Privacy Policy

Last updated: 10 September 2026

This policy explains what personal data 10X DEALERSHIP LIMITED collects, why we collect it, who we share it with and how you can get it deleted. It covers our website, the 10X Dealership application and every integration you connect to it, including Facebook and Instagram.

1. Who we are

10X DEALERSHIP LIMITED, trading as 10X Dealership, provides dealer management software to motor dealerships. We act in two different roles, and it matters which one applies to you:

Controller — for the accounts of dealership staff who use our software, for visitors to our website, and for billing.
Processor — for the customer and vehicle records a dealership enters into the system. That data belongs to the dealership. We process it on their instructions and we do not sell it, rent it or use it to build our own marketing lists. If you are a car buyer and want your record removed, contact the dealership you dealt with; if you cannot reach them, write to us and we will pass the request on.

Registered in Ireland, CRO number 820444. Our business address is Clonmel, County Tipperary, E91 C9R9, Ireland.

You can reach us about anything in this policy at privacy@10xdealership.com.

2. What we collect

Account data — name, work email address, role, dealership, hashed password, and the record of actions taken in the system (our audit log).
Dealership records — customers, leads, enquiries, vehicles, documents, invoices and messages that dealership staff enter or upload.
Billing data — subscription plan and payment status. Card details are handled by Stripe and never reach our servers.
Technical data — IP address, browser type, pages opened and error reports, used to keep the service running and secure.
Data from services you connect — see the next section.

3. Facebook, Instagram and other connected services

A dealership can connect its own Facebook Page, Instagram account, mailbox or vehicle data provider to 10X Dealership. Nothing is connected by default — someone at the dealership has to authorise it, and can disconnect it at any time.

When a dealership connects its Facebook Page, Instagram account or advertising account, we receive:

The Page — its identifier and name, and an access token that lets us read on the Page's behalf.
Posts published by the dealership on that Page, and the Instagram Business account linked to it — the text, image, link and publication date, together with counts of reactions, comments and shares.
Audience statistics for that Page and those posts — how many people they reached and how many times they were shown, stored as one daily total per post.
Advertising statistics for the ad account the dealership selects — campaign names, amount spent, impressions, clicks and the number of leads generated, stored as one daily total per advertisement.

We use this to show a dealership how its own posts and campaigns are performing, next to its stock and sales figures in the same system. Each dealership sees only the accounts it connected; we never combine data between dealerships and we do not pass it to anyone other than the subprocessors listed in section 5.

What we do not collect. We read counts, not people. We do not collect the names or profiles of individuals who react to, comment on or click a post, we do not read private messages or conversations, and we do not receive contact details of anyone who interacts with the Page. We ask Facebook only for permission to read — not to publish, and not to create or change advertising campaigns.

Separately from the above, a dealership can use its own Facebook credentials, entered by hand in Settings, to publish a vehicle listing to its Page. That happens only when someone at the dealership clicks to publish a specific vehicle.

To revoke access, remove the connection in 10X Dealership under Settings → Integrations, or remove our app in your Facebook settings under Settings & Privacy → Settings → Business Integrations. Revoking stops any further data reaching us. To also delete what we already hold, follow section 9.

4. Why we use it, and on what legal basis

To provide the service (performance of a contract) — accounts, dealership records, connected integrations.
To take payment (performance of a contract, legal obligation) — subscriptions and invoicing.
To keep the service secure and working (legitimate interests) — logs, backups, abuse prevention, audit trail.
To assist users (legitimate interests) — support requests and service notices.
Where the law requires it (legal obligation) — accounting and tax records.

Some features use automated text analysis to read an uploaded document or draft a summary for staff. These are aids for a person who decides — no decision with a legal or similarly significant effect on anyone is made automatically.

5. Who we share it with

We do not sell personal data. We share it only with providers that help us run the service:

Hetzner — hosting of our servers and database, within the European Union.
Stripe — subscription payments.
Anthropic — the text analysis features described above. Content sent for analysis is not used to train models.
OpenAI — selected images, prompts and related content for AI photo and video features when those features are used.
Meta Platforms — only where a dealership has connected a Facebook or Instagram account.
Vehicle marketplaces and data providers — where an integration is enabled and available, including Autotrader. Relevant stock details, advert content, images and identifiers are exchanged to carry out the requested synchronisation or publishing. Provider permissions and terms apply.
Email and messaging providers — to deliver the notifications and messages the software sends on a dealership's behalf.

We may also disclose data where the law obliges us to, or to establish or defend a legal claim. Where a provider processes data outside the European Economic Area, that transfer is covered by the European Commission's Standard Contractual Clauses.

6. How long we keep it

Dealership records — for as long as the dealership's account is active. After an account closes we delete or return them within 90 days, unless the law requires us to keep them longer.
Account data — until the account is deleted, plus up to 30 days in backups.
Billing records — seven years, as tax law requires.
Technical logs — normally up to 12 months.

7. How we protect it

Traffic is encrypted in transit. Passwords are stored hashed, never in readable form. Each dealership's data is separated at database level, so one dealership cannot read another's records. Uploaded documents are served only to authenticated users of the dealership that owns them. Access to production systems is limited to the people who need it, and significant actions are written to an audit log.

8. Your rights

If you are in the European Economic Area or the United Kingdom you can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict how we use it, object to processing based on legitimate interests, and ask for your data in a portable format. Write to privacy@10xdealership.com and we will respond within one month.

If a dealership entered your data, we will forward your request to them, because it is their record to decide on. You also have the right to complain to your data protection authority — in Ireland that is the Data Protection Commission (dataprotection.ie).

9. Deleting your data

You can have your data erased in any of these ways:

In the app — an owner or administrator can delete a user, a customer record or a vehicle record directly in 10X Dealership. Deleting a user removes their access immediately.
By email — write to privacy@10xdealership.com from the address concerned, with the subject Data deletion request. Tell us which account, dealership or Facebook profile the request relates to. We confirm within 72 hours and complete the erasure within 30 days, backups included.
For data received from Facebook or Instagram — removing our app in your Facebook settings under Settings & Privacy → Settings → Business Integrations stops any further data reaching us. To erase what we already hold, send the email request above and name the Facebook Page or profile concerned.

We will tell you when the erasure is done. Where the law requires us to keep something — an invoice, for example — we will say what we kept and why.

10. Cookies

We use only what the service needs to work: a token that keeps you signed in and a preference for light or dark mode. We do not use advertising or cross-site tracking cookies on this website. Clearing your browser storage signs you out.

11. Children

10X Dealership is a tool for businesses. It is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child's data reached us, write to us and we will remove it.

12. Changes to this policy

If we change this policy we will update the date at the top, and for a significant change we will notify account holders by email or in the application before it takes effect.

13. Contact

10X DEALERSHIP LIMITED — privacy@10xdealership.com