Privacy Policy
This policy explains what information Caeruz collects, why, who it is shared with, how long it is kept and the choices you have. It covers caeruz.com, the Caeruz dealer console and the Caeruz browser extension (together, Caeruz). Caeruz is operated by Zathur, a Wyoming company (we, us).
In short: we collect what we need to run your dealership's account, we don't sell personal information, we don't show ads, and we use analytics cookies only if you accept them. You can ask us for a copy of your data or to delete it at any time on the Your data page.
1. Who Caeruz is for
Caeruz is software for car dealerships. Accounts are for adults (18 or older) acting for a business. Caeruz is not directed to children, and we do not knowingly collect information from anyone under 18.
2. Information we collect
When you create an account
- Your dealership's name and website address.
- Your name, email address and password. Passwords are stored only as a one-way hash; we can't read them.
- Your phone number and address, which also become your dealership's contact details, and your preferred language.
- Your date of birth, to confirm you are 18 or older.
- If you choose Sign in with Google, Google shares your name and email address with us. We never receive your Google password.
- When you type a ZIP code, it is sent to Zippopotam.us, a free public lookup service, to fill in the city and state.
What you and your team put into Caeruz
Vehicles and their photos, videos, costs and prices; leads and your customers' contact details; sales, deals and financing applications; users, roles, payroll, commissions and advances; messages; and anything else you add. Your dealership controls this information (see section 7).
Your dealership's public website
When you sign up, and then on a schedule, Caeruz reads the public pages of the website you give us to import your vehicle listings, photos and business details. It reads only what any visitor can see.
Facebook, Instagram and Google Ads accounts you connect
Your dealership can connect its own Meta (Facebook and Instagram) and Google Ads accounts in Caeruz, under SEO › Connections. You sign in with Meta or Google and choose what to allow; Caeruz never sees your Meta or Google password. Depending on the features you turn on, we receive:
| Permission | What we receive | What it is used for |
|---|---|---|
| Meta: public profile | The name and Meta user ID of the person who connected. | Showing who connected the account. |
| Meta: business_management | The names and IDs of the business portfolios that person manages. | Showing which business portfolio is connected. |
| Meta: ads_read, ads_management | Your ad accounts (name, currency, time zone), their campaigns, status, spend, impressions, clicks and results, and your datasets (pixels). | Showing spend against the monthly budget you set and your campaign results; sending your lead results to your dataset (below); reading which ad a form lead came from. |
| Meta: pages_show_list, pages_read_engagement | The Facebook Pages you manage and the Instagram accounts linked to them. | Letting you choose your Page and showing its Instagram account. |
| Meta: pages_manage_posts, instagram_basic, instagram_content_publish | Your Instagram account's username and follower count, and its daily publishing limit. | Publishing the vehicle posts you approve to your Facebook Page and Instagram. Nothing is posted without an approval in Caeruz. |
| Meta: leads_retrieval, pages_manage_ads, pages_manage_metadata | Your Page's lead forms and, for each form submission, the answers people give (such as name, email, phone and your form's questions) and the campaign, ad and form it came from. | Creating each form submission as a lead in your Caeruz CRM. |
| Google Ads | The Google account email you connect with, the Google Ads accounts it can reach (name, ID, currency, whether it is a manager account), and their campaigns, status, spend, impressions, clicks and conversions. | Showing spend against the monthly budget you set and your campaign results. |
How it is protected and used. Access tokens are encrypted on our servers and never shown to anyone. Data from a connected account is used only to provide these features to the dealership that connected it. We do not sell it, do not use it for our own advertising, and do not use it to train AI models.
What Caeruz sends to Meta. If your dealership chooses a dataset under Meta in Connections, Caeruz reports your leads' progress (new lead, qualified, sold, with the vehicle price for a sale) to that dataset on your dealership's behalf, so Meta can measure and improve your dealership's own ads. Contact details are hashed (SHA-256) before they leave our servers. Leads marked "do not share" are never sent, and for dealerships in California Meta's Limited Data Use setting is applied. Your dealership decides whether to turn this on and is responsible for the notices its customers need (section 7).
Disconnecting and deleting. Disconnect at any time in SEO › Connections: we revoke our access at Meta or Google and delete the stored token. You can also remove Caeruz under Facebook Settings › Business integrations, or under Third-party access in your Google Account; when Meta tells us, we delete your connection data automatically. Leads and campaign figures already saved in your dealership's Caeruz account stay until the dealership deletes them or closes its account (section 8). To ask us to delete information we received from Meta or Google, use the Your data page.
Caeruz's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Technical information
Our servers record the IP address, browser type and time of each request, for security, abuse prevention and troubleshooting. Your browser keeps a few items so you stay signed in and your choices are remembered; they are listed in the Cookie Policy. If you accept analytics cookies, Google Analytics also measures how visitors find and use caeruz.com: pages viewed, the site that sent you, device and browser type, and an approximate location. It stays off unless you accept, and you can change your mind at any time under Cookie settings at the foot of each page. We do not use advertising or cross-site tracking cookies.
3. How we use information
- To provide Caeruz: create and secure your account, run the console, import your website, and show your team what their roles allow.
- To send service messages you need, such as password resets, invitations and receipts for requests. We do not send marketing email without your permission.
- To keep Caeruz secure, prevent fraud and abuse, and fix problems.
- To answer your questions and requests.
- To comply with the law and enforce our Terms of Service.
We do not sell personal information, and we do not share it for advertising on our own behalf. The one exception is a choice your dealership makes: reporting its own leads' results to its own Meta ad account, as described in section 2.
4. AI features
Some features use AI providers to produce a result you asked for, for example describing a vehicle, reading a document you upload, or analysing a sale application. Only the information needed for that result is sent. The providers process it on our behalf under their business API terms, which by default do not use it to train their models. AI output can be wrong; check it before you rely on it.
5. Who we share information with
We share information only with service providers that run parts of Caeruz for us, under contracts that limit their use of it to providing their service:
| Provider | What it does for Caeruz |
|---|---|
| Vercel | Hosts the caeruz.com website. |
| Railway | Runs our application servers. |
| Supabase | Stores the database and uploaded files, such as vehicle photos. |
| Resend | Delivers service email. |
| Firecrawl | Reads your dealership's public website for the import. |
| OpenAI, Anthropic | AI features you use (section 4). |
| Sign in with Google, if you use it, and the web fonts inside the signed-in console. | |
| Google Analytics | Measures visits to caeruz.com, only if you accept analytics cookies. |
| Meta (Facebook, Instagram) | Your dealership's own Pages, Instagram account, ad accounts and datasets, when you connect them (section 2). |
| Google Ads | Your dealership's own Google Ads accounts, when you connect them (section 2). |
| Zippopotam.us | Turns a ZIP code into a city and state at sign-up. |
| U.S. NHTSA | A public government service that decodes a vehicle's VIN and lists open recalls. |
We may also disclose information when the law requires it, to protect the rights, safety or property of our users or others, or as part of a merger, acquisition or sale of the business, in which case this policy continues to apply to it. When you choose to open another service from Caeruz, such as Facebook Marketplace or WhatsApp, that service's own terms and privacy policy apply to what you do there.
6. The Caeruz browser extension
The Caeruz extension connects your Caeruz console to the sites your dealership already uses, with your own sign-ins: Manheim, IAAI, Facebook Marketplace and, if you connect it, your dealership's own website. It has no window of its own: Caeruz asks it to do work you set up there, and it runs only in your own browser. When it gains a new site, this section will say what it reads there before that version is released.
- Manheim and IAAI. When you visit Manheim signed in, it reads the session token Manheim keeps for you, and uses it to read Manheim's listings when you run a scan or a saved watch from Caeruz. For IAAI it reads IAAI's search pages with the sign-in your browser already has; it does not read or store that sign-in itself. The lots a scan finds go to the Caeruz page in your browser; the lots a saved watch finds go to your dealership's Caeruz account.
- Facebook Marketplace. When you post a vehicle from Caeruz, it opens Marketplace's listing form in a tab of its own, with the Facebook account you are signed in to, and fills it with that vehicle's details and photos from Caeruz. It types and clicks in that tab through Chrome's debugging interface, so Chrome shows a bar saying Caeruz is debugging the browser while it posts; it uses that interface only in the Facebook tab it opened, only to type and click, and never to read pages, cookies or network traffic. It reports back whether the post worked, its link, and which of your groups list it. It reads the buyer messages under your own Marketplace listings and sends to your Caeruz leads only the conversations about vehicles you posted from Caeruz (the buyer's name and the messages); conversations about anything else are never sent anywhere. It never reads or stores your Facebook password.
- Your website. Only if you connect it: Chrome asks you to allow that one site, and the extension then reads its vehicle list once a day and sends it to your Caeruz account, so Caeruz can show what was added or sold.
- What it stores. In your browser's extension storage, on your computer: the Manheim session token, Manheim's list of makes and models, the key that links it to your dealership's Caeruz account, and the state of a post in progress.
- What it sends. It talks only to Manheim, IAAI, Facebook, your website if you connected it, and Caeruz. It never sends your sign-ins to our servers or to anyone else. It contains no analytics, advertising or tracking.
- Staying signed in. It never sees or stores your Manheim or IAAI password. When a session has run out, it opens the site in a background tab for a few seconds so the site can renew your sign-in, then closes the tab.
- Alerts. It can show browser notifications: lots priced under market from a scan you left running, a post that finished or failed, or a website that needs you to complete a "confirm you are a person" check.
- Removing it. Uninstalling the extension deletes everything it stored. Clearing caeruz.com's site data removes saved scan results. What it sent to your Caeruz account stays there under your dealership's control (see section 7).
The Caeruz extension's use of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
7. Your dealership's customers and staff
When a dealership stores information about its customers, applicants or employees in Caeruz, the dealership decides why and how that information is used, and we process it on the dealership's behalf, as its service provider. The dealership is responsible for giving those people any notices and obtaining any consents the law requires. If you are a customer of a dealership that uses Caeruz, please contact the dealership about your information; we will help it respond.
When you connect Facebook Marketplace, the messages buyers send about your dealership's listings are stored in Caeruz for your dealership and deleted 90 days after the listing ends. Caeruz only reads them; it never sends messages on your behalf.
8. How long we keep information
We keep account and dealership information for as long as the account is open. When an account is closed, or you ask us to delete your data, we delete it from our live systems within 30 days, unless the law requires us to keep something longer. When a free trial ends without a subscription, we keep the data for 30 days in case you subscribe, then delete it the same way. Copies in backups are removed as those backups expire on their normal cycle. Server logs are kept for a limited time for security, then deleted.
9. Security
Caeruz is served only over encrypted connections (HTTPS). Passwords are hashed, each dealership's data is separated from every other's, access inside a dealership follows the roles its administrator sets, and our database and file storage are hosted with providers that encrypt data at rest. No system is perfectly secure; if we learn of a breach that affects your information, we will notify you as the law requires.
10. Where information is processed
Caeruz and its service providers store and process information in the United States. If you use Caeruz from elsewhere, your information is transferred to the United States.
11. Your rights and choices
Wherever you live, you can ask us to:
- tell you what personal information we hold about you and give you a copy;
- correct information that is wrong;
- delete your information, or close your dealership's account and delete its data;
- stop processing that relies on our legitimate interests, where the law gives you that right.
Make a request on the Your data page or by emailing support@caeruz.com. We will confirm the request comes from you, usually by replying from support@caeruz.com to the address on the account, and answer within 30 days (45 days where California law allows, with notice). You may use an authorized agent; we will ask for proof of their authority. We will not treat you differently for exercising these rights. If we decline a request, we will explain why, and you can appeal by replying to our answer.
If you are in the EU, the UK or a similar jurisdiction: we process your information to perform our contract with your dealership, for our legitimate interests in running and securing Caeruz, to comply with legal obligations, and with your consent where we ask for it. You may also complain to your data protection authority.
California residents: in the last 12 months we collected the categories described in section 2 (identifiers, contact and commercial information, internet activity limited to server logs, and professional information your dealership adds) for the purposes in section 3, and disclosed them only to the service providers in section 5. We do not sell personal information or share it for cross-context behavioral advertising on our own behalf; when a dealership chooses to report its leads' results to its own Meta account (section 2), we do so on that dealership's instructions as its service provider. We do not use sensitive personal information to infer characteristics about you.
12. Changes to this policy
If we change this policy in a way that matters, we will tell you by email or in Caeruz before the change takes effect. The date at the top shows when it last changed.
13. Contact
Questions, requests or complaints: support@caeruz.com. Caeruz is operated by Zathur, a Wyoming company.