Privacy Policy | RP Exotics

RP Exotics (“RP Exotics,” “we,” “our,” or “us”) operates the website at rpexotics.com and the related dealer services described below. This Privacy Policy explains what personal information we collect when you visit the site or interact with us, how we use and share it, the third-party processors that handle that data on our behalf, and the choices and rights you have.

1. Information we collect

You provide directly

Account & identity: name, email address, phone number, and any profile information you submit when you register, sign in, or update your account.
Inquiries & proposals: vehicles you save, inquire on, or submit offers for, the contents of any messages you send us, and any information you upload (e.g. trade-in details, photos, or documents).
ProSignment & sale documents:government ID, driver's license, title and lien information, and related paperwork required to consign or purchase a vehicle. These are stored encrypted in our document store and shared only with the staff and counterparties needed to complete the transaction.
Payment authorization data. When you submit a proposal or place a deposit, you enter card information into a hosted payment field operated by our third-party payment processor. RP Exotics does not see, transmit, or store the full card number; we receive a token and, optionally, a card-on-file reference.
Support requests: contents of messages submitted through our support form, including any attachments you provide.

Collected automatically

Device & usage data: IP address, user agent, referring URL, the pages you view, the searches and filters you run, approximate region (derived from IP), and timestamps. Used for analytics, fraud prevention, and rate limiting.
Session recordings & heatmaps. We use a third-party session-replay analytics tool to record masked playbacks of how visitors interact with the site (mouse movement, clicks, scrolls). Form fields and other content marked sensitive are redacted before leaving your browser. The tool is used to debug issues and improve UX and is never used to target advertising.
Error & performance telemetry. A third-party error-monitoring tool collects stack traces, breadcrumbs, and timing metrics when errors occur or pages load. Common identifiers (e.g. authentication tokens) are dropped before transmission. Used solely to keep the site reliable.
Cookies & similar storage: see our Cookie Policy for the categories and lifetimes.

2. How we use information

To create and operate your account and authenticate you.
To respond to inquiries and offers, manage consignments, and facilitate purchases, financing applications, and trade-ins.
To process deposit authorization holds and payments via our payment processor.
To send transactional email (e.g. password resets, deposit confirmations, offer status, support replies).
To send, with your consent, occasional marketing communications about new inventory and events.
To monitor performance, debug issues, prevent fraud and abuse, comply with applicable laws, and enforce our Terms of Service.
To power our AI-assisted concierge feature (“Ask Cash”): the prompt you type, optional vehicle context, and an anonymous session identifier are sent to a third-party large-language-model provider to generate a reply. Your prompts are not used to train any third-party model and are not associated with your account beyond what is needed to log support transcripts.

3. Categories of service providers

We share personal information with vetted service providers strictly to operate the site and deliver the services you request. Each is contractually bound to process the data only for the purposes listed and to maintain confidentiality and security safeguards consistent with this policy. We disclose the categories of providers below; the current list of named subprocessors is maintained internally and available to verified rights-holders on request.

Category	Purpose	Data categories
Cloud hosting and infrastructure	Hosting, database, file storage, transactional email, authentication.	All categories of personal information described above.
Identity and federated sign-in	Optional single-sign-on (e.g. third-party OAuth providers).	Email address and basic profile, only if you choose to sign in with a third-party account.
Payment processing	Card tokenization, deposit authorization holds, and payments. Card details are entered directly into the processor's hosted field; we receive a token, not the card number.	Tokenized card reference, billing contact, transaction metadata.
Analytics and session replay	Masked session replay, heatmaps, and aggregated UX metrics. Sensitive form fields are redacted before leaving your browser. Never used for advertising.	Masked interaction recordings, viewport, IP address, approximate region.
Error and performance monitoring	Reliability monitoring and incident triage.	Stack traces, breadcrumbs, IP address, page URL.
AI-assisted concierge	Generating replies for the “Ask Cash” feature. Prompts are not used to train any third-party model.	The text of your prompt and optional vehicle context.
Bot and spam protection	Protecting public forms from automated abuse.	IP address, browser signals, challenge token.
Internal communications and CRM	Routing inquiries, proposals, and consignment leads to our team for follow-up.	Name, email, phone, and the contents of your submission.
Market data references	Vehicle and auction comparables shown in the consignment portal.	VIN, make, and model lookups. No personal information is shared.

4. We do not sell or share your data

RP Exotics does not sell personal information, and we do not share it for cross-context behavioural advertising. We do not rent, trade, or otherwise monetize the personal information of visitors or clients. The only third parties that ever receive your data are the service providers described in section 3, acting on our behalf and bound by contract to use the data solely for the purposes we direct.

We may also share information when we reasonably believe disclosure is required by law, court order, or subpoena; necessary to investigate or prevent fraud, abuse, or security incidents; or necessary to protect the rights, property, or safety of RP Exotics, our clients, or the public.

5. International transfers

We are based in the United States and our processors operate in the United States and, in some cases, in the European Union. If you access the site from outside the United States, your information will be transferred to and processed in the United States.

6. Retention

We retain personal information for as long as your account is active and for a reasonable period afterwards to satisfy legal, accounting, and dispute-resolution requirements. Transaction records, including purchase agreements, deposit receipts, and consignment paperwork, are retained for the period required by Missouri dealer recordkeeping rules. Session-replay recordings are retained for a maximum of 30 days. Error telemetry is retained for 90 days.

7. Your rights and choices

Access, correction, deletion, portability. You may request a copy of the personal information we hold about you, ask us to correct inaccurate information, or request deletion. Submit your request via the channel in section 11.
Opt out of marketing. Every marketing email includes an unsubscribe link. Transactional messages, including order confirmations, password resets, and support replies, are not opt-outable as long as you have an active account.
California (CCPA / CPRA). California residents may exercise their rights to know, delete, correct, and limit use of sensitive personal information via the channel in section 11. We will not discriminate against you for exercising these rights. We do not sell or share personal information for cross-context behavioural advertising.
EEA / UK (GDPR / UK GDPR). Where GDPR applies, our lawful bases include performance of a contract (operating your account and processing your inquiries), legitimate interests (security, fraud prevention, improving the site), legal obligation (recordkeeping), and consent (marketing and non-essential cookies). You have the right to access, rectify, erase, restrict, port, or object to our processing, and to lodge a complaint with your supervisory authority.
Cookies & tracking. See our Cookie Policy for how to control cookies.

8. Security

We use TLS in transit, encryption at rest, scoped IAM credentials, and least-privilege access controls. No method of transmission over the Internet is 100% secure; we cannot guarantee absolute security but we work to protect your information using reasonable safeguards.

9. Children

The site is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe we have collected such information, please contact us so we can delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page reflects the most recent revision. Material changes will be announced on the site or by email.

11. Submitting a privacy request

To exercise the rights described in section 7, including access, correction, deletion, portability, or to limit the use of sensitive personal information, submit a written request by mail to RP Exotics, Attn: Privacy, 1155 N Warson Road, St. Louis, MO 63132, USA, or by email to privacy@rpexotics.com. We will verify your identity before completing the request as required by applicable law.