The data is the dealership’s. This page says what our platform reads, where it is held, who can see it, what we do and do not do with it, and how a store leaves with it.
Effective July 2026. Last updated August 2026.
Dealer Velocity One is an intelligence and orchestration layer that sits above the systems a dealership already runs. To do that, it reads data from those systems. This page explains what it reads, what it does with it, where it is kept, and what happens to it when a store stops using us.
This is a description of how the platform works. The binding terms are in the subscription agreement signed between the dealership and Dealer Velocity IQ LLC, and in the data processing addendum attached to it. Where this page and that agreement disagree, the agreement wins. We publish this version because a dealer should be able to read it before signing anything.
If you are a consumer rather than a dealership, section 12 is the section for you.
The dealership’s. Not ours.
A dealership that uses our platform stays the owner of its data and, under the state privacy laws that use these words, the controller of it. We are a service provider and a processor. We handle dealership data to provide the platform to that dealership, on its documented instructions, and for no other purpose.
Concretely, that means we do not:
The platform connects to the systems a store already runs, and reads what it needs to hold one timeline per customer:
Read only by default. Connections to the CRM, DMS and lead sources are read only. The platform reads the journey and writes its recommendations into its own surfaces, not into yours. Where a store wants the platform to write back, for example to log an activity in the CRM so that a salesperson sees it where they already work, that is turned on deliberately, scoped to what it is being asked to write, and recorded. It is not the default and it is not silent.
Four things.
Run the platform for that store. Hold the timeline, produce the recommendations, send what the store asks to be sent, and show the results.
Show the store its own results. Every recommendation is scored against what the deal actually earned. That measurement is the store’s, and it is what the Control Center reports on.
Support the store. Diagnose a problem, answer a question, fix something that is wrong. Our people access dealership data for support under section 7.
Keep the platform running and secure. Monitoring, backups, capacity, and the security work in section 8.
Anything beyond those four is either in section 11 or it is not something we do.
Dealer Velocity One is Azure native. Dealership data is held in Microsoft Azure, in United States regions, and it stays in the United States.
Tenancy. The platform is tenanted at two levels, the rooftop and the dealer group, so a store sees its own data and a group sees its stores. A store in one group cannot see another group’s data, and two stores in the same group are separated unless the group grants otherwise.
Your own subscription. A dealership or group that wants the platform to run inside its own Azure subscription can have that. The data stays in infrastructure the group owns, and the commercial and operational terms for that are in the subscription agreement.
Data is encrypted in transit using current TLS, and encrypted at rest by the Azure services that hold it.
At the dealership. Access is by role, at the rooftop and the group level. A salesperson sees their customers, a manager sees the floor, a group executive sees the stores they are responsible for. The store administers its own users and is responsible for removing people who leave.
At Dealer Velocity IQ. Access to dealership data is limited to the people who need it to run the platform or to support the store. It requires multi-factor authentication, it is granted on the least privilege the job needs, and it is logged.
Nobody else. Except the subprocessors in section 13, and except where the law requires it under section 16.
The controls in place today are multi-factor authentication for all administrative access, least privilege access by role, encryption in transit and at rest, logging of access to dealership data, network isolation between tenants, and backups with tested restores.
We hold no SOC 2 report and no ISO certification today. We would rather say that than imply otherwise. When we have one it will be named here, with its date and its scope, and a dealership under a mutual non-disclosure agreement will be able to ask for the report.
Velocity Credit handles consumer credit data, and that carries obligations the rest of the platform does not.
Consent comes first. Written consent and a permissible purpose are captured and timestamped before an inquiry runs. Not as a checkbox in a settings page: as a gate the workflow cannot get past. The consent record sits at the top of the customer file, with when it was captured, who captured it and what it covers.
Soft pull first. Prequalification runs as a soft inquiry with no impact to the customer’s score. A hard pull happens only when the deal and the customer are ready, and only with the authorization the law requires.
The trail. Every inquiry, the score it returned, the rule version that evaluated it, the person who approved it and what happened next is recorded and auditable. That includes the adverse action trail, so a declined customer can be told why.
Whose permissible purpose it is. The dealership is the party with the permissible purpose and the relationship with the consumer. We provide the workflow that records consent, runs the inquiry the store instructs, and keeps the evidence. We do not make the credit decision, and we are not the store’s compliance department. The store remains responsible for its own obligations under the Fair Credit Reporting Act, the Gramm Leach Bliley Act and the safeguards rule, the Equal Credit Opportunity Act, and the state law that applies to it.
Credit data is non-public personal information, and a pull needs recorded consent and a permissible purpose. The platform never approves or denies credit on its own: it assembles the evidence, shows its reasoning, and a human decides. Every inquiry, score, rule version and approver is auditable.
Dealer Velocity One is advisory. A human approves every recommendation, and the inputs, the rule version, the explanation, the approver and the outcome are recorded for each one.
That is not a limitation we are apologising for. It is the design. A system that acts on a customer without a person deciding is a system nobody can audit and nobody can be accountable for, and in a business regulated the way this one is, accountability has to land on a person at the store.
We do not use one dealership’s data to train models that serve another dealership, and we do not use dealership data to train general purpose models.
Where the platform learns, it learns from the store’s own history for the store’s own benefit. Velocity Desk’s approval odds come from your funded deals. The recommendation scoring comes from what your deals earned. That is the point of the product: a model built on your store rather than on an industry average that describes nobody.
We use aggregated and de-identified information, which cannot reasonably be linked back to a dealership, a customer or a deal, to understand how the platform performs and where it needs work.
We never use consumer credit data for model development in any form.
If we ever want to do something outside this, we will ask, in writing, and a dealership that says no will keep the platform exactly as it is. Agreeing will not be a condition of using the product, and it will not be buried in a terms update.
If you are a customer of a dealership rather than the dealership, the store holds the relationship with you, and it decides what happens to your information. That is not us avoiding the question: it is how the law allocates it, and it means the store is the right place to send a request.
Ask the dealership, and it can ask us. When a store asks us to find, correct, export or delete the information the platform holds about one of its customers, we do it, and we do it within the time the store needs to meet its own deadline under whichever state law applies.
If you have contacted the dealership and cannot get an answer, write to privacy@dealervelocity.ai and we will do what we can to help you reach the right person. We cannot give you another company’s records, and we will not act on your data without the store’s instruction, but a request that reaches nobody is not an answer.
We use a small number of companies to provide the platform. Each of them is under a written contract that limits them to providing their service to us, holds them to security obligations at least as strict as our own, and prohibits them from using dealership data for their own purposes.
We will tell dealerships before we add a subprocessor that handles their data.
While you are a customer. We keep dealership data for as long as the store uses the platform, and for as long as the store wants its history kept. The timeline is the product, so deleting last year’s deals would remove the thing the recommendations are scored against. A store can ask us to delete specific records at any time, and we do.
When you leave. The data is the dealership’s, and leaving with it is a supported operation rather than a negotiation.
On request at any time, including after the agreement ends, we provide an export of the dealership’s data in a documented, machine readable format. Not a screenshot, not a report, and not for a fee that functions as a lock.
After that window we delete dealership data from our systems, and it ages out of backups on the backup cycle rather than instantly, which is a limit of how backups work rather than a reservation. We may keep what the law requires us to keep, and records we need for a legal claim, for as long as that reason lasts.
Dealer Velocity One is pre-launch. The platform core and the Control Center are in build, and Velocity Engage and Velocity Desk are the first two modules being delivered.
This page describes how the platform is designed to work and how it handles data as it is built. Some of what it describes is in place today and some is being built now. A dealership evaluating us should ask which is which for the parts that matter to it, and we will answer specifically rather than generally. When the answer changes, this page changes with it.
Every product visual on this website is an illustration. There are no live rooftops and no measured results, and this page will not pretend otherwise.
If we receive a subpoena, a court order or a government demand for dealership data, we will tell the dealership before we produce anything, unless we are legally prohibited from telling them. Where we can, we will direct the requester to the dealership, because it is the dealership’s data and the dealership’s relationship with its customers.
If dealership data is exposed or accessed by somebody who should not have it, we will tell the affected dealership without undue delay, and in any case within seventy two hours from becoming aware is the standard commitment and the one most dealer group agreements ask for. It must match the subscription agreement, and it must be a window the company can actually meet on a Saturday.
We will tell them what happened, what data was involved, what we have done about it, and what we are doing so it does not happen again. Consumer notification obligations sit with the dealership as the owner of the customer relationship, and we will give the store what it needs to meet them.
We will update this page when what we do changes, and the effective date at the top will say when the current version took effect. For changes that reduce the protections described here, we will notify dealerships directly rather than relying on them re-reading the page.
Questions about this policy, security questionnaires, and requests from dealerships go to privacy@dealervelocity.ai.
