BIPA);
State Data Broker Laws (CA): We will follow section 29. Data Broker Disclosure
50-State Breach Notification Laws: We will follow section 21. Data Breach Notification Clause in accordance with applicable federal and state laws.

18. Exercising Privacy Rights

Requests may be submitted through:

Web form: Opt Out Request Form;
Email: compliance@autorevolution.com/li>

Verification

We may verify your identity prior to processing requests.

Response Time

We respond within 45 days, extendable where permitted.

Appeals

Appeals:

If your request is denied, you may appeal by contacting:

Email: compliance@autorevolution.com

19. Non-Discrimination

We will not discriminate against you for exercising your privacy rights.

20. Data Security

We implement reasonable administrative, technical, and physical safeguards designed to protect personal information;
No internet system is fully secure; we do not guarantee absolute security;
In the event of a data breach, we will follow section 21. Data Breach Notification Clause in accordance with applicable federal and state laws.

21. Data Breach Notification Clause

In the event of a data breach involving personal information, we will:

Investigate and contain the incident promptly;
Notify affected individuals without unreasonable delay and in accordance with applicable state laws;
Provide notice within required statutory timelines, including 30 days where mandated;
Notify relevant regulatory authorities when required.

Notifications will include:

Nature of the breach;
Categories of data affected;
Provide steps individuals can take to protect themselves;
Contact individuals for further assistance.

22. Financial Information (GLBA Notice)

If you submit financial or credit-related information:

Such data may be subject to the Gramm-Leach-Bliley Act (GLBA);
We implement safeguards to protect this information;
Data is used only for permitted purposes;
Additional privacy notices may apply.

23. Image Data, Vehicle Photography, and Biometric Data

Biometric Information and Image Data Processing

Our photography application is designed to capture and process images of vehicles for inventory, marketing, and analytics purposes.

While images are intended to capture vehicles, they may incidentally include individuals or facial features that could be considered biometric identifiers under applicable law.

To the extent such data constitutes biometric or sensitive data, Company applies reasonable safeguards including:

Data minimization;
Access controls;
Retention limitation;
Security protections.

Customer is solely responsible for lawful collection, signage, and consent obligations.

We do not use facial recognition to identify individuals.

Inventory-related photographs and videos captured through LotPix are transmitted to and stored within the Customer’s designated inventory management environment maintained through AutoRevolution. Upon successful transmission, LotPix is designed, where technically feasible and supported by the applicable device, operating system, and network conditions, to automatically remove such media from local device storage.

The Company does not intentionally retain inventory media on user devices following upload and does not maintain any permanent local storage of such media within the application.

However, the timing and effectiveness of media deletion may be affected by factors beyond the Company’s reasonable control, including device limitations, offline operation, synchronization processes, operating system behavior, user actions, or other technical constraints, and therefore immediate or complete removal from local storage cannot be guaranteed in all circumstances.

Company maintains reasonable practices aligned with biometric privacy principles but does not admit biometric collection under law.

24. Third-Party Links

Our Services may contain links to third-party websites.

We are not responsible for their privacy practices.

25. Children's Online Privacy Protection Act (COPPA)

Our Sites are not directed to children under 13, and we do not knowingly collect personal information from children under 13.

If such data is identified:

If we discover such information, we will delete it immediately;
Parents may contact us to request deletion.

26. Changes to This Policy

We may update this Privacy Policy periodically.

Changes will be posted with a revised "Last Updated" date.

27. Contact Information

AutoRevolution
334 East Church Street
Lewisville, Texas 75057
United States

Phone: 972-243-8460
Email: compliance@autorevolution.com

28. Notice of Right to Opt Out

You have the right to opt out of the sale or sharing of your personal information.

See: Opt Out Request Form

29. Data Broker Disclosure

If we qualify as a data broker under applicable law, we will:

Register as required;
Provide deletion mechanisms;
Comply with applicable data broker obligations.

Critical Exceptions

AutoRevolution is not a data broker.

You are NOT a data broker if:

Acting purely as a service provider/processor;
Processing data only on behalf of a client;
No independent use or monetization.