Privacy Policy

Motorloop is a service for independent car dealerships: a website in ten designs, an inventory with AI auto-fill, a lead inbox and a back office. In this policy, “Motorloop”, “we” and “us” mean the business that runs motorloop.io and the Motorloop software.

[To complete: legal entity name, registered address and company registration number]

You can reach us at w@startbase.ai.

Motorloop acts in two different roles, and the rules differ between them.

• We decide (controller). This covers visitors to motorloop.io, people who write to us, and the dealerships and team members who hold Motorloop accounts. In Israeli law terms, we own the database for this data.
• The dealership decides, we process (processor). This covers what buyers give a dealership through its Motorloop website: inquiries, test-drive bookings, trade-in and finance requests, chat messages and saved searches. Each dealership decides why and how it uses that data. We handle it only to provide the service. If you are a buyer and want to use your rights, contact the dealership; we will help it respond.

We collect only what is needed to show you the site.

• Server logs. Our hosting provider, Netlify, records technical details of each request: IP address, time, page, browser, and the page that linked to us. This is needed to deliver the site and keep it secure.
• Your language. The site saves the language of the page you are on in your browser (local storage), so the next visit to motorloop.io opens in the same language. It stays on your device.
• The investor page. The password-protected page at /info remembers, in your browser and until you close the tab, that you unlocked it.

motorloop.io sets no cookies of its own, runs no analytics, and loads no advertising, third-party scripts, fonts or embeds. If that changes, we will update this page first.

The request access and contact forms ask for your name, work email, dealership name and a few details about your stock, plus anything you choose to add: a phone number, your current website, a preferred domain, a message. We also record the language the site was in.

• Why. To reply to you, set up your trial and understand what you need. We use your details for this and nothing else. We do not add you to marketing lists, and there are no automated drip campaigns.
• Legal basis (EU and UK visitors). Taking steps at your request before a contract, and our legitimate interest in answering enquiries.
• How it is handled. The forms are processed by Netlify Forms, which stores the submission and forwards it to our email inbox, with spam filtering. If sending from the page fails, your email app opens with the message filled in, and the message then travels through your own email provider.
• How long. We keep an enquiry for as long as it is needed to answer you and to run the trial or account that follows. If you do not become a customer, we delete it once it is no longer useful, and sooner if you ask.

When a dealership signs up and uses Motorloop, we handle:

• Account details. The names and work emails of the owner and team members, a password (kept only as a hash by our sign-in provider, never in readable form), and an optional phone number if two-step sign-in by SMS is turned on.
• Dealership details. Name, location, branding, contact details, website settings and domain.
• What the dealership puts in. Cars, photos, descriptions, costs and documents, leads and clients, notes and follow-ups.
• Billing. The plan, a billing contact, and Stripe customer and subscription references. Card details go straight to Stripe and never reach our servers.
• Usage and security records. Sign-in events, AI request counts against plan limits, and the records our systems keep to prevent abuse, such as rate limiting by IP address.

We use this to run the service, bill for it, keep accounts secure, give support, apply plan limits, prevent abuse, improve reliability, and meet legal obligations. Motorloop staff can open a dealership’s account only to give support, investigate abuse or keep the service running.

A dealership’s Motorloop website can collect the following from its visitors. The dealership is responsible for it (see section 2) and we process it for them.

• Forms and chat. Inquiries, test-drive bookings, finance and trade-in requests: name, phone, email, message and the car concerned. The AI chat assistant answers from the dealership’s live inventory, using what the visitor types (see AI features). If a visitor shares contact details, it can pass them to the dealership as an inquiry. The conversation itself is kept in the visitor’s browser, not by Motorloop.
• Saved searches and alerts. An email address, only when a visitor asks for alerts.
• Favorites, comparison and recently viewed. Kept in the visitor’s browser. An anonymous random identifier, with no name or contact detail, is used to count car views and to remember favorites.
• Where a visitor came from. When a visitor arrives from a campaign link or from another website, a cookie that lasts 30 days records the campaign tag or the website’s name, so the dealership can see which channel an inquiry came from. It does not follow visitors across other websites.
• What we do not store. We do not store a visitor’s IP address or browser details with inquiries or car views.
• Links and embedded content. WhatsApp, phone and map links open the visitor’s own apps or sites, and Motorloop does not handle those conversations. Some pages show an embedded Google Map, and a dealership can add YouTube or Vimeo videos to a car. These load straight from Google, YouTube or Vimeo when the page opens, so those companies can see the visitor’s IP address and may set their own cookies, under their own privacy policies.

Dealerships can export their leads, their clients and, on Pro, their trade log as CSV files at any time, and can delete individual client records themselves. Marketing emails sent through Motorloop go only to clients who agreed to receive them, and each one carries a one-click unsubscribe link.

Motorloop uses the OpenAI API for three things. Each sends only the text it needs. None sends passwords, payment details or stored documents, and auto-fill sends no photos.

• Car auto-fill. The year, make, model and trim a dealer enters, plus the VIN and any notes they type, go to OpenAI, with its web search tool, to find published specifications and write a description. A second request translates the listing text into Hebrew, Russian and Arabic. A plate number is not sent to OpenAI: it is looked up in Israel’s public vehicle registry (data.gov.il).
• Website text. When a dealer asks for help writing their website, we send the dealership’s name and location, the description the dealer wrote and a few facts we hold, such as the brands in stock, and then translate the result.
• The buyer chat assistant. To answer a visitor, we send their last twelve messages, each cut to 1,000 characters, and details from the dealership’s inventory. If a visitor types a name or phone number into the chat, it goes along with the rest. This is the only AI feature that handles text typed by a visitor.
• Drafts and live answers. Specifications, descriptions and website text are drafts: nothing is published until the dealer has reviewed it and pressed Publish. The chat assistant is different. It answers visitors directly, in real time.
• Training and retention. We use the API, not a consumer product, and we do not opt in to sharing data with OpenAI for training its models. OpenAI may keep API requests and answers for up to 30 days, for example to detect abuse, under its own terms.
• Limits. AI requests are limited per account and per visitor to prevent abuse.

We use a small number of service providers. They handle data only to provide their service to us, under their own terms and data-processing commitments.

• Netlify

  What it does for Motorloop

  Hosts motorloop.io and processes its contact and request access forms

  Data involved

  Visitor IP address and request logs; form submissions

• Vercel

  What it does for Motorloop

  Hosts the Motorloop application and dealership websites

  Data involved

  Request logs and the pages served

• Supabase

  What it does for Motorloop

  Database, sign-in (including confirmation, invitation and password-reset emails) and file storage

  Data involved

  Everything stored in dealership accounts: listings, photos, leads, clients, team members

• Stripe

  What it does for Motorloop

  Payments and subscriptions

  Data involved

  The account owner’s email, the dealership ID and the plan. Card details are entered with Stripe and never reach us

• OpenAI

  What it does for Motorloop

  AI auto-fill, website text, translation and the buyer chat assistant

  Data involved

  The vehicle details, notes and dealership text sent with each request; what a visitor types into the chat

• Resend

  What it does for Motorloop

  Sends email

  Data involved

  Recipient addresses and message content: lead and search alerts, account and trial emails, digests and opted-in campaigns

• Twilio and ActiveTrail

  What it does for Motorloop

  Send text messages: Twilio for numbers outside Israel, ActiveTrail for Israeli numbers

  Data involved

  Phone numbers and message text: lead alerts and sign-in codes

• Google Places

  What it does for Motorloop

  Shows a dealership’s Google rating and reviews on its website (when enabled)

  Data involved

  The Place ID the dealership connects. No visitor data

• Sentry

  What it does for Motorloop

  Error monitoring

  Data involved

  Technical error reports and a sample of performance traces: page address, browser, stack trace

• Browser push services

  What it does for Motorloop

  Deliver push notifications to dealers who turn them on, through services run by Google, Mozilla and Apple

  Data involved

  A push subscription identifier

Two public sources are queried but are not our service providers. Israel’s vehicle registry (data.gov.il) receives the plate number a dealer looks up, and Google Public DNS receives only a domain name when a dealer connects a custom domain.

We do not sell personal data, and we do not use buyers’ data for advertising of our own. We may disclose data if the law requires it, to protect people or the service, or to a successor if Motorloop is sold or merged, on the terms of this policy.

Motorloop is set up to run on Vercel (the application) and Supabase (the database and file storage). Our providers run data centers in several countries, including the European Union and the United States. [To complete: region of the production database and application hosting]

When data moves between countries, we rely on the safeguards our providers offer, such as standard contractual clauses, where the law requires them.

• motorloop.io

  What

  Language of the last page you opened (local storage)

  Why

  Open the site in your language

  How long

  Until you clear it

• motorloop.io

  What

  An “unlocked” flag for the investor page (session storage)

  Why

  Not asking for the password again in the same tab

  How long

  Until you close the tab

• Dealership websites

  What

  Language cookie

  Why

  Remember the visitor’s language

  How long

  1 year

• Dealership websites

  What

  Source cookie (ml_src)

  Why

  Tell the dealership which channel brought an inquiry

  How long

  30 days

• Dealership websites

  What

  Local storage: favorites, comparison, recently viewed, an anonymous visitor ID, chat history, accessibility settings

  Why

  The features the visitor uses

  How long

  Until the visitor clears it

• Dealer console

  What

  Sign-in session and design-preview cookies

  Why

  Keep a dealer signed in and show unpublished design changes

  How long

  While signed in

You can clear or block cookies and local storage in your browser settings. Sign-in will not work without its session cookies.

• Dealership accounts. For as long as the dealership has an account. If a trial ends or a plan is cancelled, the account is paused and its data is kept, so the dealership can come back. [To complete: how long a paused or cancelled account is kept before its data is deleted] When a dealership asks us to close its account, we delete its data (records and stored files) from our active systems. Copies in our providers’ backups expire on their own schedule.
• Buyers’ data. For as long as the dealership keeps it in its account. The dealership decides, and can export or delete it.
• Enquiries to us. See section 4.
• Logs and abuse-prevention records. Kept for a short time, then removed. The counters that limit abuse can include an IP address. Each one counts over a window of at most 24 hours and is purged routinely in the background.
• Billing records. For as long as tax and accounting law requires.

• Connections to motorloop.io, dealership websites and the Motorloop app use HTTPS.
• Each dealership’s data is separated at the database level with row-level security, so one dealership cannot read another’s.
• Inside a dealership, roles control what people can see. On the Pro plan, for example, salespeople do not see costs or margins.
• Dealership users can turn on two-step sign-in with an SMS code.
• Public forms and AI features have spam protection and rate limits.
• Our infrastructure providers encrypt stored data.

We do not claim a security certification, and no system is perfectly secure. If a breach affects personal data, we will tell the affected dealerships without undue delay and notify authorities where the law requires.

Under the Israeli Protection of Privacy Law, 1981, you can ask to see the personal data held about you and to have it corrected or deleted. If you are in the EU or UK, the GDPR also gives you the rights to restrict or object to processing, to receive your data in a portable format, and to withdraw consent. You can unsubscribe from any marketing email with one click.

To use any of these rights, write to w@startbase.ai. For data a dealership holds about you, we may pass your request to the dealership, which decides about its own records. We reply within 30 days and do not charge for reasonable requests. You can also complain to the Israeli Privacy Protection Authority or, in the EU or UK, to your local data protection authority.

Motorloop is built for businesses and is not directed at children. We do not knowingly collect data from anyone under 16. If we learn that we have, we will delete it.

We change the date at the top when we update this policy. If a change is material, we will tell dealership account holders by email before it takes effect.