Privacy

Effective October 24, 2026. This notice describes the Sophos Automotive pilot operated by Sophos Agency. Contact matt@sophosagency.ai with privacy questions or data deletion requests.

Information we access

We store your Sophos account identity, email address, dealership and team membership, reporting permissions and preferences. Google reporting connections are separate from your Sophos sign-in.

With your Google authorization and selected resource, we access Google Ads customer, campaign, ad group, keyword, conversion, ad and creative asset reporting; Google Analytics 4 property, website activity, landing page and measured event reporting; and Search Console property, search query, page and date performance. Google account identity and authorized resource metadata identify and scope the connection. Sophos does not request Gmail, personal Google Drive files or customer CRM records for these reporting features.

When a dealership administrator imports an inventory file or enables an approved inventory source, we retain vehicle details, VINs, stock numbers, prices, website and image links, feed settings and dated inventory observations. These observations support estimated Days on Lot and Merchant Center feed exports. Inventory files do not authorize customer CRM or DMS ingestion.

How we use this information

We use connected information to import and retain your dealership’s reporting history, update reports each morning while enabled, calculate date comparisons, display reporting and provide answers you request from an assistant. Team members see information according to the dealership permissions you assign. Google Ads access is used for reading reporting and observed creative information; this pilot does not publish or edit provider campaigns, tags or conversions.

Storage, sharing and assistants

The pilot runs on Google Cloud. Reporting and account records are stored in PostgreSQL; provider credentials stay on the server and reporting refresh tokens are encrypted before storage. Uploaded library files use private Google Cloud Storage when that feature is configured.

When you ask an enabled AI assistant a question, the question and relevant authorized dealership context or saved reporting facts are sent to OpenAI to generate that answer. This is a user-requested feature. Automatic reporting imports do not send reporting to an AI model. Sophos does not use Google user data to train generalized AI or machine learning models.

We do not sell Google user data or use it for advertising targeting. Infrastructure and AI providers process information to supply the features described here. Human access to connected Google data is limited to your affirmative permission for a specific support request, necessary security or abuse investigations, compliance with applicable law, or qualifying aggregated internal operations permitted by Google’s Limited Use requirements.

Retention and your controls

Available reporting history starts one calendar year before the dealership workspace start date. That start date stays fixed, and stored history accumulates during enrollment. A provider may limit which historical data is available. Pausing automatic reporting stops new scheduled imports and keeps saved reports available to authorized team members. Disconnecting a source stops access through that connection; it does not itself erase already saved reporting.

You can revoke Google access in your Google account connections. Ask us at the contact address above to delete your account or retained dealership data. We verify the requester’s authority and coordinate removal from active storage; we explain any backup or legally required retention limits when handling the request. We do not promise recovery of deleted records.

Google user data

Sophos Automotive’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Changes

We update this notice when the pilot’s data practices change. New uses of connected Google data require updated disclosures and any necessary consent before that use begins.