Privacy Policy

1. Who we are

Pacific Autohaus (also referred to as "we," "us," or "our") is a licensed California auto dealer located at 933 S 4th Street, Grover Beach, CA 93433. This Privacy Policy covers personal information we collect from visitors to our website, customers, and applicants for financing.

2. Categories of personal information we collect

In the past 12 months we have collected the following categories of personal information as defined by the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA):

• Identifiers: name, phone number, email address, mailing address, IP address.
• Customer records: information from lead forms and consultations (vehicle of interest, trade-in details, notes).
• Commercial information: vehicles viewed, inquiries made, purchase history if you buy a car from us.
• Internet / network activity: pages visited, referring URL, approximate location based on IP, browser and device type, timestamps. Collected via first-party analytics and cookies as described below.
• Geolocation data: approximate location from IP address only. We do not collect precise GPS location.
• Professional or employment information: employment status, employer, job title, monthly income — collected only if you submit a financing application.
• Sensitive personal information (SPI): Social Security number, driver's license number, and financial account information — collected only if you submit a financing application. See §6 below for how we handle SPI.
• Inferences: vehicle preferences, budget range, and purchase intent inferred from the above.

3. How we use your personal information

We use the information we collect to:

• Respond to your inquiry, schedule test drives, send vehicle details, and follow up on open leads.
• Process financing applications through our lending partners (if you submit a credit app).
• Complete a vehicle purchase, trade-in, or service transaction.
• Send transactional SMS/email (confirmations, reply-back to your texts, status updates).
• Send marketing SMS/email only if you checked the opt-in box on a form. You can reply STOP at any time.
• Measure which ads and marketing channels actually produce real leads and sales, so we know where to spend our advertising budget. See §4 for exactly how.
• Comply with legal obligations (DMV reporting, tax, anti-money-laundering, dealer licensing).
• Detect and prevent fraud.
• Improve the website and debug issues.

4. Who we share information with — and what our ad tags actually do

We disclose personal information to the following categories of service providers, each under a contract that limits their use of the data to providing services to us:

• DealerCenter — our dealer management system (inventory, deal structuring, credit app processing).
• Lending partners — banks and credit unions we submit your financing application to on your behalf.
• SMS / messaging providers — to deliver text messages you've asked us to send.
• Analytics providers — Google Analytics, plus our own first-party site analytics, to understand site usage.
• Ad platforms — Meta (Facebook/Instagram) and Google Ads. The detail is directly below.
• Payment processors — for deposits and payments.
• Government agencies — DMV and tax authorities as required by law.
• Professional advisors — our lawyers, accountants, and auditors.

What we send to the ad platforms

We would rather be specific here than vague, because this is the part of a privacy policy people actually care about.

• We run the Meta Pixel and the Google Analytics / Google Ads tags on this website to measure advertising performance. Both are configured in their privacy-restricted modes — Meta's Limited Data Use setting and Google's restricted data processing setting — which limit how those companies are permitted to use the data they receive from us.
• Hashed contact details ("enhanced conversions"). When you submit a lead form, we send Google a scrambled, one-way-encrypted version of your email address, phone number, and name. "One-way" means it cannot be turned back into your real email or phone number — not by us and not by Google. It can only be compared against a value Google already has. We do this so we can tell which ads produced an actual customer instead of a wasted click. We do not send your plain-text contact details to Google or Meta for advertising.
• Ad click identifiers. When you arrive here from a Google or Facebook ad, the link carries a click ID (called gclid or fbclid). We store that ID on your lead record so we know which specific ad brought you in.

We do not sell personal information for money. We have never received, and do not receive, payment in exchange for your personal information.

But we want to be straight with you rather than hide behind a technicality: under California law, the ad-platform integrations described above may qualify as "sharing" personal information for cross-context behavioral advertising, even though our purpose is measurement rather than building profiles about you. So we treat them as sharing, and we give you a real way to opt out.

Automated follow-up (AI-assisted)

We use an automated, AI-assisted follow-up tool to help us respond to leads quickly by text and email, including outside business hours. That tool receives your name, phone number, email address, and what you asked about (for example, the vehicle you inquired on) so it can draft and send a relevant reply. It is a tool we operate in order to talk to you — it is not an ad platform, and we do not use it to build advertising profiles.

You can opt out at any time: reply STOP to any text to stop the messages, or email james@pacificautohaus.com and ask us to handle your follow-up manually instead. A real person is always available — call or text us and you will get a human.

Do Not Sell or Share My Personal Information

You have two ways to opt out of the advertising sharing described above, and both of them work:

• Browse with a Global Privacy Control signal enabled. Use a browser or extension that sends GPC. We detect it automatically and suppress the advertising and analytics pixels for your visit — no email, no form, no waiting. See §10 for exactly what that does.
• Email james@pacificautohaus.com with the subject line "Do Not Sell or Share My Personal Information." Include the email address and phone number you used with us so we can find your record. We will stop including your information in advertising measurement and confirm to you in writing.

5. Sources of personal information

We collect personal information directly from you (forms, texts, phone calls, in-person visits), from automated technology when you use our website (cookies, server logs), from service providers and lending partners (credit bureaus, vehicle history services), and occasionally from public sources (DMV records, public property records).

6. Sensitive personal information — use and limits

We collect sensitive personal information (SSN, driver's license, financial account info) only when you voluntarily submit a credit application. We use it solely to:

• Verify your identity.
• Submit your application to lenders to obtain financing for the vehicle you are purchasing.
• Comply with federal and state legal obligations (OFAC, Patriot Act, dealer record-keeping).

Right to limit use of sensitive personal information: under CPRA you have the right to limit our use of SPI to those purposes listed above. Because we already only use SPI for those purposes, no additional action is required — but you may still submit a formal request and we'll confirm in writing.

7. How long we keep your information

We would rather describe our actual practice than promise an automatic deletion schedule we do not run. So, honestly:

• Lead and customer records (name, phone, email, vehicle of interest, notes, purchase history) — we keep these for as long as they are needed for the business relationship, and for as long as legal, tax, and dealer record-keeping obligations require. California DMV and IRS rules require us to retain completed transaction records for several years.
• Credit applications and related sensitive information — retained for at least 25 months from submission or denial, as required by the federal Equal Credit Opportunity Act. These live in DealerCenter, not on this website.
• SMS consent and opt-out records — retained so we can honor your STOP request and show what you agreed to. See directly below.
• Analytics data — the analytics data held by Google is governed by Google's own retention settings on our account, not by a schedule we run ourselves.
• Marketing email lists — until you unsubscribe.

You can ask us to delete your information at any time, and we will honor it. Email james@pacificautohaus.com and we will delete your records, except for anything we are legally required to keep — for example a completed vehicle sale, or a credit application still inside the ECOA window above. We will tell you what we deleted, and what we had to keep and why.

SMS consent records

When you opt in to text messages, we record the exact wording of the consent language you agreed to, the date and time you agreed to it, and your opt-in choice (and later your opt-out, if you reply STOP). We retain those records so we can honor your STOP request and demonstrate what you actually consented to.

8. Your California privacy rights

If you are a California resident, you have the following rights under the CCPA/CPRA. These rights apply regardless of whether you are a customer or just a website visitor.

• Right to know — request a copy of the specific pieces and categories of personal information we have collected about you, the sources, the purposes, and the categories of third parties we've disclosed to.
• Right to delete — request deletion of personal information we have collected from you, subject to legal exceptions (e.g. completed transactions, pending financing applications, legal obligations).
• Right to correct — request that we correct inaccurate personal information we maintain about you.
• Right to limit use of sensitive personal information — as described in §6 above.
• Right to opt out of sale / sharing — we do not sell your personal information for money, but our advertising measurement may qualify as "sharing" for cross-context behavioral advertising. You can opt out by browsing with a Global Privacy Control signal enabled, or by emailing us. See §4.
• Right to non-discrimination — we will not deny you service, charge you a different price, or provide a different level of quality of service because you exercised any of these rights.

9. How to exercise your rights

To exercise any of the rights above, email james@pacificautohaus.com or call (805) 904-0010 with:

• Your name, phone number, and email address.
• The specific right you are exercising (know, delete, correct, limit SPI).
• Enough information for us to verify your identity (we may ask follow-up questions to match your request against our records).

We will respond within 45 days of receipt. We may extend once by another 45 days if reasonably needed and we will notify you of the extension. There is no fee to exercise your rights.

Authorized agents: you may designate an authorized agent to make a request on your behalf. We will require written verification of the agent's authority and may still contact you directly to verify the request.

10. Global Privacy Control (GPC) signals

We honor Global Privacy Control signals sent by browsers and extensions that support them. Here is exactly what happens when your browser sends one:

• We suppress the advertising and analytics pixels. The Meta Pixel and the Google Analytics / Google Ads tags do not load and do not fire for that visit, on that browser and device. No advertising cookies get set.
• Our own first-party site analytics still records the visit — which pages you looked at, which vehicles you clicked. That data stays with us, is used to run and improve this website, and is not shared with advertisers or ad platforms.
• The site keeps working normally. Things you do on purpose — saving a vehicle, setting a theme, submitting a form — are unaffected.

The signal is read from your browser on each visit, so it applies per browser and per device. If you also want the lead record we already have for you excluded from advertising measurement, email us as described in §4.

11. Minors under 16

Our website is not directed to children under 16, and we do not knowingly collect personal information from children under 16. We do not knowingly sell or share the personal information of any consumer under 16 years of age, because we do not knowingly collect it in the first place. If we learn that we have inadvertently collected personal information from a child under 16, we will delete it promptly.

12. California "Shine the Light" (Civil Code § 1798.83)

California residents may request once per calendar year a list of the categories of personal information we disclosed to third parties for their direct marketing purposes, along with the names and addresses of those third parties. Pacific Autohaus does not disclose personal information to third parties for those parties' direct marketing purposes, so there is no list to provide. You may still submit a written request to james@pacificautohaus.com and we will confirm this in writing.

13. Cookies and browser storage

Here is the accurate list of what this website actually puts on your device.

Third-party cookies

• Google Analytics cookies (_ga, _ga_*) — measure how the site is used: pages viewed, where traffic came from, how people move through the inventory.
• Meta Pixel cookies (_fbp, _fbc) — measure how our Facebook and Instagram ads perform. Running in Meta's Limited Data Use mode.

Browser storage we set ourselves

These are stored in your browser's own localStorage, on your device. They exist to make the site work, and they are not shared with advertisers:

• Your saved / favorited vehicles.
• Your theme preference.
• Your inventory view preference (for example grid or list).
• Saved state for the arcade game on this site.
• A session ID used by our own first-party analytics.
• Any Google or Facebook ad click ID (gclid / fbclid) captured from the link you arrived on, so it can be attached to your lead if you submit a form.
• A short-lived retry queue — if your connection drops while you are submitting a lead form, we hold that submission here and send it once you are back online, so your message is not silently lost.

If your browser sends a GPC or Do Not Track signal

No advertising cookies are set at all for visitors whose browser sends a Global Privacy Control signal — the Google and Meta tags never load, so they never get the chance to set anything. We treat a Do Not Track (DNT) signal exactly the same way we treat GPC. Our own first-party analytics still records the visit, and we do not share that with advertisers.

You can also block or clear cookies and site storage through your browser settings. Doing so may clear your saved vehicles and reset your preferences.

14. Security

We use administrative, physical, and technical safeguards appropriate to the sensitivity of the personal information we handle. All financing applications are submitted through secure, encrypted channels. No method of transmission over the internet is 100% secure; if you believe your personal information has been compromised, contact us immediately.

15. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be posted here with a new "Last updated" date. Continued use of our website after changes are posted constitutes your acceptance of the updated policy.

16. Contact us

Privacy questions, requests, or complaints:

• Email: james@pacificautohaus.com
• Phone: (805) 904-0010
• Mail: Pacific Autohaus, 933 S 4th Street, Grover Beach, CA 93433

You may also contact the California Attorney General's office at oag.ca.gov/privacy if you believe we have violated your rights under California privacy law.