Auto Contract Audit ("Auto Contract Audit," "ACA," "Company," "we," "our," or "us") respects your privacy and is committed to protecting the personal information you provide while using our website, services, and document review platform. This Privacy Policy is provided to give you notice of how we collect, use, store, share, and protect your information, and of the choices and rights available to you.
This notice describes our current practices. It is not, by itself, a request for your consent — where consent is legally required for a particular use of your information, we will ask for it separately.
1. Information We Collect
When you use our website or request our services, we may collect personal information that you voluntarily provide, including but not limited to:
- Full name
- Email address
- Telephone number
- Mailing address
- Vehicle purchase agreements
- Retail installment sales contracts
- Warranty and service contract information
- GAP and other add-on product agreements
- Payoff statements
- Supporting financial documents
- Uploaded files and documentation
- Communications with our representatives
- Information submitted through contact forms or customer portals
- Account credentials (your password is stored only in encrypted/hashed form — we cannot see or recover your actual password)
- Payment information necessary to process transactions (handled directly by our payment processor, Stripe — see Section 10)
We may also automatically collect limited technical information such as:
- IP address
- Browser type
- Device information
- Operating system
- Website usage statistics
- Cookies and similar technologies strictly necessary for the website to function (see Section 8)
This information helps us improve website performance, security, and user experience.
2. How We Use Your Information
We use the information collected to:
- Review and analyze vehicle purchase contracts
- Identify optional products and add-on services purchased
- Evaluate potential refund or reimbursement opportunities
- Prepare contract analysis reports
- Communicate regarding your account or document review
- Respond to customer service inquiries
- Verify submitted information
- Improve our services and website functionality
- Maintain internal business records
- Comply with legal and regulatory requirements
- Protect against fraud, unauthorized activity, or misuse of our services
We only collect information necessary to provide our services. All review of uploaded documents is performed manually by ACA personnel — see Section 4 for details on automated processing.
3. Document Handling & Confidentiality
Auto Contract Audit understands that customers upload sensitive financial and vehicle purchase documents. Submitted documents are:
- Treated as confidential
- Used solely for contract review and related requested services
- Accessible only to authenticated staff and administrators with a legitimate business need, through role-restricted accounts
We do not review or use customer documents for unrelated marketing purposes.
4. Automated Document Processing
We do not currently use artificial intelligence, optical character recognition (OCR), or any other automated technology to read, extract information from, analyze, or make determinations about uploaded documents. Every document you submit is reviewed manually by ACA personnel, and every finding, refund opportunity, and recommendation in your report is prepared by a person, not generated automatically.
If we begin using automated or AI-assisted tools to process uploaded documents in the future, we will update this Privacy Policy before doing so to explain the purpose of that processing, what information is extracted, whether the results are reviewed by ACA personnel, and whether any outside provider is involved.
5. Data Retention & Deletion
We retain personal information and uploaded documents for as long as your account remains active and as needed to provide the services you requested, respond to you, and satisfy the business, tax, accounting, fraud-prevention, and legal recordkeeping purposes described in this policy.
Documents you upload: While a review request has not yet been evaluated by our staff (status "submitted" or "under review"), you may delete an uploaded document yourself from your dashboard, which permanently removes both the file and its record from our systems. Once a request has been evaluated (a finding, recommendation, or recovery case has been created against it), documents tied to that review are retained as part of the permanent record of that review and can no longer be self-deleted, since removing them could compromise the accuracy and integrity of the review, report, and any recovery case built on them.
Reports, communications, and transaction records: Review reports, messages exchanged through the dashboard, and payment/subscription records are retained for the duration of your relationship with us and afterward as needed for our business records and legal obligations (including tax and accounting recordkeeping).
Account deletion: To request deletion of your account and associated personal information, contact us using the details in Section 14. Deletion requests are currently reviewed and processed manually by our team; we do not yet offer a fully automated self-service account-deletion feature. We will confirm with you once a deletion request has been completed, and we will let you know if any information must be retained for tax, fraud-prevention, contractual, or legal purposes.
Inactive accounts: We do not currently run an automated process that deletes or anonymizes accounts after a period of inactivity. An inactive account's information is retained under the same terms as an active account's, unless and until a deletion request is made or applicable law requires otherwise.
Backups: We do not currently publish a fixed backup retention schedule. If your information exists in a system backup at the time a deletion request is processed, it will be removed from our active, in-use systems; backup copies are not immediately and individually purged on request, but are not used for any purpose other than disaster recovery.
6. Information Sharing
Auto Contract Audit does not sell personal information, and does not share personal information for cross-context behavioral advertising. Your information may only be shared:
- With your express authorization
- When necessary to complete services you request
- With the service providers described in Section 10, who process information on our behalf
- To comply with applicable laws, court orders, subpoenas, or governmental requests
- To protect the rights, property, safety, or legal interests of Auto Contract Audit, our customers, or others
7. Data Security
We implement the following measures to help protect your personal information:
- Encrypted (HTTPS/TLS) connections between your browser and our website
- Passwords are stored only in hashed form and are never visible to our staff
- Role-based access controls restrict staff and administrator accounts to the information relevant to their role
- Server-side validation of uploaded file types and file sizes
- Rate limiting on login, password-reset, and verification-code endpoints to reduce automated abuse
No method of internet transmission or electronic storage is completely secure, and we cannot guarantee absolute security. We are actively working to strengthen these protections over time, including restricting direct access to uploaded documents so they can only be retrieved through an authenticated request.
8. Cookies & Website Technologies
Our website currently uses only the cookies and similar technologies strictly necessary for the site to function — for example, keeping you logged in and protecting forms from cross-site request forgery. We do not currently use analytics, advertising, or cross-site tracking cookies.
If we begin using analytics or advertising technologies in the future, we will update this Privacy Policy to describe them, along with your choices regarding their use, before doing so.
Most browsers allow you to disable cookies; however, certain website features (such as staying logged in) will not function properly if cookies are disabled.
9. Customer Rights
Subject to applicable law, you may request to:
- Access the personal information we hold about you
- Correct inaccurate information
- Update your contact information
- Request deletion of your personal information, as described in Section 5
- Request information about how your data has been used and with whom it has been shared
To submit a request, contact us using the details in Section 14. Because these requests involve sensitive personal and financial information, we take reasonable steps to verify your identity before fulfilling them — typically by confirming the request comes from the email address associated with your account, and we may ask for additional information if needed to confirm your identity, especially for a request submitted by someone other than the account holder (see Section 11 regarding authorized agents). Requests are reviewed and processed within a reasonable timeframe in accordance with applicable law.
10. Third-Party Service Providers
We work with a limited number of third-party service providers to operate our website and deliver our services. These providers only receive the information necessary to perform their function for us, and are not authorized to use it for their own independent marketing purposes:
- Payment processing: Stripe processes payments and subscription billing on our behalf. Stripe receives the payment information necessary to complete your transaction; ACA does not store your full card details.
- Email delivery: We use a third-party email service to send account, verification, and notification emails.
- Bot/spam protection: Google reCAPTCHA helps prevent automated abuse of our signup form.
- Document review reports: Review report PDFs are generated on our own servers using local software; no outside provider receives your documents for this purpose.
We do not currently use a third-party cloud storage provider for uploaded documents — documents are stored on our own application servers. We do not currently use any analytics or advertising service, so no such provider currently receives your browsing information.
Each of these providers is contractually and/or by the nature of their service limited to processing information for the purpose we've engaged them for. Auto Contract Audit is not responsible for the independent privacy practices of third-party websites you may separately choose to visit.
11. California Privacy Disclosures
This section provides additional information for California residents, consistent with the California Online Privacy Protection Act (CalOPPA) and, to the extent applicable to our business, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). Not every CCPA/CPRA obligation applies to every business — this section describes our actual practices rather than asserting that every provision of that law applies to us.
Categories of personal information we collect: identifiers (name, email, phone, address); account credentials; financial and commercial information found in the vehicle contracts and related documents you upload; and internet/device activity information described in Section 1. We do not knowingly collect sensitive categories of personal information beyond what may appear within a document you choose to upload (for example, financial account numbers that may appear on a payoff statement).
Sources of information: directly from you (forms, uploads, account registration, communications with us), and automatically from your device when you use our website.
Business purposes for collecting and using this information: as described in Section 2.
Categories of third parties who receive information: the service provider categories described in Section 10.
Sale of personal information / sharing for cross-context behavioral advertising: We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We do not currently operate any advertising or tracking technology that would make a Do Not Track or Global Privacy Control signal meaningful to our data practices; if that changes, we will honor applicable opt-out signals and update this policy to explain how.
Third-party tracking: We do not currently permit third parties to collect personally identifiable information about your browsing activity on our website over time or across other websites.
Your rights and how to exercise them: California residents may request access to, correction of, or deletion of their personal information as described in Section 9. You may also designate an authorized agent to submit a request on your behalf; we may require the agent to provide written proof of your authorization, and may still require you to independently verify your own identity with us before we act on the request.
Non-discrimination: We will not discriminate against you — including by denying services, charging different prices, or providing a different level of service — for exercising any privacy right described in this policy.
12. Children's Privacy
Our services are intended for individuals who are at least 18 years of age. We do not knowingly collect personal information from children under the age of 18.
If we become aware that information has been submitted by a minor without appropriate authorization, we will take reasonable steps to delete such information.
13. Changes to This Privacy Policy
Auto Contract Audit reserves the right to update or modify this Privacy Policy from time to time. The "Effective Date" at the top of this policy reflects the date of the latest revision.
If we make a material change to how we collect, use, or share your personal information, we will provide notice before the change takes effect — such as a notice on our website or an email to registered customers — rather than relying solely on the updated policy being posted. Non-material changes (such as clarifications or formatting) may be made without separate notice.
14. Contact Information
If you have any questions regarding this Privacy Policy, our privacy practices, or would like to submit a privacy request (access, correction, or deletion), please contact us:
Auto Contract Audit
We are committed to addressing privacy concerns promptly and professionally.