Privacy Policy

1. Who we are

sllat is a product of Omniblack Inc. ("Omniblack," "we," "us," "our"), a company based in Ottawa, Ontario, Canada. sllat is an AI-assisted lead-response service for independent automotive dealerships. This Privacy Policy explains how we handle personal information in connection with the sllat website, our demo request form, and the sllat product.

2. Who this policy covers

This policy distinguishes three groups of individuals whose personal information we may handle. Our role and obligations differ for each:

• Website and demo visitors — people who browse sllat.io or submit the demo request form.
• Dealer staff and account users — employees or representatives of a dealership that uses sllat.
• Dealer end-customers — the car shoppers who contact a dealership and whose messages are processed through sllat on the dealership's behalf.

3. Our role: controller and processor

Under PIPEDA, the organization that decides why and how personal information is handled is accountable for it. For website visitors, demo-form submissions, and dealership account users, Omniblack is the organization with primary responsibility — we determine the purposes of processing (a "controller" role).

For dealer end-customer information processed inside the product, Omniblack acts as a service provider, processing personal information on a dealership's instructions and for the dealership's purposes (a "processor" role). In that case the dealership remains the organization primarily accountable to its customers, and we act on its directions.

4. What we collect

Website and demo form. Your name, dealership name, work email, the nature of your request, and any message you include, plus standard server logs such as IP address, timestamp, and browser user-agent.

The product (on a dealership's behalf). The content of inbound shopper messages and the replies drafted in response; shopper names, email addresses, and phone numbers; vehicle of interest; appointment dates and the assigned staff member; and related conversation metadata.

We do not intentionally collect payment card numbers, government identifiers, or sensitive categories of information through sllat.

5. How we use information and our legal basis

We use website and demo information to respond to your request, to provide and improve the service, and to communicate with dealership accounts. We process dealer end-customer information solely to deliver the lead-response service on the dealership's behalf — drafting replies, checking inventory and availability, and scheduling appointments.

We rely on consent (express or implied, as permitted by PIPEDA) as our basis for handling personal information, and we limit processing to what a reasonable person would consider appropriate in the circumstances. Commercial electronic messages we help send are governed by CASL — see Section 12.

6. AI processing and human oversight

sllat uses an AI model to draft replies to shopper messages. Drafting is automated, but dealerships control how and whether replies are sent. In shadow mode, nothing is sent. In approval mode, every reply waits for a staff member to review and approve it before it goes out. Autonomous sending is enabled only if the dealership chooses to turn it on, within limits it sets.

The AI does not make decisions that produce legal or similarly significant effects about individuals without this human involvement. Drafts can contain errors, and dealership staff are responsible for reviewing outbound messages before they are sent.

7. Service providers (subprocessors)

We rely on the following providers to operate sllat. Each processes personal information only as needed to provide its service to us:

• Anthropic — AI model that generates reply drafts
• Supabase — database and authentication
• Postmark — inbound and outbound email
• Twilio — message notifications to dealership staff
• Vercel — application hosting
• Upstash — rate limiting
• Cloudflare — DNS and network delivery

Some of these providers store or process data in the United States.

8. Cross-border processing

Because some of our service providers operate in the United States, personal information handled through sllat may be stored or processed outside Canada. PIPEDA permits such transfers where the transferring organization uses contractual and other means to provide a comparable level of protection. While information is outside Canada, it may be accessible to courts, law enforcement, and government authorities under the laws of that jurisdiction. We choose providers that offer recognized security and contractual protections.

9. Retention

We keep personal information only as long as needed for the purposes described here. For lead and conversation data processed in the product, our default is to retain it for 12 months from the last interaction, after which it is deleted — unless the dealership instructs otherwise or the law requires a longer period. Website and demo-form submissions are kept for as long as needed to handle your request and our relationship.

10. Security

We use technical and organizational measures designed to protect personal information, including encryption in transit (TLS), access controls and authentication for the dashboard, row-level security in our database to separate each dealership's data, and least-privilege access for our team. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Your rights

Subject to PIPEDA, you may ask to access the personal information we hold about you, ask us to correct it, ask us to delete it, and withdraw consent (subject to legal or contractual limits).

Website visitors and dealership account users can contact us at info@omniblack.ca. Dealer end-customers: because we process your information on a dealership's behalf, please direct access, correction, and deletion requests to the dealership you contacted; we will act on that dealership's instructions to fulfill them.

12. CASL and opting out

Commercial electronic messages are subject to Canada's Anti-Spam Legislation (CASL). Replies sent through sllat on a dealership's behalf continue a conversation a shopper started and rely on the dealership's consent basis. You can opt out of further messages at any time by replying STOP, or by using any unsubscribe mechanism included in a message. We honour opt-out requests promptly.

13. SMS notifications to dealership staff

sllat sends operational SMS notifications to authorized staff of dealerships that use the platform. These alert staff when a new sales lead arrives, when an appointment is booked, or when a lead requires manager action. They are internal operational messages only — no marketing or customer-facing messages are sent from this number.

Recipients are staff whose mobile numbers the dealership provides and authorizes when setting up its account. Staff agree to receive these notifications as part of using the platform; we do not message numbers that were not provided and authorized this way. Message frequency varies with lead and appointment activity. Message and data rates may apply. Recipients can reply STOP to opt out at any time, and HELP for assistance, or contact info@omniblack.ca.

14. Cookies and analytics

The sllat marketing site does not use third-party advertising or analytics cookies. We use strictly necessary cookies to operate the dealer dashboard, such as authentication and session cookies. We use an error-monitoring service to detect and fix faults; it is configured not to collect IP addresses, cookies, or request headers as personal data. We do not run cross-site advertising trackers.

15. Children

sllat is a business tool intended for dealerships and their staff. It is not directed at children, and we do not knowingly collect personal information from children.

16. Changes to this policy

We may update this policy from time to time. When we make material changes, we will revise the "last updated" date above and, where appropriate, notify dealership accounts. Continued use of the service after an update means you accept the revised policy.

17. Contact and Privacy Officer

Questions, requests, or complaints about privacy can be sent to our Privacy Officer at info@omniblack.ca, or by mail to Omniblack Inc., Ottawa, Ontario, Canada. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.