assembl lab · Agent-ready cars
Privacy
DRAFT for Kate's review, 26 October 2026. This is not yet a published policy, and it needs a review by a privacy lawyer. Its permanent home will be an assembl.co.nz address. This copy on the lab site is for review only. Items marked TO CONFIRM need a decision.
Agent-ready cars lets an AI assistant, such as ChatGPT or Claude, search a demo dealer's cars, check a car before you buy it, and work out what it costs to run. It's built to work without your personal information.
Who we are
assembl is based in Tāmaki Makaurau Auckland, New Zealand, and is the agency responsible for this service under the Privacy Act 2020. Contact us about privacy at TO CONFIRM: privacy contact email at assembl.co.nz, or by post at TO CONFIRM: postal address.
What this policy covers
It covers the Agent-ready cars endpoint (TO CONFIRM: final URL; today https://assembl-lab.vercel.app/api/mcp/), the views it shows inside ChatGPT, Claude and other assistants, and the Agent-ready cars page. It's a demonstration. The dealer, Harbour Lane Motors (demo), and all of its cars are invented, and the car images are 3D renders, not photographs.
What each tool asks for
No tool asks for your name, email, phone number, address or account details. The tools store nothing you send them.
| Tool | What it takes | Personal information |
|---|---|---|
| search_cars | Budget, body type, fuel, seats, kilometres, year, must-haves, a test-drive day, and your region (one of New Zealand's 16 regions, never a town, street or coordinates) | None |
| get_car | A demo car's id | None |
| car_check | Facts about a car: make, model, year, kilometres, price, fuel, region, WOF and licence dates, and yes or no answers about the listing | None. It never takes names, addresses, plates, VINs or links. It asks only whether a listing shows the dealer's details and the VIN. It reports on the vehicle, never its owner, and refuses links. The make, model and year (and nothing else) are sent to NZTA's open Motor Vehicle Register to count how many are registered. |
| running_cost | The car, kilometres a week, your region, and optionally your own power or pump price | None |
| book_test_drive | A demo car, a time, and an optional note | None. A note with an email address or phone number in it is refused. |
| hold_car | A demo car, a date, and an optional reason | None. A reason with contact details in it is refused. No deposit or payment is taken. |
Contact details, only at test-drive confirmation
In this demo, nothing is sent to a dealer and no contact details are collected. In a live version with a real dealer, we would ask for your name and a phone number or email address only when you confirm a test drive. We would ask on an assembl web page, not in the chat, and use those details for one purpose: passing them to the dealer you chose so they can confirm the time. We would keep them for TO CONFIRM: retention period, and we would not use them for marketing unless you agree.
What the assistant app sends us
- Tool inputs. When you use a tool, your assistant sends us the inputs its model chose, as listed above. We use them to answer, then discard them. We never ask for, pull or rebuild your chat history.
- A coarse location, sometimes. ChatGPT may send a coarse location hint, such as a city and region. If you haven't named a region, we use the New Zealand region from that hint to sort cars by distance, and nothing else. We don't store it.
- Anonymous identifiers. ChatGPT may send anonymised user and conversation identifiers. We don't use or store them.
Technical logs
Our host, Vercel, records request details (IP address, time, the address requested and the response status) to run and protect the service. Our code doesn't write tool inputs or results to logs. Vercel keeps these logs for TO CONFIRM: retention for our Vercel plan. The views inside ChatGPT and Claude contain no analytics, trackers or advertising, and load nothing except the car renders from our own site.
Who receives information
- OpenAI, if you use ChatGPT, or Anthropic, if you use Claude. Your assistant sends your tool calls to us and receives our results. Their own privacy policies govern your conversation.
- NZ Transport Agency Waka Kotahi receives the make, model and year of a car being checked, as a query to its open data service. No personal information is sent.
- Vercel Inc. hosts the service. Our functions run in Vercel's Sydney region; Vercel is a United States company.
- In a live version, the dealer you choose, and only for the test drive you confirm.
We don't sell personal information and we don't use it for advertising.
Sending information overseas
Information is processed in Australia (Vercel's Sydney region), and may be accessed by Vercel, OpenAI or Anthropic in the United States. Under information privacy principle 12, we disclose personal information overseas only where the recipient is subject to comparable safeguards, or where we have agreed terms that protect it in a comparable way. TO CONFIRM: which ground applies for each provider
When someone else gives us information about you (IPP 3A)
Since 1 May 2026, information privacy principle 3A requires us to tell you when we collect personal information about you from someone other than you. For example, a dealer might pass us your enquiry. We would tell you, as soon as reasonably practicable, that we have it, why, who will receive it, our name and address, any law that requires the collection, and your rights to see and correct it, unless an exception applies. This demo collects no such information. Its tools are built not to accept other people's details, such as a private seller's name.
Your rights
You can ask for any personal information we hold about you, and ask us to correct it (information privacy principles 6 and 7). Contact us at the address above. If you're not happy with our response, you can complain to the Office of the Privacy Commissioner. To stop using the service, remove the app or connector from ChatGPT (Settings → Apps) or Claude (Customize → Connectors). It then loses access at once.
Children
The service isn't directed at children under 13. It's suitable for general audiences, including 13 to 17 year olds.
Changes
We'll date every change to this policy, and describe significant changes on this page. Draft of 26 October 2026.