Privacy Policy

AutoElite is a Quebec-based SaaS platform built for Canadian automotive dealers. We operate from Montreal and comply with Quebec's Act respecting the protection of personal information in the private sector (Loi 25), as well as Canada's federal PIPEDA. This policy explains what we collect, how we use it, who we share it with, and the rights you have over your information.

Who we are (Controller)

AutoElite is operated by AutoElite Technologies Inc., a company established in Montreal, Quebec, Canada. For all personal information that AutoElite collects directly from website visitors (for example through this marketing site and our contact forms), AutoElite is the data controller. For personal information that a dealer uploads about its own customers into the platform, the dealer is the controller and AutoElite is the processor — see "Customer data and Loi 25" below.

You can reach our data protection officer (DPO) at dpo@autoelite.io or by mail at: AutoElite, attn. DPO, Montreal, Quebec, Canada.

Information collected through this marketing site

When you submit a contact form, request a demo, or sign up for a free trial on this site, we collect the information you provide:

• Your name and business email address.
• Your phone number (optional).
• Your dealership name and the AutoElite plan or feature you are interested in.
• The free-text message you write to us, if any.
• Technical signals collected automatically: IP address, browser user-agent, page URL, timestamp, and a Cloudflare Turnstile validation token.

We use this information solely for lead qualification, to respond to your inquiry, to schedule a demo, and, if you have consented, to send you occasional product news. We do not enrich it with third-party data brokers and we do not use it to train AI models. We rely on your explicit consent — captured via the checkbox on the contact form — as the legal basis for processing.

What information we collect

• Account information — names, email addresses, phone numbers, and roles for the dealer staff members who sign in to AutoElite.
• Dealership and inventory data — vehicle listings, pricing, photos, deal records, contracts, and operational data that the dealer chooses to manage in our platform.
• Customer personal information — names, contact details, government IDs, financing information, and signed documents that a dealer uploads or that a customer submits through a dealer-branded portal. We collect this only when the dealer has obtained the customer's consent.
• Billing information — subscription plan, payment method last-four, and invoice history. Full payment-card data is handled directly by Stripe and never touches our servers.
• Technical data — IP address, browser type, and request logs needed to operate the service securely.

How we use it

We use the information above strictly to deliver and support the service:

• To provide the AutoElite platform and the features each dealer subscribes to.
• To process billing, send invoices, and prevent fraud on subscription payments.
• To respond to support requests and operate the help channels.
• To send transactional emails (account, billing, security, document signing).
• To monitor performance, diagnose issues, and improve reliability.
• To comply with legal obligations under Quebec and Canadian law.

We do not sell personal information. We do not use customer data to train third-party AI models.

How we share it

We share data only with the service providers required to run the platform, and only the minimum each one needs:

• Stripe — subscription billing and payment processing.
• Cloudflare — application hosting, storage, database, and edge security.
• Twilio — outbound SMS and voice calls initiated by dealer staff.
• Email delivery providers — transactional email for receipts, document signing, and notifications.

We never sell personal information to advertisers, data brokers, or any other third party. We disclose information to law enforcement only when compelled by a valid Quebec or Canadian legal order.

Customer data and Loi 25

When a dealer's customer interacts with AutoElite — submitting a financing application, signing a contract, or messaging through a dealer portal — the dealer is the data controller for that customer's personal information. AutoElite acts as the data processor on the dealer's behalf.

Under Loi 25, the customer has the right to:

• Access the personal information held about them.
• Have inaccurate information rectified.
• Request deletion of personal information that is no longer required.
• Withdraw consent for processing, subject to legal retention obligations.
• Receive their information in a portable, structured format.

Customers should direct these requests to the dealer they transacted with. If a customer is unable to reach the dealer, or if the request concerns AutoElite as a service provider, contact us at the address below and we will route the request to the correct party.

Security

We protect the platform with the controls expected of a modern SaaS:

• Cloudflare WAF and DDoS protection on every edge request.
• Encryption in transit (TLS 1.2+) and at rest for stored data.
• Role-based access controls so staff see only the records they need.
• Session timeouts, login notifications, and audit logs on sensitive actions.
• Hashed passwords and credential rotation on suspected compromise.

No system is perfectly secure. If we ever detect a confidentiality incident that presents a risk of serious harm, we will notify affected dealers and the Commission d'accès à l'information du Québec without delay, as required by Loi 25.

Retention

• Marketing leads and contact-form submissions — retained for up to 24 months from your last contact with us, after which the record is deleted or anonymized. You can request earlier deletion at any time.
• Account and operational data — kept for the lifetime of the subscription, plus a 30-day grace period after cancellation so the dealer can export records before deletion.
• Financial and contract records — retained for 7 years to meet Quebec tax, civil, and consumer-protection obligations, even after subscription cancellation.
• Backups — rolling encrypted backups expire on a documented schedule and are not used for any purpose other than disaster recovery.

International transfers

AutoElite is hosted on Cloudflare's global edge network. Your data is stored in Cloudflare data centres located in Canada and the United States, and may be served from edge points-of-presence in Canada, the United States, and the European Union when you visit the site from those regions. Stripe (billing) and Twilio (SMS/voice) are United States–based service providers. When personal information is transferred outside Quebec, AutoElite carries out a privacy impact assessment as required by Loi 25 and binds the recipient by written agreement to confidentiality, security, and use limitations equivalent to those required under Quebec law. The list of sub-processors and storage regions is available on request from our DPO.

Your rights under Loi 25

You can exercise the following rights with respect to the personal information AutoElite holds about you as a controller (visitors, leads, dealer-account holders):

• Access — obtain a copy of the personal information we hold about you.
• Rectification — correct inaccurate or out-of-date information.
• Deletion — request erasure when the information is no longer necessary.
• Portability — receive your information in a structured, commonly used, machine-readable format.
• Withdraw consent — opt out of further processing or marketing communications at any time.
• Object to automated decisions — we do not use AutoElite to make decisions about you based solely on automated processing.

To exercise any of these rights, email dpo@autoelite.io . We respond within 30 days. If a customer of a dealer wishes to exercise these rights against their dealer (the controller), see the next section.

Cookies and tracking

We use a small number of cookies and similar technologies, all strictly necessary or security-related — we do not use advertising, profiling, or cross-site tracking cookies on this marketing site.

• Cloudflare Turnstile — a privacy-respecting bot-protection challenge that runs invisibly when you submit a contact form. Turnstile does not use third-party advertising trackers and does not fingerprint your device for marketing purposes; it evaluates signals such as request headers and timing to confirm you are a human. Setting a Turnstile validation cookie is necessary to protect the form from abuse and is the legal basis under our legitimate interest in securing the service.
• Cloudflare network cookies — used to route requests, mitigate DDoS attacks, and protect site availability.
• Session cookies (dealer / client portals) — used only after you sign in, to keep you logged in until your session expires.

We do not deploy Google Analytics, Facebook Pixel, or any other behavioural advertising tag on this marketing site.

Contact

For privacy questions, access requests, or any concern about how AutoElite handles personal information, contact our data protection officer at dpo@autoelite.io .

If you are not satisfied with our response, you have the right to file a complaint with the Commission d'accès à l'information du Québec (CAI):

• Mail: Bureau 1.10, 525, boul. René-Lévesque Est, Québec (Québec) G1R 5S9
• Phone: 1 888 528-7741 (toll-free) or 418 528-7741
• Web: cai.gouv.qc.ca

Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of the page reflects the most recent revision. Material changes will be announced on this page and, where appropriate, by email to active dealer accounts.