Privacy Policy

Last updated: September 23, 2026

Tolao is operated by SRS Intel, LLC (“Tolao,” “we,” “us”). This policy explains what information we collect, how we use it, and the choices you have. It covers our website at tolao.co, the Tolao platform at dashboard.tolao.co, and the text alerts we send.

What We Collect

Tolao is a business platform provided to licensed automotive dealership customers and their authorized team members under a business agreement.

Information you give us

• Account details: name, email address, role, and the dealership you work with
• Phone number: when you sign up or are added as a user, and for billing contacts. We send text messages only to people who have agreed to receive SMS alerts.
• What you enter in Tolao: notes, appraisals, ratings, saved or dismissed vehicles, and messages you send to our team or our assistant
• Website forms: the name, email, phone number, and message you submit through a contact or sign-up form on tolao.co

Information collected automatically

• How you use Tolao: sign-ins, pages viewed, features used, clicks, and time spent actively using the platform
• Device and connection details: browser type, device type, and IP address
• Error reports: technical details when something breaks, so we can fix it
• Session recordings: we may record how pages are used (for example, clicks and scrolling) to find confusing or broken parts of the product. Anything you type into a form field is hidden and never recorded.

If you connect a Google account

Some users may choose to connect a Google Workspace or Gmail account so they can read, send, and organize email inside Tolao. When you do, we receive your email address and access to your mailbox for those features only. You can disconnect at any time.

Payments

Payments are processed by our payment provider. We do not receive or store full card numbers.

How We Use Information

• To provide the platform, keep accounts secure, and sign you in
• To send the operational alerts and emails you have signed up for
• To understand how Tolao is used, including which stores and team members are active, so we can support our dealership customers and improve the product
• To respond to your questions and requests
• To bill our customers and meet legal obligations

Vehicle listing data is used for appraisal and acquisition decisions made by authorized users and dealership customers.

Cookies and Similar Technologies

We use cookies and browser storage for three purposes:

• Essential: keeping you signed in and the platform secure. Tolao does not work without these.
• Product analytics: inside the Tolao platform, our analytics provider (PostHog) uses cookies and browser storage to measure how the product is used, as described above.
• Website analytics and contact management: on our website and some account pages (such as sign-in and settings), HubSpot uses cookies to understand how visitors find and use our site and to manage contact requests. HubSpot may also receive information you type into forms on those pages.

You can block or delete cookies in your browser settings. Blocking essential storage will prevent you from signing in. Our website does not currently respond to browser “Do Not Track” signals.

Who We Share Information With

We do not sell your personal information. We share it only as follows:

• Service providers who run parts of Tolao on our behalf and may use the information only to provide that service to us: hosting and databases, text-message delivery, email delivery, payment processing, product and website analytics, error monitoring, image storage, customer-relationship software, and AI services that help analyze vehicle listings, draft messages, and power our assistant
• Your dealership: account administrators at your dealership can see and manage the user accounts within their store
• Legal and safety: when required by law, or to protect the rights and safety of our users or the public
• Business transfers: if SRS Intel, LLC is involved in a merger, acquisition, or sale of assets

Google User Data

Information received from Google APIs is used only to provide the email features you turn on inside Tolao. Tolao's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, and we do not use it to train AI models.

SMS Communications

Tolao sends SMS operational alerts to authorized users (dealership customers, team members, and invited users) who have explicitly consented via the platform. SMS consent is collected via a checkbox during account activation and is stored with a timestamp and the exact consent text shown at the time.

Message content is limited to:

• Lead notifications relevant to the user's role
• System status alerts (integrations, authentication, platform health)
• Operational updates and task assignments

Message frequency varies based on platform activity. Message and data rates may apply per the recipient's carrier.

Users may opt out at any time by:

• Replying STOP to any SMS message (handled automatically)
• Disabling SMS alerts in their account settings on dashboard.tolao.co

Carrier opt-out and HELP keywords (STOP, UNSUBSCRIBE, HELP, INFO) are honored automatically.

What We Don't Do

SMS Opt-In and Mobile Information Sharing

No mobile information, phone numbers, or SMS opt-in data will be shared with third parties, affiliates, or lead generators for marketing or promotional purposes at any time. Text messaging originator opt-in data and consent are never shared with any third parties for any purpose, except as strictly required by law or for a carrier, aggregator, or regulator investigating fraud, abuse, or policy violations in the messaging ecosystem.

Other Data Practices

• We do not sell user information to third parties
• We do not share phone numbers outside SRS Intel, LLC, except with service providers that help us run Tolao (such as our text-message provider and our customer-relationship software), which may use them only to provide those services
• We do not use SMS for marketing or promotional content
• We do not text anyone who has not explicitly consented via the platform

Vehicle Listings from Third-Party Sources

The Service displays used-vehicle listings aggregated from third-party platforms and public sources. This listing information is external third-party content shown for informational purposes; it is not personal information we collect from you, our users. When you choose to contact a seller, that interaction takes place on the original platform and is subject to that platform's own terms and privacy policy. Tolao is not responsible for the privacy practices of those platforms.

Data Retention

User account data is retained while the account is active and for a reasonable period after deactivation for record-keeping and compliance. SMS consent records (the time of consent, the consent text shown, and the IP address) are retained for the lifetime of the account for audit purposes.

Your Choices

• You can ask to see, correct, or delete your personal information by emailing support@tolao.co. We will respond within a reasonable time and may need to verify your identity first.
• You can turn off SMS alerts at any time, as described above.
• You can disconnect a connected Google account at any time.
• Depending on where you live, you may have additional rights under state privacy laws. Contact us to use them; we will not treat you differently for doing so.

Security

We use reasonable technical and organizational measures to protect your information, including encrypted connections and encrypted storage of sensitive credentials. No system is perfectly secure, and we cannot guarantee absolute security.

Children

Tolao is a business tool and is not intended for anyone under 18. We do not knowingly collect information from children.

Changes to This Policy

We may update this policy from time to time. When we do, we will change the date at the top of this page, and we may also let users know about significant changes by email or in the app.

Contact

Tolao is operated by SRS Intel, LLC. Questions about this privacy policy or data requests: support@tolao.co.