1. Who we are and what this Policy covers
PrepHub LLC ("PrepHub", "we", "us"), a Georgia (United States) limited liability company, operates the Lotlantic website and service (the "Service"). Address: 8735 Dunwoody Place, Ste N, Atlanta, GA 30350, United States. E-mail: prephub.llc.biz@gmail.com.
This Policy explains what personal information we handle, why, who receives it, how long we keep it and what you can ask of us. It covers registered users, visitors who open a listing page from a shared link, and sellers and other people whose information appears in listings or in our conversations with sellers. PrepHub decides how and why this information is processed. Marketplaces where listings were published are independent of us and have their own policies.
2. Information we collect
| Information | Source | Why we have it |
|---|---|---|
| Account: e-mail address, optional name or company name, a hashed password, whether your e-mail is confirmed, account dates, and the version and time you accepted the Terms | You | To create and secure your account, sign you in and record your agreement |
| Delivery and pricing settings: destination country and port, or a US delivery address (street, city, state, ZIP code) and its approximate map position, and any shipping margin we set for your account | You; us | To show shipping estimates |
| Sessions and security: session identifier and expiry, the IP address and browser string of each sign-in, sign-in events, and short-lived rate-limit counters by IP address | Your browser | To keep you signed in, protect accounts and limit abuse |
| Activity in your account: listings you view, searches with the filters used, listings you save or share, clicks through to the original listing, and requests you submit | Your use of the Service | To run the features, show you your own activity, understand how the Service is used and detect misuse. Our administrators can see this activity per account |
| Visits to shared listing pages: the listing, the time, the account that shared the link and, for visitors who are not signed in, a one-way keyed hash of the IP address and browser string (we do not store the visitor's IP address) | The visitor's browser | To count visits per shared link without identifying visitors |
| Seller information requests and reports: the listing, the request's status and progress, and the report | You; our seller-communication service | To perform the request (section 4) |
| Privacy requests: each export or deletion you request or ask us for by e-mail, with its date, status and outcome | You | To carry out the request and keep a record that we did |
| Correspondence: e-mails you send us and our replies | You | To answer you |
| Payment and Credit records (only when paid features are offered): what you bought, amounts, dates, payment status, the processor's customer and transaction references, card brand and last digits, billing country and Credit balance and history. Full card numbers are handled by the payment processor and never stored by us | You; the payment processor | To bill you, keep accounting and tax records, handle disputes and prevent fraud |
| Listing information (third-party content): listing number and link, title, vehicle details, price and price history, mileage, VIN, the seller's own description, city, state, ZIP code and map position, whether the seller is a dealer or a private seller, dates seen, and one copy of the main photo | Marketplace pages read by our listing collector (at present Facebook Marketplace); the public NHTSA vehicle catalog | To build the catalog, market comparisons and estimates |
| Seller conversations: messages between PrepHub and a seller about a listing and the answers taken from them | Sellers; our personnel | To answer a user's request and prepare the report |
The catalog does not copy a seller's name, profile link or rating. A seller's own description may contain details the seller chose to publish, such as a phone number. Information that is publicly available on a marketplace is still personal information when it relates to an identifiable person, and we treat it that way.
3. How we use information
- to provide the Service: accounts, catalog, saved listings, sharing, shipping estimates, seller information requests and reports;
- to secure the Service: sign-in, e-mail confirmation, password reset, rate limits, and fraud and abuse detection;
- to communicate with you about your account, your requests and changes to our terms;
- to understand and improve the Service, for example which listings and features are used and the quality of our data;
- when paid features are offered: to bill you, keep accounting and tax records and prevent payment fraud;
- to comply with law, respond to lawful requests and establish or defend legal claims.
We do not sell personal information, we do not use it for targeted advertising and we do not build advertising profiles.
4. Seller communication and AI
When you submit a seller information request, our operator is notified and our personnel contact the seller from PrepHub's accounts. The seller never receives your name or contact details unless you ask us in writing to pass them on.
Our seller-communication service uses an AI model provided by OpenAI through its API. It sends the listing text, the questions to ask and the seller's replies, with e-mail addresses and phone numbers in the replies replaced by placeholders. Your name, e-mail and other account details are never sent to the model. The model helps draft questions, interpret answers and write the short summary at the top of the report. Our requests are sent with OpenAI's option not to store them. Under OpenAI's published API terms, data sent through the API is not used to train its models, and OpenAI may keep it for up to 30 days to monitor abuse. OpenAI's own terms govern its handling.
Our personnel supervise these conversations. Some follow-up messages may be prepared and sent by our software under rules our personnel set and monitor, without a person approving each one. We do not make decisions about you with legal or similarly significant effects by automated means. Estimates and AI results concern vehicles, not you.
5. Who receives information
| Recipient | What they receive | Why |
|---|---|---|
| Supabase, Inc. (database hosting on Amazon Web Services, US-East, Ohio) | The information in section 2 | Our databases run there |
| Railway Corp. (application hosting, logs and photo storage, US-East, Virginia) | Information processed by the application, server logs, listing photo copies | Our website and background jobs run there |
| OpenAI, L.L.C. | Listing text, seller replies without e-mail addresses or phone numbers, and the questions; never your account details | AI assistance (section 4) |
| Telegram Messenger Inc. | Notices with a request or case number, the vehicle, its price and links; no names or e-mail addresses | To alert our operator to new requests |
| Our e-mail delivery provider, when one is in use | Your e-mail address and the content of account e-mails | To deliver confirmation, password-reset and account e-mails |
| Stripe, Inc. or another payment processor named at checkout, only when paid features are offered | Your payment details, billing information and the amount | To process payments; the processor also acts under its own privacy policy for fraud prevention and its legal duties |
| OpenStreetMap Foundation | Only if you click "Show map" on a listing page: your browser loads the map from openstreetmap.org, which receives your IP address and browser details | To show the listing's approximate location |
| Sellers | Nothing about you, unless you ask us in writing | To perform your request |
| Advisers, authorities and courts | What is necessary | Legal and accounting obligations, lawful requests, legal claims |
| A successor | Our records, subject to this Policy | If our business is merged, acquired or sold |
Facebook and other marketplaces receive nothing from us about you. When you follow a link to an original listing, you leave the Service and the marketplace's own policy applies.
6. Cookies, analytics and advertising
We use only what the Service needs to work:
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
better-auth.session_token (with a __Secure- prefix on HTTPS) | Cookie, HTTP-only | Keeps you signed in | Up to 30 days, extended while you use the Service; removed when you sign out |
locale | Cookie | Remembers your interface language | 1 year |
cf:nav:current, cf:nav:previous | Session storage in your browser, never sent to us | Lets the Back button return to the page you came from | Until you close the tab |
cf:map:auto | Local storage in your browser, never sent to us, set only if you choose to always show maps | Loads maps without a click | Until you clear your browser data |
These are strictly necessary for features you use, so we do not show a cookie banner. We do not currently use analytics or advertising tools, tracking pixels or third-party scripts, and our fonts are served from our own servers.
If we add analytics or advertising tools (for example Google Analytics or the Meta Pixel), we will update this Policy before they go live, load them only after you agree where the law requires consent, offer a way to opt out of any "sale" or "sharing" of personal information as the law defines those terms, and treat a Global Privacy Control signal from your browser as a request to opt out.
7. How long we keep information
| Information | How long |
|---|---|
| Account, delivery settings and saved listings | While your account exists; deleted when you delete your account |
| Sign-in sessions; e-mail confirmation and password-reset links | Until they expire (sessions 30 days after last use) |
| Searches, shares, clicks, saved-listing changes and listing views, including hashed visits to your shared links | 90 days |
| Sign-in events (security record) | 12 months |
| Seller information requests and reports | While your account exists; after you delete your account, 12 months without your name or e-mail, in case of a dispute |
| Records of privacy requests | 3 years after completion; your e-mail is replaced by a one-way hash once your account is deleted |
| Listings | While active on the marketplace; up to 12 months after they become inactive, after which only anonymized market facts remain (vehicle, rounded mileage, prices by date, state, dates seen) |
| Listing photo copies | 90 days after the listing becomes inactive |
| Seller conversations | Up to 12 months after the request they served is completed |
| Payment, Credit and tax records (when offered) | As long as accounting and tax law requires, and while a balance or obligation exists, even after account deletion |
| Server logs and database backups | According to our hosting and database providers' retention settings |
Records under a legal hold (a dispute, fraud review or legal claim) are kept until the hold ends. Automated deletion on this schedule is being introduced in stages and is not yet switched on for every category. Until it is, some records may be kept longer than shown; we use them only for the purposes in this Policy. Seller conversations are held in our separate seller-communication system and are deleted there by our own procedure.
8. Your choices and rights
In your account you can change your name, password, delivery settings and language, download your data as a file, and delete your account. Deletion takes effect at once: your sign-in, account details, delivery settings, saved listings, activity records and shared-link statistics are deleted and you are signed out everywhere. Seller information requests and reports are kept without your name or e-mail as section 7 says. If a request is still in progress, a payment or Credit balance is open, or a legal hold applies, the deletion waits for our review and we write to you. Deleting your account does not delete server logs and backups before their normal expiry, or seller conversations, which contain no name or contact details of yours.
By e-mail to prephub.llc.biz@gmail.com you can ask us to tell you what we hold about you and give you a copy, correct it, delete it, or stop a particular use where the law gives you that right. Depending on where you live (for example in a US state with a consumer privacy law, or in the European Economic Area or the United Kingdom), you may have some or all of these rights by law, and we honor them as that law requires.
We verify requests by confirming control of your account e-mail and may ask for more information. An agent you authorize may make a request for you if we can verify your permission and identity. We answer within the time the applicable law allows. If we keep something, we tell you what and why. If we decline a request, you can appeal by replying with the subject "Privacy Appeal", and you may also complain to your data protection or consumer protection authority. We will not treat you differently for using your rights.
9. Sellers and others who appear in listings
If your listing appears in the Service, or PrepHub contacted you about a listing:
- What we hold: the listing information in section 2, including your description, the VIN and one photo, and, if we contacted you, our messages and the answers taken from them. The catalog does not hold your name or profile.
- Why: to help our users research vehicles and to answer their questions about your listing. Listing information is information you published for buyers to see; we use it only to run the Service and never to market to you or to profile you.
- How long: as section 7 says.
- What you can ask: to see, correct or remove your listing or photo, or to stop being contacted. Use the Content Removal Policy or e-mail us with the listing link. When we remove a listing, we delete its information and photo from the Service and keep only its marketplace number so that it is not added again. This does not remove the listing from the marketplace where you published it.
10. Security
We use HTTPS for all traffic, store passwords only as salted hashes, require confirmed e-mail addresses, expire password-reset and confirmation links, rate-limit sign-in and reset forms, sign out other sessions when a password changes, limit database access by role and limit administrator access to named accounts. No service is completely secure, and we do not claim security certifications. If a security incident affects your personal information, we will notify you and the authorities as the law requires.
11. Where information is processed
PrepHub is a US company and our servers and providers are in the United States. If you use the Service from another country, including the European Economic Area, the United Kingdom or Switzerland, your information is transferred to and processed in the United States, which may not offer the same level of protection as your country. At the date of this Policy we have not put in place a formal transfer mechanism, such as standard contractual clauses, for these transfers.
12. Children
The Service is for adults. Registration requires you to confirm that you are 18 or older, and we do not knowingly collect personal information from children. If you believe a minor has given us personal information, contact us and we will delete it.
13. Changes to this Policy
We update this Policy when our practices or the law change, and the version date at the top changes with every update. For material changes we notify registered users by e-mail or in the Service before they take effect.
14. Contact
PrepHub LLC, 8735 Dunwoody Place, Ste N, Atlanta, GA 30350, United States. Privacy requests and questions: prephub.llc.biz@gmail.com.