Todd
Todd — gettodd.ai · Effective date: September 23, 2026 · Version 1.1
This Privacy Policy explains how Xlerates Technologies LLC (“Xlerates,” “we,” “us”) collects, uses, processes, and shares information in connection with Todd (the “Service”).
Todd is a business-to-business software service designed for automobile dealerships. It is not directed to consumers or children.
We collect information used to establish and administer accounts and dealership workspaces, such as name, work email address, role, dealership name and address, and authentication information.
Authentication credentials are managed through our authentication infrastructure.
We process content submitted through the Service, including lender rate sheets and other documents, questions and messages submitted through chat, feedback, dealership information, and information entered into Service forms.
Dealers may include information relating to vehicle transactions or dealership customers when using the Service, such as credit-score information, vehicle information, amounts financed, trade information, or deal structure.
Dealers control what they submit and are responsible for determining that the information is necessary and lawful to provide to the Service.
We collect information concerning subscription plan, billing status, and transaction history.
Payment-card information is collected and processed by Stripe. Xlerates does not store complete payment-card details on its own application servers.
We may collect information concerning use of the Service, including feature usage, question volume, timestamps, device and browser information, IP address, authentication events, and application logs used to operate, secure, troubleshoot, and protect the Service.
We may collect information relating to communications with you, including delivery, bounce, and abuse-report information concerning transactional emails.
We use information as reasonably necessary to:
We do not sell Dealer Data.
We do not permit our AI subprocessors to use Dealer Data to train their generalized models.
We do not use Dealer-submitted lender materials to create a shared lender-document library for other dealerships.
We use third-party service providers to operate Todd. Depending on the functionality used, these providers may process information on our behalf under agreements governing their use of that information.
Current principal providers include:
| Stripe | Payment and subscription processing |
| Supabase | Database, authentication, and file storage |
| Vercel | Application hosting |
| OpenAI | AI processing of documents and questions |
| Google (Gemini) | AI document processing |
| Resend | Transactional email delivery |
Our subprocessors may process information only as necessary to provide their respective services to Xlerates, subject to their applicable contractual obligations.
We may also disclose information where reasonably necessary to comply with applicable law or valid legal process; investigate fraud, abuse, or security incidents; protect the rights, safety, or property of Xlerates, our users, or others; or complete a merger, acquisition, financing, corporate reorganization, or sale of assets subject to appropriate protections.
Todd uses artificial-intelligence services to process certain Dealer Data and generate responses.
Information submitted for AI processing may include portions of documents, questions, deal information, and other context necessary to provide the requested functionality.
Xlerates does not permit its AI subprocessors to use Dealer Data to train their generalized models.
Retention and processing practices applicable to AI providers may depend on Xlerates’ then-current service configuration and contractual arrangements with those providers.
Dealer determines what information it submits to Todd.
Dealer is responsible for ensuring that it possesses the rights, permissions, authority, and lawful basis necessary to provide information to Xlerates and authorize its processing by Xlerates and its subprocessors.
Dealers should not submit information that is unnecessary for the requested functionality or that they are prohibited from providing to a third-party service provider for processing.
Dealer Data is used to provide the Service to the applicable Dealer and authorized users of its workspace.
Xlerates does not make one dealership’s Dealer Data available to another dealership except where expressly authorized by the affected Dealer or required by law.
Xlerates does not publicly distribute Dealer-submitted lender materials.
We retain account information and Dealer Data for as long as reasonably necessary to provide the Service and for legitimate legal, billing, security, fraud-prevention, and operational purposes.
Following account termination, Dealer may request deletion of its Dealer Data by contacting Xlerates within 30 days.
Deletion may not immediately remove information contained in routine backups or information that Xlerates must retain for legal, security, billing, fraud-prevention, or compliance purposes. Such information will remain subject to applicable protections until deleted or aged out in accordance with the relevant retention process.
We maintain reasonable administrative, technical, and organizational safeguards designed to protect information processed through the Service.
These safeguards include controls relating to authentication, authorization, encryption in transit, access to production systems, and scoped access to third-party services.
No internet-connected service can guarantee absolute security. Users should maintain strong, unique credentials and promptly notify us of suspected unauthorized account access or security incidents.
Authorized users may access and update certain account information through the Service.
Dealers and users may request access, correction, or deletion of applicable information by contacting support@gettodd.ai.
Depending on applicable law and the nature of the information involved, additional privacy rights may apply. Xlerates will respond to valid requests as required by applicable law.
Transactional communications relating to security, billing, accounts, or operation of the Service are part of the Service. Promotional communications, if sent, will provide applicable opt-out mechanisms.
Todd uses cookies, authentication tokens, local storage, and similar technologies as necessary to authenticate users, maintain sessions, secure the Service, and remember applicable interface preferences.
We do not use third-party advertising cookies or cross-site behavioral advertising trackers through the Todd application.
Todd is a business service intended for use by dealership personnel and is not directed to children.
We do not knowingly provide the Service for use by children.
We may update this Privacy Policy from time to time.
The effective date and version appear at the top of the Policy. If we make material changes, we will provide notice through the Service, by email, or by another reasonable method before those changes take effect where appropriate.
Xlerates Technologies LLC
522 W Riverside Ave Ste N
Spokane, WA 99201
support@gettodd.ai
© 2026 Xlerates Technologies LLC · Terms of Service