Privacy Policy

Last updated: October 1, 2026

Dealer by Design Inc. ("Dealer by Design," "we," "us," or "our") operates the READY HUB platform and the website readyhub.ca. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.

Bought a vehicle and using a Customer Portal? If a dealership sent you a link to upload documents or confirm your pickup, a separate page covers what happens to that information — how we handle your information in the customer portal.
Running your dealership on READY HUB? Sections 1 to 3 cover this website and people who contact us. Section 4 covers your dealership's data on the platform.

1. Information We Collect

Information You Provide

  • Contact Information: Name, email address, phone number, dealership name, and job title when you request a demo, contact us, or create an account.
  • Account Data: Login credentials and profile information for READY HUB platform users.
  • Communications: Records of correspondence when you contact our support team.

Information Collected Automatically

  • Usage Data: Pages visited, time spent on pages, click patterns, and referring URLs.
  • Device Information: Browser type, operating system, device type, and screen resolution.
  • IP Address: Collected and anonymized for analytics purposes.
  • Cookies: We use cookies and similar tracking technologies as described in Section 7.

2. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve our services and platform
  • Process demo requests and respond to inquiries
  • Send service-related communications and updates
  • Analyze website usage to improve user experience
  • Detect, prevent, and address technical issues or security threats
  • Comply with legal obligations

We do not sell your personal information to third parties.

Lawful basis for processing (EEA/UK residents): We rely on the following lawful bases under the General Data Protection Regulation: consent (for marketing communications and non-essential cookies), contract (to provide services you have requested, such as a demo), legitimate interest (to improve our services, analyze website usage, and protect against fraud and security threats), and legal obligation (to comply with applicable laws and regulations). You may withdraw consent or object to processing based on legitimate interest at any time by contacting us.

3. How We Share Your Information

We may share your information with:

  • Service Providers: Third-party companies that help us operate our business (e.g., hosting, analytics, email services).
  • Sales Partner: International Automotive Solutions (IAS), our authorized sales partner, when you request a demo or sales consultation, and, for subscribing dealerships, for account management and usage reporting as Section 4 describes.
  • Legal Requirements: When required by law, regulation, legal process, or governmental request.
  • Business Transfers: In connection with a merger, acquisition, or sale of assets.

4. Dealership Data on the READY HUB Platform

Sections 1 to 3 are about this website and the people who contact us. This section applies to dealerships that subscribe to READY HUB, and to the information they and their customers place in it ("Dealership Data"): inventory and vehicle records, deal and delivery records, customer contact details and documents uploaded through a Customer Portal, and data received from a dealership's other systems under an integration the dealership has authorized.

Who is responsible for it

Dealership Data belongs to the dealership. Dealer by Design processes it on the dealership's instructions to provide, support, secure and improve the platform. We do not sell Dealership Data and do not use it for advertising. International Automotive Solutions (IAS), our sales partner, sees a dealership's account details, enabled features and usage figures such as delivery counts, so that it can manage the account and show the dealership what it is getting from READY HUB; IAS does not receive a dealership's customer documents or its customers' contact details. We may use information that has been de-identified and aggregated, so that neither the dealership nor any individual can be identified, for benchmarking and product analytics.

Who runs the platform for us

The following companies handle Dealership Data to deliver READY HUB. Each handles only what its job needs, under contract and on our instructions, and none of them may use it for anything else:

  • Amazon Web Services — hosting, database, document storage, caching and some email delivery (Ohio and Virginia, United States)
  • Auth0 — sign-in and one-time codes
  • Twilio — text messages
  • SendGrid — email
  • Google — address lookup when an address is entered (Places), and usage analytics for the READY HUB application (Firebase Analytics)
  • Railway — hosting for the READY HUB support chat and the knowledge service behind it
  • Cerebras — runs the AI model that answers in the READY HUB support chat; it receives the questions dealership staff type there and the product knowledge used to answer them
  • Sentry — error monitoring

We will tell subscribing dealerships before a new provider begins handling personal information on our behalf.

Where it is stored

In the United States, on servers run by Amazon Web Services, mainly in Ohio. The other providers above handle it in the United States too. Section 10 explains what that means for access by US authorities. There is no Canadian-storage option at present.

Integrations with other systems

READY HUB exchanges Dealership Data with a third-party system — a dealer management system, a website provider, an accessory supplier — only where the dealership has authorized that integration in writing. Each integration is limited to the data it reasonably needs, and a dealership may revoke its authorization in writing at any time. Third parties handle the data they receive under their own terms and privacy policies. Where READY HUB offers a dealership's customers an optional service from another company, a customer's information is shared only with that customer's express consent.

Keeping it safe

Dealership Data travels over encrypted connections, and its database records and documents are encrypted at rest by Amazon Web Services. Credentials and access keys are additionally encrypted by the application itself. Access is limited to the people who need it to do their job, everyone who handles it is under a confidentiality obligation, and access to customer documents is logged. Staff sign in through Auth0 with the controls the dealership chooses, and a dealership can remove a user's access at any time. We review these safeguards against the sensitivity of what the platform holds and will say here when they change materially.

How long we keep it

For the term of the dealership's subscription. For sixty (60) days after the subscription ends, the dealership may export its Dealership Data in a commonly used format; we then delete it, except what we are required to keep by law. During the subscription, we delete customer documents a dealership asks us to delete; the platform does not yet delete them automatically.

If something goes wrong

If we become aware of unauthorized access to, or loss of, Dealership Data, we notify the affected dealership without undue delay and no later than 72 hours after confirming it, tell it what we know about the data and individuals involved, and cooperate in its response. The dealership, as the organization accountable for its customers' information, makes any report to the Office of the Privacy Commissioner of Canada and any notification to the individuals affected.

Questions from dealerships

A dealership's privacy officer or IT team can write to us at the address in Section 13 for anything this section does not answer, including a current list of the providers above.

5. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes described in this policy, comply with legal obligations, resolve disputes, and enforce our agreements. When no longer needed, data is securely deleted or anonymized. Dealership Data is kept for as long as Section 4 describes.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

Data breach notification: In the event of a personal data breach that creates a real risk of significant harm, we will notify affected individuals and applicable regulatory authorities as required by law. For Canadian residents, we will report breaches to the Office of the Privacy Commissioner of Canada in accordance with PIPEDA. For EEA/UK residents, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach as required by GDPR. For US residents, we will provide notice in accordance with applicable state breach notification laws. For Dealership Data, we notify the dealership as Section 4 describes, and the dealership notifies its customers.

7. Cookies and Tracking Technologies

We use the following cookies and tracking technologies:

  • Google Analytics 4: To understand website usage patterns. IP addresses are anonymized. You can opt out using the Google Analytics Opt-out Browser Add-on.
  • Essential Cookies: Required for basic website functionality.

Most web browsers allow you to control cookies through their settings. Disabling cookies may limit your ability to use certain features of our website.

8. Your Privacy Rights

For All Users

You have the right to:

  • Access the personal information we hold about you
  • Request correction of inaccurate information
  • Request deletion of your personal information
  • Opt out of marketing communications at any time

For Canadian Residents (PIPEDA)

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to access your personal information, challenge its accuracy, and withdraw consent for its collection, use, or disclosure. We will respond to access requests within 30 days.

For California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with additional rights:

  • Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
  • Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
  • Right to Correct: You may request correction of inaccurate personal information.
  • Right to Opt Out: You have the right to opt out of the sale or sharing of your personal information. We do not sell personal information.
  • Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

For Residents of Other U.S. States

If you reside in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Nebraska, or other states with comprehensive consumer privacy laws, you may have similar rights to access, correct, delete, and opt out of certain processing of your personal information. As additional state privacy laws take effect, the rights described in this section will apply to residents of those states as well. To exercise these rights, contact us using the information below.

For European Economic Area & UK Residents (GDPR)

If you are located in the European Economic Area or the United Kingdom, you have additional rights under the General Data Protection Regulation:

  • Right of access: Obtain confirmation of whether we process your personal data and request a copy.
  • Right to rectification: Request correction of inaccurate or incomplete personal data.
  • Right to erasure ("right to be forgotten"): Request deletion of your personal data, subject to certain exceptions.
  • Right to restrict processing: Request that we limit how we process your data in certain circumstances.
  • Right to data portability: Receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.
  • Right to object: Object to processing of your personal data based on legitimate interests, including direct marketing.
  • Right to withdraw consent: Withdraw consent at any time where we rely on consent as the lawful basis for processing.
  • Right to lodge a complaint: File a complaint with your local data protection supervisory authority.

To exercise any of these rights, use the privacy request process described below. We will respond within one month of receiving your request, as required by GDPR.

How to Submit a Privacy Request

To exercise any of the privacy rights described above, send an email to support@readyhub.ca with the following information:

  • Request type: Access, Delete, Correct, or Opt Out
  • Your full name
  • Email address associated with your account or interactions with us
  • State or province of residence (so we can apply the correct privacy law)
  • Details of your request

To make this easier, you can use our pre-filled email template:

Submit a Privacy Request

Identity verification: To protect your information, we will verify your identity before processing requests by matching the information you provide against our records. We may request additional verification if needed.

Response time: We will acknowledge your request within 10 business days and respond substantively within 45 days. If we need additional time (up to 45 more days), we will notify you with the reason.

Authorized agents: You may designate an authorized agent to make a request on your behalf. We will require written proof of the agent's authorization and verification of your identity.

No fee: We do not charge a fee to process or respond to your verifiable request unless it is excessive, repetitive, or manifestly unfounded.

9. Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under 16, we will take steps to delete that information.

10. International Data Transfers

Our servers are located in the United States. Information you provide is transferred to, stored and processed there, which means US courts, law enforcement and national security authorities can require access to it under US law. We remain accountable for that information and require comparable protection from the providers who handle it, but no contract we sign overrides a lawful order in the country where the data sits.

11. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those websites. We encourage you to read the privacy policies of any third-party site you visit.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date. Your continued use of our services after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us at:

Dealer by Design Inc.
Email: support@readyhub.ca
Website: readyhub.ca

For California-specific requests, you may also email us with the subject line "CCPA Request" at support@readyhub.ca.