Privacy Policy

Effective date: October 16, 2026

This Privacy Policy explains how DealerPointe, LLC collects, uses, shares and protects information through our public website at dealerpointe.com (the “Website”) and through Censa™, our software service for automotive dealerships (the “Censa platform” or “Censa”). It also explains the choices available to you.

1. Who We Are

DealerPointe, LLC (“DealerPointe,” “we,” “us” or “our”) is a North Carolina limited liability company that has operated since 2019. Our principal address is 12400 Wake Union Church Rd #3-202, Wake Forest, NC 27587. We provide four service offerings to businesses:

Censa™ Technology Expense Optimization, our own software and service for reviewing a dealership’s software and technology expense lines.
Process Design & Customer Retention: designing, writing and training dealership processes across departments, including written playbooks, training and on-site coaching; helping staff use their existing tools as designed; and improving customer satisfaction and retention.
Fractional GTM & Revenue Leadership: go-to-market strategy and playbooks, fractional sales leadership (including representing a client’s offerings to prospects), and aligning sales pipelines to dealer group buying cycles.
Specialized Advisory & Transactions: vehicle import compliance guidance, operational due diligence for mergers and acquisitions, and post-acquisition integration advice.

All of our services are advice, coaching and software only. We do not install, configure, maintain, update, fix, monitor or support technology for customers, we do not audit customers’ CRM or DMS systems, and we do not access or log into customers’ computer systems or handle their consumer customers’ information.

Our customers are businesses — auto dealerships and dealer groups, and automotive technology and service companies — not individual consumers. The people who use Censa are our customers’ executives (for example, a CFO, controller or dealer principal) and staff they invite.

This Policy covers the Website and the Censa platform. Our other service engagements are governed by the written agreements we sign with each customer (such as a Consulting Services Agreement and Statement of Work), which control how we handle any customer information shared with us during that work.

2. Information We Collect

2.1 Booking a call

When you book a call through the scheduler on our Website, we collect:

Your name
Your work email address
Your dealership, dealer group or company name
The number of stores, if you are a dealer
Any optional note you choose to include

Scheduling is handled through Microsoft Bookings. Intro calls are 30-minute Microsoft Teams video calls. When you join a Teams call, Microsoft processes information such as your display name and connection data under its own terms and privacy statement.

2.2 Website usage data and cookies

When you visit the Website, our hosting provider and web servers automatically receive standard technical information, such as your IP address, browser type, device type, pages requested, referring page, and date and time of the request. We do not use analytics or advertising cookies on the Website. See our Cookie Notice for details.

2.3 Censa user account data

Censa is a private, invitation-only application. It is not indexed by search engines. For each person a customer invites, we hold:

Name and work email address
Sign-in records (for example, when a user signed in, failed sign-in attempts, the single-use sign-in codes we emailed, and which sign-in method each user chose)
Audit logs of actions taken in Censa (for example, uploads, decisions recorded and report delivery)

2.4 Customer expense data

To review a dealership’s technology spending, the dealer’s controller exports a CSV file of software and technology expense lines — not the full general ledger — and uploads it after signing in to Censa. To sign in, the user chooses either a 6-digit sign-in code emailed to their work address, which works once and expires after 15 minutes, or two-step sign-in with an authenticator app. Censa is designed to limit what it receives:

Six columns only. Censa accepts only these columns: store, vendor, department, amount, date and seats (seats is optional). A file with any other column is rejected before its contents are processed.
Masking. Long digit strings in the text, such as account or check numbers, are replaced with “•” before anything is saved.
Headcount. The dealer also enters rough headcount by department. These are numbers only, with no names.

Censa does not collect the personal or financial information of a dealership’s own customers (consumers). It receives only vendor expense lines. It is not a system for storing consumer “nonpublic personal information.”

2.5 Communications

If you email us or communicate with us on a call, we keep a record of the communication and your contact details so we can respond and provide our services.

3. How We Use Information

We use information to:

Respond to booking requests, schedule calls and follow up with you about our services.
Create and manage Censa user accounts, send single-use sign-in codes by email, check authenticator codes and authenticate users.
Provide the Censa service: automatically match expense lines to our catalog of known vendors and flag possible waste, such as duplicate tools, unused seats, overlapping contracts and forgotten subscriptions, with AI assistance reviewed by a person (see below).
Support the review call, in which a DealerPointe advisor reviews the findings with the dealer on a Microsoft Teams video call. The dealer makes every keep, cut or right-size decision. Censa does not cancel anything or contact vendors unless the dealer asks.
Generate and email the executive report (PDF) to the dealer’s CFO or other designated recipient, and support follow-up check-ins on savings outcomes.
Keep Censa secure, including maintaining audit logs, detecting and preventing misuse, and troubleshooting.
Operate, maintain and improve the Website and our services.
Comply with law, enforce our agreements and protect our rights.

Censa’s matching and analysis is automated, but it does not make decisions about individuals. People review every finding. DealerPointe does not use Customer Data to train artificial-intelligence models.

AI assistance. Censa uses AI models from Anthropic, PBC (Claude) to help DealerPointe’s advisor prepare each review: researching vendors’ public product information for the vendor catalog, suggesting matches for vendor names Censa does not recognize, spotting tools that may do the same job, checking what a dealer’s main systems already include, looking up public renewal and manufacturer program terms, and drafting questions, letters and report summaries for the advisor to edit. DealerPointe’s server sends the AI provider only: vendor names and expense-line descriptions, with long numbers already masked, each tool’s category, capabilities, monthly cost, seat count and number of stores; the franchise brands sold, for manufacturer program checks; and job titles Censa could not place in a department, without names or headcounts. Some research reads vendors’ and manufacturers’ public websites through the provider’s web search. We never send the dealer group’s name, store names, people’s names, email addresses, account numbers or any consumer information. The AI runs only on DealerPointe’s server, not in your browser. Its output is only a suggestion. A DealerPointe advisor reviews every suggestion before it affects a catalog entry, a finding, a question sent to the dealer or the report. We find it. You decide. Anthropic does not train its models on data sent through its commercial service and keeps that data only for a limited time.

4. Legal Bases and Purposes

We process information only for the purposes described in this Policy. Where a law requires a legal basis, we rely on:

Contract: to provide Censa and related services to our business customers and their authorized users.
Legitimate business interests: to respond to business inquiries, market our services to business contacts, secure our systems and improve our services, where those interests are not outweighed by your rights.
Legal obligation: to comply with applicable laws, regulations and lawful requests.
Consent: where required, for example for certain marketing emails. You may withdraw consent at any time.

5. Business Customer Data vs. Personal Data

Most of the data in Censa is business data about a dealership’s technology vendors and spending. For Customer expense data and other information a dealership provides to Censa (“Customer Data”), we act on behalf of, and under the instructions of, our business customer. The customer’s agreement with us, including any Data Processing Addendum (“DPA”), governs that data. If you are a user at a dealership and have a question about Customer Data, please contact your dealership as well as us.

We act on our own behalf for information we collect through the Website, booking requests and general business communications.

6. How We Share Information

We share information only as described here:

Sub-processors and service providers who help us operate the Website and Censa, under contracts that limit their use of the information to providing services to us:

Provider	Purpose
WP Engine	Hosting of the public Website
Supabase (database), Render (application server) and Vercel (app delivery)	Censa hosting and database
Resend	Delivery of sign-in codes, reports and service emails
Microsoft 365 (Outlook, Teams and Bookings)	Business email, video calls for intro and review calls, and call scheduling
Anthropic, PBC	AI model provider for the research assistant (vendor research, match suggestions, overlap and coverage checks, and drafts for the advisor); receives masked vendor and spend details, never names, account numbers or consumer information

Within the customer’s organization: the executive report is emailed to the customer’s designated recipient. Users the customer invites can add information to Censa (the expense file, headcount and answers to the advisor’s questions); findings and reports are not viewable in Censa.
Vendors, at the dealer’s request only: we do not contact a dealer’s vendors unless the dealer asks us to.
Legal and safety: when we believe in good faith that disclosure is required by law, subpoena or court order, or is needed to protect the rights, property or safety of DealerPointe, our customers or others.
Business transfers: in connection with a merger, acquisition, financing or sale of all or part of our business, subject to confidentiality obligations.
With consent: in any other case where you or the customer directs us to share.

A current list of sub-processors is available on request at info@dealerpointe.com.

7. No Sale of Personal Information

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. If we ever use advertising cookies, we will update this Policy and the Cookie Notice first and provide any required opt-out.

8. Retention

8.1 Uploaded expense lines — 7-day deletion

The uploaded expense lines, the headcount figures, and everything built from them are permanently deleted 7 days after the executive report is delivered. For Censa Plus customers, each later upload is likewise permanently deleted 7 days after its report is delivered. DealerPointe staff can place a hold on deletion while a correction is being made. When the hold is released, a fresh 7-day period starts. A hold lasts at most 30 days. After that, the data is deleted even if the hold is still on. An upload that never leads to a delivered report is permanently deleted 60 days after it was uploaded. An audit-log entry records each deletion.

8.2 What we keep after deletion

After the expense lines are deleted, we keep only:

The final executive report (report snapshots are frozen once delivered), with the dealer’s decisions
Its follow-up savings record (savings outcomes and check-ins)
The activity (audit) log

None of these contain account numbers. We keep them for 12 months after the report is delivered, then permanently delete them, and close the dealer’s Censa sign-in accounts at that time unless a newer review is still within its own 12 months. For Censa Plus clients, reports are kept while the plan is active and for 12 months after it ends. DealerPointe’s contracts and invoices are its own business records and are kept as the law requires.

8.3 Backups

Backups taken before deletion expire on our hosting provider’s schedule, which is about 7 days. Until those backups expire any copies of deleted lines in them remain encrypted and are used only to recover from a system failure.

8.4 Other information

We keep user account data for as long as the account is active and for up to 12 months afterward; dealer sign-in accounts are closed as described in 8.2. We keep booking request and business contact information for up to 24 months after our last contact with you, or until you ask us to delete it, unless we need it longer to comply with law or resolve disputes.

9. Security

We use administrative, technical and physical safeguards designed to protect information, including:

Encrypted connections (TLS) for data in transit.
Encryption of stored data. In addition, the original vendor description from each expense line, exactly as uploaded, is encrypted with a separate key for each dealer, and those keys are encrypted with a master key kept outside the database. The other details used for the review (amounts, dates, store and department names, and a standardized copy of each vendor name used for matching) are protected by the storage encryption and by database-level separation between dealers.
Isolation of each dealer’s data at the database level (row-level security), so one dealer cannot see another’s data.
The six-column upload limit and masking of long digit strings, described above.
Sign-in controls: dealer users sign in either with a 6-digit code emailed to their work address, which works once and expires after 15 minutes, or with two-step sign-in using an authenticator app, which we recommend (once a user sets up the app, emailed codes no longer open that account); DealerPointe staff sign in with a password plus an authenticator code. Accounts lock for 15 minutes after 5 wrong attempts. Sessions end after 30 minutes without activity and after 12 hours in any case.
Audit logs of sign-ins, failed attempts, emailed sign-in codes and other actions.
Automatic deletion of uploaded expense lines, described above.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn of a security incident affecting your information, we will notify affected customers and individuals as required by applicable law and our agreements.

10. Your Choices

Marketing emails: you can opt out at any time by using the unsubscribe link or emailing info@dealerpointe.com.
Cookies: see our Cookie Notice.
Censa accounts: your dealership administrator can remove your access. You may also contact us.

11. State Privacy Rights

Some U.S. state privacy laws, such as the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), give residents rights over their personal information. Whether these laws apply to DealerPointe depends on thresholds such as annual revenue and the volume of personal information processed. Based on those thresholds, we do not believe these laws currently apply to DealerPointe. Even so, we will honor the requests below from anyone who asks.

Subject to exceptions allowed by law, you may ask us to:

Know what personal information we collect, use and disclose, and access a copy of it.
Correct inaccurate personal information.
Delete personal information.
Opt out of the sale of personal information, sharing for cross-context behavioral advertising, or certain profiling. (As stated above, we do not sell or share personal information for those purposes.)
Limit the use of sensitive personal information. (We do not intend to collect sensitive personal information through the Website or Censa.)
Not be discriminated against for exercising these rights.
Appeal our decision on a request, where the law provides that right.

To make a request, email info@dealerpointe.com. We will verify your request by confirming your work email address. You may use an authorized agent where the law allows. If your request concerns Customer Data that we process for a dealership, we may refer your request to that dealership and assist it in responding.

12. Children

The Website and Censa are intended for businesses and their adult employees. They are not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

13. International Users

DealerPointe is based in the United States and serves U.S. businesses. Information is processed and stored in the United States (Our database and servers are in the eastern United States). If you access the Website from outside the United States, you understand that your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

14. Changes to This Policy

We may update this Policy from time to time. We will post the updated Policy on the Website and change the “last updated” date above. If a change is material, we will provide additional notice, such as by email to customer administrators or a notice on the Website, before the change takes effect.

15. Contact Us

If you have questions about this Policy or our privacy practices, contact:

DealerPointe, LLC

12400 Wake Union Church Rd #3-202, Wake Forest, NC 27587

Email: info@dealerpointe.com

Website: dealerpointe.com