How we handle your data.
Plain-language summary of what we collect, who helps us process it, how long we keep it, and the rights you have over it. Questions: privacy@autoadvisorpartners.com. Last updated June 13, 2026.
Tenant isolation
Your shop’s data is logically isolated per account at the database layer (row-level security), so one customer can never see another’s data. Your data is never used to train any public AI model.
What we collect
Account information (your email), the operational data you and your team enter or that your connected systems sync (customers, vehicles, appointments, repair orders, parts, financial and people records), AI-agent activity logs, and standard request metadata. We do not collect or store full payment-card numbers, SSNs, or bank credentials.
Separately, if you use one of our marketing tools without creating an account, we keep the contact details you give us: the revenue-leak calculator, a Service-Drive Audit request, or a masterclass sign-up. These are stored in our CRM (your name, shop, email, and what you told us), separate from any platform workspace.
Sub-processors
We use a small set of vetted third parties to run the platform. Each receives only the data needed for its function:
| Sub-processor | Purpose | Data shared | Region |
|---|---|---|---|
| Supabase | Authentication + primary Postgres database (tenant data at rest) | Account email, and your shop’s operational records | US (AWS us-west-1) |
| Google Cloud (Cloud Run, Secret Manager) | Application hosting + secret storage | All request/response traffic in transit; no separate data store | US (us-west1) |
| Anthropic (Claude) | The in-app AI assistant + agent reasoning | The prompt context for a request (shop KPIs, schedule, the message you send). Anthropic does not train on API data. | US |
| ElevenLabs | The AI voice agent (inbound/outbound calls + voice previews) | Call audio and the phone number dialed | US |
| Apify | Public-business lead research (operator-initiated) | Public business listings (name, phone, public reviews) | US/EU |
Outbound communications
The platform can place AI voice calls and send emails on your behalf. Outbound calls require recorded consent on the contact and are blocked for anyone on a Do-Not-Call list, enforced in software. The AI identifies itself immediately and honors removal requests. Emails include an unsubscribe path. You control each agent’s autonomy (Off / Approve / Auto).
Retention & deletion
Platform workspaces. We keep your data for as long as your workspace is active. A workspace owner can permanently delete the entire workspace and all of its data at any time from Settings → Delete this workspace, which cascades to every record. Any signed-in member can also download a machine-readable copy of their shop’s data at any time from Settings → Download your data, or email privacy@autoadvisorpartners.com for help. We honor verified requests promptly.
Marketing leads. If you reached us through the revenue-leak calculator, a Service-Drive Audit request, or a masterclass sign-up (and never created an account), you have the same two rights. From Manage your data you can export a machine-readable copy of everything we hold for you, or permanently delete it. To protect you, we first email a secure link to the address on file (double opt-in), so only you can act on your data, then deletion is a true erasure of your record, not a hidden flag.
Your rights
Depending on your jurisdiction (incl. GDPR, CCPA/CPRA, LGPD) you have the right to access, correct, export, and delete your personal data, and to object to certain processing. Contact us to exercise any of these; we do not sell personal data.
Security
Data is encrypted in transit (TLS) and at rest. Access is gated by authentication and role-based authorization; the platform applies standard web-security headers and rate limiting. See our security posture summary on request.