RocketAuto Privacy Policy
Last updated 2 October 2026
RocketAuto is software used by independent Canadian car dealerships to run their inventory, sales, service and marketing. This policy explains what the platform does with information. It is written for two audiences: the dealerships that use RocketAuto, and the people whose details a dealership stores in it.
Who controls the information
For customer information — a person who enquires about a vehicle, books a service, or buys a car — the dealership is the controller and RocketAuto is the processor. The dealership decides what to collect and why. RocketAuto holds and processes it on that dealership's behalf and does not use it for its own purposes.
What the platform stores
- Dealership staff accounts — name, email address, and role.
- Dealership business records — vehicle inventory, deals, service work, parts, and financial records belonging to that dealership.
- Customer records — name, email address, phone number, and the content of an enquiry, entered by dealership staff or submitted through the dealership's own website.
- Billing records — a dealership's subscription plan and invoice history. Payment card details are collected and processed directly by the payment processor (Stripe); full card numbers never reach RocketAuto's servers.
- Marketing attribution — advertising click identifiers
(
gclid,fbclidand equivalents), campaign labels, the first page visited, and the referring site reduced to its origin and path. These identify an advertisement, not a person. A referring URL's query string is discarded because it can carry personal data. - Connected-platform credentials — access tokens for accounts a dealership connects, such as Google Ads or a Facebook Page. Tokens are stored encrypted and are never shown back to any user.
Information from Meta (Facebook and Instagram)
A dealership may connect its own Facebook Page. RocketAuto then uses only what that connection requires:
- Publishing to the Page — when a member of dealership staff has approved a post, RocketAuto publishes it to the one Page that dealership selected. It does not read, moderate, or act on any other Page, and nothing is published without a person approving it first.
- Lead Ads — when someone submits a Lead Ad form on the dealership's Page, Meta notifies RocketAuto with an identifier only. RocketAuto exchanges that identifier for the details the person actually submitted and files them as a new enquiry in that dealership's own records, so staff can reply. Those details are used to respond to that person's enquiry and for nothing else.
Information obtained through Meta is never sold, never shared with another dealership, and never combined across dealerships to build a profile of anyone.
Website visitors
A dealership's public website may include analytics or advertising tags that the dealership itself configures. Where those tags support consent signalling, RocketAuto sets the restrictive option by default — advertising and analytics storage start denied until a visitor opts in — rather than leaving that choice to each dealership.
Cookies on the platform
The platform itself uses cookies and browser storage for signing staff in, keeping sessions secure, and remembering preferences, along with error telemetry that helps diagnose problems. The dealership software you sign in to carries no advertising cookies of any kind.
Artificial intelligence
RocketAuto uses AI to draft marketing copy and summarise a dealership's own records. Drafts are suggestions: a person must approve anything before it is sent, published, or acted on. AI features can be switched off per dealership, and material supplied to a model is treated as untrusted content, never as instructions.
Sharing
Information is shared only with: the infrastructure providers that run the service (Google Cloud and Firebase); the payment processor that handles a dealership's subscription (Stripe); a platform a dealership has explicitly connected, and only to carry out what that dealership asked for; and where the law requires it. It is not sold.
How information is protected
Safeguards are matched to the sensitivity of the information: encryption in transit, authenticated access with role-based permissions, isolation of each dealership's records from every other dealership's, and encrypted storage for connected-platform tokens. No system is perfectly secure, but a breach that affects you would be reported as the law requires.
Retention
A dealership's records are kept for as long as that dealership uses RocketAuto, and are removed on request when it stops. Marketing attribution expires automatically after 30 days.
Where information is processed
The platform runs on cloud infrastructure whose systems may be located in Canada or the United States. Information processed outside your province or outside Canada may be subject to the laws of that jurisdiction.
Your choices
To see, correct, or delete information a dealership holds about you, contact that dealership — it decides what it keeps. For anything concerning the platform itself, or if you cannot reach the dealership, email support@rocketauto.ca. Deletion instructions are at rocketauto.ca/data-deletion. Identity may need to be verified before a request is acted on, and if you are not satisfied with the response you may contact the Office of the Privacy Commissioner of Canada or your provincial privacy regulator.
Children
The platform is a business tool and is not directed to children; RocketAuto does not knowingly collect personal information from them.
Changes to this policy
Updates are posted here with a new "last updated" date. Material changes are notified to dealerships.
Contact
RocketAuto — support@rocketauto.ca. RocketAuto operates in Canada and handles personal information in line with PIPEDA.
This policy covers the RocketAuto platform. A dealership's own website carries its own privacy page describing that dealership's practices. Use of the platform is governed by the Terms & Conditions.