Privacy Policy
Kobexi is a business-to-business customer-relationship system for car dealerships. [Company legal name] ("we", "us") provides the software. The dealership that buys or pilots Kobexi decides why its customer information is collected and is responsible for that information. For the dealership's customer and lead records, we act as a service provider and processor. For our own staff accounts, we decide the purposes described below.
Information about dealership staff
When a dealership creates an account we store the details the dealership enters: name, work email, role, title, and an optional phone number. Passwords are stored as a hash, not as the password itself. Sign-in creates a session. If you use a passkey, we store the public key and a credential id. We do not receive your fingerprint or face. If you trust a browser, we store a hashed device token. Sign-in codes sent by email or text are stored only as a hash and expire after 10 minutes. We keep an audit log of sign-ins, failed sign-ins, role changes, exports, and deletes. We also store the home-screen layout you choose.
Information about dealership customers and leads
The dealership, not a shopper visiting this website, puts customer information into Kobexi. That can include names, phone numbers, email addresses, addresses, vehicle interests, notes, messages the dealership sends or receives, appointments, appraisals, trade details, credit-application fields the dealership enters, photos and videos, and VIN or driver's-license scans the dealership uploads. A text reply of STOP is stored so that number is not marketed to again.
We do not buy lead lists, and people do not create customer accounts on this site.
How we use information
We use this information to run the CRM: sign-in, permissions, messaging, follow-ups, appointments, appraisals, and the audit log. We use staff phone numbers and emails to send sign-in codes and, if the staff member turns them on, lead alerts. We use customer contact details so the dealership can text, email, and call about that customer's own inquiry, and, where the dealership has its own consent, for the dealership's marketing messages.
We do not sell personal information. We do not share it for cross-context behavioral advertising.
No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.
Text messages
Staff texts under the program name Kobexi Alerts are sign-in codes and optional lead alerts. Customer texts are conversational messages and, when the dealership has consent, marketing messages the dealership sends through Kobexi. Message frequency varies. Message and data rates may apply. Reply STOP to opt out and HELP for help. See the SMS terms.
Service providers
We use other companies to host and deliver Kobexi. They may process information only to provide their service to us:
- Render hosts the application, the Postgres database, and uploaded files.
- Email, including staff sign-in codes and dealership messages, is sent over SMTP. When outbound email is turned on, that mail is sent through Postmark. Until a live mail provider is connected, those messages stay inside Kobexi and are not delivered.
- Text messages are sent through Twilio when texting is turned on. Until then, texts are simulated and are not delivered to a phone.
- If an AI feature is connected, an OpenAI-compatible model provider may receive the text or images needed for that feature. Those features are Kobexi Bot and Response Bot replies, the Ask AI draft box, VIN and license scan reading, appraisal market summaries, and photo or video labeling. On the current hosted staging service those features are not connected and no model key is used. When a provider is connected, we send only the content that feature needs. We do not permit that content to be used to train the provider's models where the provider's account settings allow us to turn training off. Whether a provider trains on API data depends on that provider's terms and on those settings.
- Appraisal market data can be requested from a market-data provider such as MarketCheck if that connection is turned on. It is not turned on in the current hosted service. Appraisals then use simulated comps that do not leave the server.
How long we keep it
We keep dealership and customer information while the dealership's account is open and as needed to provide the service. Sign-in codes expire after 10 minutes. A trusted-device token lasts 30 days unless it is revoked. Logical database backups are kept for about 14 days and then deleted. After the account ends, the dealership may ask us to delete or return customer data. Copies can remain in backups until those backups expire, and we may keep a record we are legally required to keep. There is not a self-serve button that downloads the entire database. A dealership can ask us for an export.
Security
The hosted site is served over HTTPS, so data is encrypted in transit. Passwords, sign-in codes, session tokens, and trusted-device tokens are stored as hashes. Passkeys are stored as public keys. Staff sign-in can require a second step (an email code, a text code, or a passkey). Roles limit which leads and tools a person can open. Sensitive actions are written to an audit log. The hosting provider encrypts the database and disk at rest. No method of storage is perfect.
Your requests
You may ask us to access, correct, or delete personal information we hold about you, and you may appeal a denial, by emailing privacy@kobexi.com. If you are a California resident, you may make those requests under the California Consumer Privacy Act. We will not discriminate against you for making a request. We do not sell personal information or share it for cross-context behavioral advertising.
If the request is about a dealership's customer, we will usually refer it to that dealership or help the dealership respond, because the dealership decides that information.
Dealerships that are financial institutions under the Gramm-Leach-Bliley Act and the FTC Safeguards Rule stay responsible for their own compliance, including their own information-security program and their oversight of service providers. This policy does not move those duties to [Company legal name].
Children
Kobexi is a tool for dealership staff. It is not directed to children under 16, and we do not knowingly collect personal information from children. Dealerships should not enter a child's information except where they have a lawful reason to do so.
Changes
We may update this policy. The effective date at the top will change. If we make a material change to how we use staff account information, we will post the new policy on this page.
Contact
[Company legal name]
[Business mailing address]
privacy@kobexi.com