Privacy Policy & Google API User Data Governance
AutoPlace.io’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
1 Application Identity & Platform Overview
This Privacy Policy describes the policies and procedures of AutoPlace.io, operated by Zamzilla LLC (“AutoPlace”, “we”, “our”, or “us”), regarding the collection, use, retention, and disclosure of information when you access or interact with our website (https://autoplace.io), our web application (https://app.autoplace.io), and any related digital automotive services (collectively, the “Platform”).
AutoPlace is a premier automotive software ecosystem that simplifies the car buying, selling, and leasing process. Through our platform, consumers define their ideal vehicle specifications, set target price alert thresholds, receive transparent reverse bids from verified franchise dealerships, schedule live digital walkarounds, and coordinate secure digital closing paperwork.
2 Information We Collect & Process
We practice strict data minimization and only collect information essential to delivering our automotive marketplace, price alerts, and digital deal closing tools:
When you authenticate using Google Sign-In, we collect your primary Google email address, verified full name, avatar profile image, and unique Google account identifier to create, secure, and personalize your AutoPlace profile.
Vehicle makes, models, trims, model years, target purchase budget thresholds, saved vehicles, and notification preferences so our background engine can monitor dealer inventory and alert you when prices drop.
Vehicle Identification Numbers (VIN), mileage, exterior/interior vehicle condition, and photos for generating Instant Cash Offers (ICO) and Kelly Blue Book market appraisals.
If explicitly authorized by you, we integrate with Google Calendar (to schedule vehicle delivery or test drives), Google Drive (to store certified deal jackets), and Google Sheets (to sync deal pipelines).
3 Specific Google API Scopes & In-App Usage
AutoPlace requests only the minimum Google API scopes necessary to power user-requested features. Below is the full, exhaustive list of Google OAuth scopes requested by AutoPlace, along with the exact in-app feature each scope powers:
| Google API Scope | Purpose & In-App Functionality | Data Stored? |
|---|---|---|
|
…/auth/userinfo.email …/auth/userinfo.profile openid |
User Authentication & Profile Security: Used to authenticate your identity, create and maintain your secure AutoPlace account, display your avatar, and send account security alerts. | Yes (Account Email, Name, and User ID in secure Firebase profile) |
| https://www.googleapis.com/auth/calendar.events | VIP Test Drive & Delivery Scheduling: Allows you to schedule vehicle test drives, dealer appointments, and delivery handoffs. AutoPlace creates a calendar event on your primary Google Calendar and sends calendar invites with deal details. AutoPlace never reads or modifies your unrelated personal calendar events. | No (Only event IDs created by AutoPlace are tracked for appointment status) |
| https://www.googleapis.com/auth/drive.file | Deal Jacket & Window Sticker Export: Used strictly to save user-requested vehicle documents—such as certified Deal Jackets, Monroney window stickers, and purchase contract PDFs—directly into your private Google Drive under an “AutoPlace Deals” folder. Per Google’s drive.file specification, AutoPlace can only access files that AutoPlace itself creates; AutoPlace CANNOT see, open, or modify any other files in your Google Drive. | No (Files reside exclusively in your personal Google Drive) |
| https://www.googleapis.com/auth/spreadsheets | Deal Matrix & Inventory Pipeline Export: Allows you to export multi-dealer reverse bids, vehicle price comparison matrices, and trade-in appraisals into a Google Sheets spreadsheet in your own Google Drive for offline review and budgeting. | No (Sheets reside exclusively in your personal Google Drive) |
| https://www.googleapis.com/auth/gmail.send | User-Initiated Deal & Reservation Confirmation: Enables AutoPlace to dispatch user-initiated vehicle price-lock reservations, purchase inquiries, and bill-of-sale packages to verified franchise dealership sales directors directly from your authorized email address. AutoPlace only sends emails upon your explicit click (“Send Offer” or “Lock Price”). | No (Outgoing emails sent via Google API directly) |
| https://www.googleapis.com/auth/gmail.readonly | Dealer Offer & Inbound Reply Tracking: Allows AutoPlace’s Deal Desk to check for incoming replies from franchise dealers regarding active car price bids, ensuring out-the-door counteroffers appear in your real-time negotiation dashboard. AutoPlace only filters for relevant dealership communications related to your active deal ID; AutoPlace never accesses, stores, or reads your personal, financial, or unrelated emails. | No (Processed transiently in memory to update deal status) |
4 Google Limited Use & Anti-Abuse Protections
In strict compliance with Google’s Limited Use Requirements under the Google API Services User Data Policy:
- No Selling of Google User Data: We do not sell, rent, lease, or monetize any Google user data, contact details, or email content to third parties, data brokers, or advertising aggregators under any circumstances.
- No Advertising Usage: We do not use or transfer Google user data to serve advertisements, including personalized, retargeted, contextual, or interest-based advertising.
- No Generalized AI/ML Model Training: We do not use Google user data to train, fine-tune, or retrain generalized artificial intelligence, Large Language Models (LLMs), or foundation machine learning models.
- Human Access Prohibition: No human employee, contractor, or developer at AutoPlace or Zamzilla LLC is permitted to read or inspect private Google user data (such as emails or documents) unless:
- You have provided explicit, affirmative written consent to inspect a specific message or document to resolve a technical support ticket;
- It is strictly necessary to investigate a security incident, abuse, or system compromise; or
- We are legally compelled to do so under valid legal process or court order.
5 How We Use Your Non-Google Information
Non-Google information collected on the platform is used strictly to provide, maintain, and enhance the AutoPlace automotive marketplace:
- Authentication & Account Administration: To verify your identity, maintain login sessions, and protect against automated bots or fraudulent activity.
- Real-Time Price Drop Alerts: To monitor inventory and notify you via in-app alerts or email when dealerships drop prices to match your target price parameters.
- Dealer Marketplace Coordination: To deliver your car purchase requests to licensed dealerships so they can compete to offer you transparent out-the-door pricing.
- Digital Vehicle Inspections (DVI): To facilitate live video inspections and digital inspection checklists between you and the dealership.
- Digital Closing Room Paperwork: To generate consolidated delivery packets, bill of sale summaries, and odometer disclosure forms.
6 Data Sharing & Third-Party Disclosures
AutoPlace will never sell your personal data. We only share information in the following strictly controlled scenarios:
- Verified Dealership Partners: When you voluntarily submit a request for bids or accept a dealer’s price quote, we provide the verified dealership with your specified vehicle requirements and contact info to finalize the purchase.
- Cloud Infrastructure Providers: We utilize Google Cloud Platform and Firebase for secure hosting and database storage under strict Enterprise Data Processing Agreements.
- Payment Gateways (Stripe): If you place a refundable vehicle reservation deposit or utilize the Mutual Trust Escrow Vault, payment details are processed directly by Stripe under PCI-DSS Level 1 compliance. AutoPlace never stores full credit card numbers or bank account credentials.
- Legal Mandates: Where required by valid legal process, subpoena, or applicable state and federal automotive consumer protection regulations.
7 Data Security, Storage & Encryption Standards
We employ rigorous industry standards to safeguard your data at every tier:
- In-Transit Encryption: All communications between your browser, our servers, and third-party APIs are encrypted with Transport Layer Security (TLS 1.3 / HTTPS).
- At-Rest Encryption: All database records, user profiles, and tokens are encrypted at rest using AES-256 encryption.
- Role-Based Access Control (RBAC): Firestore database rules strictly enforce that users can only read, write, and modify their own vehicles, alerts, and transaction records.
8 Data Retention, Account Deletion & Immediate OAuth Revocation
You retain full ownership and control over your personal data. We provide simple, immediate mechanisms to manage, export, or permanently delete your data:
- Data Retention Schedule: User account data, saved cars, and price alerts are retained only for as long as your account remains active. If your account remains inactive for 24 consecutive months, inactive data is queued for automatic deletion.
- Complete Account & Data Deletion: You can delete your account at any time via the in-app Settings page, or by submitting a written deletion request to admin@zamzilla.com or support@autoplace.io. Upon receipt, all account records, user profile data, and saved searches are permanently purged from all databases within 30 days.
- Immediate Google OAuth Revocation: You can unilaterally revoke AutoPlace’s authorization to access your Google account at any moment through Google’s Security portal at https://myaccount.google.com/permissions. Revoking access immediately severs all API communication between AutoPlace and your Google Workspace.
9 Public Non-Gated Access Guarantee
AutoPlace maintains a public, unauthenticated web presence. Prospective users, consumers, and Google verification reviewers may browse our homepage, inspect feature documentation, review loan calculator estimates, and read our terms and privacy policy without needing to create an account, provide payment information, or log in.
10 Contact Us & Responsible Entity
If you have questions, comments, or data deletion inquiries regarding this policy or our data practices, please reach out to us: