Privacy Policy

Auto Hot List ("Auto Hot List", "we", "us", "our") is a business-to-business U.S. new-vehicle sourcing and export company headquartered at 1308 South Loop West, Houston, Texas 77054, United States. We act as the data controller for personal data processed through autohotlist.net and our related business communications.

For any privacy question, request, or complaint, contact sales@autohotlist.net or call +1 (713) 231-6731.

This policy applies to our website, sourcing request forms, contact forms, quotations, email campaigns, and any commercial correspondence with dealers, exporters, fleet operators, corporate accounts, and government buyers worldwide.

Our services are intended exclusively for businesses and business representatives. We do not knowingly collect data from consumers acting in a personal capacity, and we do not knowingly collect data from anyone under the age of 18.

• Identity and contact data — full name, company name, business email address, telephone number, country, and job role where provided.
• Sourcing request data — vehicle make, model, year, trim, condition, colors, quantity, destination port or city, target budget, and free-text notes you submit.
• Transaction and logistics data — quotations, invoices, VINs, shipping documentation, consignee details, and payment references (we do not store full bank or card numbers on this website).
• Communications data — the content of emails, WhatsApp messages, and form submissions, plus email delivery, open, click, bounce, and unsubscribe events for messages we send you.
• Technical and usage data — IP address, approximate country derived from IP, browser and device type, referring page, pages viewed, and time spent on the site.
• Security data — anti-abuse signals generated by our bot-protection and rate-limiting controls when you submit a form.

We do not intentionally collect special categories of personal data (such as health, biometric, or political data). Please do not include such data in free-text fields.

• To respond to sourcing requests, prepare shortlists, quotes, and pro-forma invoices.
• To source vehicles from U.S. franchise dealers and coordinate inspection and consolidation in Houston, Texas.
• To arrange export documentation, freight booking, and customs paperwork with logistics partners.
• To manage our customer relationship, accounts, invoicing, and after-sale support.
• To send transactional emails (order updates, confirmations, password and account notices).
• To send commercial updates and inventory notices where permitted, always with an unsubscribe link.
• To measure aggregate website performance and improve our content, pages, and service.
• To protect the site against spam, fraud, and abusive automated traffic.
• To comply with U.S. export control, sanctions screening, tax, accounting, and other legal obligations.

Where the EU or UK GDPR applies, we rely on the following legal bases:

• Contract — to take steps at your request before entering into a transaction and to perform our sourcing, sales, and export services.
• Legitimate interests — to operate and secure our website, run B2B marketing to relevant trade contacts, prevent fraud, and develop our business. We balance these interests against your rights and you may object at any time.
• Legal obligation — to meet export control, sanctions, tax, and record-keeping requirements.
• Consent — where required for certain marketing communications or non-essential cookies. You may withdraw consent at any time without affecting prior processing.

We never sell your personal data. We share it only as needed to deliver our service:

• U.S. franchise dealers and selling agents — to locate, reserve, invoice, and title vehicles.
• Freight forwarders, shipping lines, and customs brokers — to book, load, and clear shipments.
• Technology providers — website hosting, database and storage, email delivery and tracking, bot protection, and analytics, acting as processors under contract.
• Professional advisers — accountants, auditors, insurers, and legal counsel where necessary.
• Authorities — where required by law, court order, sanctions screening, or lawful government request.
• Corporate transactions — a successor entity in the event of a merger, acquisition, or asset sale, subject to this policy.

We are based in the United States and serve clients worldwide, so your data will be transferred to and processed in the United States and in the countries where our logistics partners operate.

Where data is transferred out of the European Economic Area, the United Kingdom, or another jurisdiction with transfer restrictions, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (with the UK Addendum where applicable), adequacy decisions, or your explicit consent. A copy of the relevant safeguards is available on request.

• Inquiries that do not become transactions — up to 24 months from last contact.
• Client and transaction records — up to 7 years after the final transaction, to meet tax, accounting, and export-control record-keeping duties.
• Marketing contact records — until you unsubscribe or object, plus a suppression record kept indefinitely so we can honor your opt-out.
• Website analytics — retained in aggregated or pseudonymized form.

When a retention period ends, we delete or irreversibly anonymize the data.

Depending on where you are located, you may have the right to access, correct, delete, or receive a portable copy of your personal data; to restrict or object to processing; to withdraw consent; and to lodge a complaint with your supervisory authority (for example, an EU data protection authority or the UK ICO).

California residents (CCPA / CPRA)

You have the right to know what personal information we collect, use, and disclose; to request deletion or correction; to opt out of "sale" or "sharing" of personal information; and not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising.

Other regions

We also honor equivalent rights under laws such as Brazil's LGPD, Canada's PIPEDA, Saudi Arabia's PDPL, the UAE PDPL, and comparable frameworks.

To exercise any right, email sales@autohotlist.net. We will verify your identity and respond within the period required by applicable law (generally 30 days, or 45 days in California). Requests are free unless manifestly unfounded or excessive.

We use strictly necessary cookies and local storage for session management, security, bot protection, and remembering your preferences. We also use limited first-party analytics to count visits, approximate country, and page performance.

Our marketing emails include a tracking pixel and link redirects that record opens and clicks so we can measure campaign performance. You can block remote images in your email client or unsubscribe at any time using the link in every email.

You can control or delete cookies through your browser settings. Blocking strictly necessary cookies may prevent forms and secure areas from working.

We use encryption in transit (HTTPS/TLS), access-controlled databases with row-level security, role-based staff access, rate limiting, and bot protection on public forms. Administrative areas are restricted to authenticated staff accounts.

No method of transmission or storage is completely secure. If a personal data breach is likely to result in a risk to your rights, we will notify you and the relevant regulator within the timeframes required by applicable law.

Our site may link to manufacturer, dealer, shipping-line, or mapping websites. We are not responsible for their content or privacy practices — please review their policies before submitting data.

We may update this policy to reflect changes in our services, technology, or legal requirements. The "last updated" date at the top of this page shows the current version. Material changes affecting your rights will be communicated by email or a notice on the site.