Privacy Policy

1. Who operates LotMarque

LotMarque is a service operated by Artur Khaliavin, an individual sole proprietor based in Stittsville, Ontario, Canada. LotMarque is not a company, corporation or incorporated entity. Where this policy says "we", it refers to that sole proprietor.

Artur Khaliavin is also the person accountable for personal information handled through the service. All privacy questions and requests go to contact@lotmarque.com.

2. Scope of this policy

This policy covers the website at lotmarque.com and the LotMarque application. It applies to information about account holders and to anything account holders upload while using the service. It is written to meet Canada's federal privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA).

3. Information collected

We collect the following:

• Account details — your name, dealership or business name if you give one, email address, and a hashed version of your password. We never store your password in readable form.
• Vehicle records — VINs you enter, decoded trim and factory equipment, mileage, stock numbers, prices and any other details you type into a listing.
• Uploaded photos — the walkaround images and any other pictures you add to a vehicle record.
• Inspection notes — text you type, and voice notes together with the transcripts produced from them.
• Generated content — the listings, feature lists, condition blocks and window cards produced for you.
• Billing information — handled by our payment processor. We receive confirmation of payment, the plan, the last four digits of the card and its expiry. We never see or store your full card number.
• Technical data — IP address, browser and device type, operating system, and the pages and actions recorded in usage logs.
• Cookies — as described in the Cookie Policy.

4. VINs and vehicle records

A VIN identifies a vehicle, not a person. On its own it is not personal information. It can, however, be linked to an owner through registration, insurance or service records held elsewhere, so we treat VINs and vehicle records with the same care as account data: they are access-controlled, they are not sold, and they are deleted with your account.

5. What not to upload

Photos should show the vehicle, not people or personal effects. Avoid capturing bystanders, staff, customers, or belongings left inside a trade-in. We recommend blurring or masking licence plates before upload — the plate adds nothing to a listing and links the vehicle to a registered owner.

If you upload something you should not have, delete it from the vehicle record. Deleted photos are removed from active storage immediately and purged from backups within 30 days.

6. Why the information is collected and consent

Each type of information has a purpose:

• Account details — to create and secure your account, and to contact you about the service.
• Vehicle records, photos and notes — to decode the VIN, generate listing content and window cards, and keep your inventory library searchable.
• Billing information — to take payment, apply your plan and meet record-keeping obligations.
• Technical data and logs — to keep the service secure, diagnose faults and prevent abuse.

Under PIPEDA we rely on your consent. Creating an account and entering vehicle data is express consent for the purposes above. Consent for anything optional — analytics cookies, product emails — is asked for separately, and you can withdraw consent at any time, subject to the limits described in section 12.

7. Email and CASL

Canada's Anti-Spam Legislation (CASL) governs the commercial email we send. Transactional messages — receipts, renewal notices, password resets, service alerts — are sent because you hold an account and are needed to operate it. Promotional email is sent only if you opt in, and every promotional message carries an unsubscribe link that works immediately.

8. How your content is used

Your vehicle records, photos, notes and generated listings are yours. We do not sell them, rent them, or share them for advertising. They are not used to train third-party models: our AI providers are engaged under terms that prohibit training on customer content submitted through the service.

We use aggregate, de-identified figures — how many listings were generated in a week, how often a feature is used — to run and improve the service. Those figures cannot identify you, your dealership or a specific vehicle.

9. How long information is kept

Account data is kept while your account is active. After an account is closed it is deleted within 90 days, apart from records we must keep for tax and accounting purposes, which are limited to transaction dates and amounts.

Vehicle records, photos and listings can be deleted by you at any time. After cancellation they remain exportable for 60 days and are then permanently deleted, as set out in the Refund & Cancellation Policy. Voice notes are deleted once transcribed unless you choose to keep them. Security logs are kept for 12 months.

10. Service providers and transfers outside Canada

Running LotMarque means using other providers. Each receives only what it needs:

• a payment processor, for subscriptions and billing;
• a hosting provider, for the application, database and photo storage;
• a transactional email provider, for receipts, resets and service notices;
• an AI model provider, for generating listing copy and condition text;
• a speech-to-text provider, for transcribing voice notes;
• a VIN decoding data provider, for trim and factory equipment lookups;
• an analytics provider, if you have accepted analytics cookies.

We use providers that offer a comparable level of protection, bind them by contract to use the information only for the service they provide, and limit what is sent to each one.

11. Security

Information is encrypted in transit with TLS and encrypted at rest. Passwords are stored only as salted hashes. Photos are served through signed, expiring URLs, so an image link cannot be shared or guessed after it lapses. Administrative access is limited to the operator, protected by multi-factor authentication, and granted on a need-to-know basis.

No system is perfectly secure. Use a strong, unique password and tell us at contact@lotmarque.com if you suspect an account has been accessed without permission.

12. Your rights

Under PIPEDA and applicable Ontario law you may:

• ask what personal information we hold about you and get a copy;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your account and its contents;
• withdraw consent for optional processing, and for processing generally — noting that withdrawing consent for essential processing means the account can no longer be provided;
• ask for your data in a portable, machine-readable format;
• complain to the Office of the Privacy Commissioner of Canada, or to the Information and Privacy Commissioner of Ontario where that office has jurisdiction.

You are welcome to raise a concern with us first, but you are not required to.

13. How to exercise your rights

Write to contact@lotmarque.com from the email address on your account and say what you want to do. We may ask a question or two to confirm it is really you, particularly for deletion requests.

We acknowledge requests within 5 business days and answer within 30 days. If a request is complex and needs longer, we will tell you before the 30 days are up and explain why. Access requests are answered free of charge.

14. Cookies

Cookies and similar technologies are covered in full in the Cookie Policy, which lists every cookie, its purpose and its duration. Non-essential cookies stay off until you turn them on.

15. Age requirement

LotMarque is not directed at anyone under 18 and is not intended for use by minors. Accounts require you to be 18 or older. If we learn that we hold personal information collected directly from a person under 18 as an account holder, we will delete it.

16. Breach notification

If a breach of security safeguards creates a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada and the affected individuals as soon as feasible, and keep a record of the incident as PIPEDA requires. The notice will describe what happened, what information was involved, what we have done, and what you can do to protect yourself.

17. Changes to this policy

If this policy changes, the "last updated" date at the top changes with it. For changes that materially affect how your personal information is handled, we will email account holders at least 30 days before the change takes effect. Continuing to use the service after that date means the updated policy applies.

18. Contact

Questions, requests and complaints about privacy go to the operator of the service: