Lead Data and Consent

This document describes how the ADP Car Market Hub plugin captures, stores and manages contact and test-drive inquiries ("leads") submitted through the plugin's built-in form, including the available consent controls.

This document is not legal advice. Site operators should review the lead form text, consent wording and retention practices with their own legal advisor.

When to use this document

Use this document when you need to:

• Configure the contact / test-drive form for a vehicle dealership site.
• Document how visitor inquiries are processed for a privacy notice.
• Review the data fields that are stored for each lead.
• Plan how leads are exported, retained or deleted.

Overview

The plugin provides a built-in inquiry form that can be displayed on vehicle detail pages. Submissions are stored as a non-public custom post type (as24ci_lead) and can also trigger email notifications.

Two submission modes are supported:

• A standard inquiry (contact request).
• A test-drive request, which adds a date and time to the inquiry.

Submissions are managed in the plugin admin under the Leads tab, where they can be searched, filtered by status, exported to CSV and deleted.

Data captured per lead

Each lead stores the following information when the form is submitted:

• Contact name
• Email address
• Phone number (optional, if the field is enabled)
• Message (optional, if the field is enabled)
• Related vehicle (WordPress post ID, title and source listing identifier)
• Permalink of the related vehicle
• Source URL the request came from
• Submission timestamp (UTC)
• Whether a notification email was sent
• Internal status (new, contacted, closed, spam)
• For test-drive requests: requested appointment date and time
• For test-drive requests: a flag marking the lead as a test-drive

The submitter's IP address is not stored with the lead. The plugin uses a salted hash of the IP address only to apply temporary, in-memory rate limiting on the contact form (5 submissions per IP per 5 minutes via a WordPress transient that expires automatically).

Consent controls

The plugin exposes consent and privacy options for the lead form. They are available in the plugin settings under the lead form configuration:

The consent checkbox text and any link to the privacy policy must be written by the site operator to match the actual data processing performed on the site. The plugin does not provide pre-validated legal wording.

Email notifications

When a lead is submitted, the plugin can send notification emails using the standard WordPress mail function (wp_mail):

• A dealer notification to the configured recipient address.
• A confirmation email to the customer.

Both subject lines and templates are configurable in the plugin settings. Mail delivery itself depends on the site's WordPress mail configuration (SMTP plugin, hosting provider, etc.).

The recipient email for dealer notifications is configured through the Lead recipient email setting. If that setting is empty, the plugin resolves a recipient through a fallback chain: the CMH Team contact email assigned to the vehicle (an assigned team member, otherwise the general dealership email from the Team standards), then the seller-profile email, then the post author's email, and finally the WordPress admin email. When the relevant Team rule is enabled, the general dealership email can additionally be added as a copy recipient. Multiple comma-separated addresses are supported, the same as wp_mail. The CMH Team contact details used here are described in Data Storage Overview.

Step by step: configure the lead form

1. Open the plugin admin and go to the lead / contact form settings.
2. Set the Lead recipient email for dealer notifications (optional — defaults to the post author).
3. Enable or disable the optional fields (Phone, Message) as needed.
4. Configure the consent checkbox: - Decide whether the checkbox is required. - Provide consent text appropriate for your jurisdiction and site. - Provide the privacy policy URL.
5. Optionally customize the success and error messages, the email subjects and the email templates.
6. Save the settings and test the form on a vehicle detail page.

Managing leads

In the Leads admin tab, administrators can:

• Browse all leads in reverse chronological order.
• Search by name, email, vehicle title or source listing ID.
• Filter by status (new, contacted, closed, spam).
• Update the status of individual leads.
• Delete individual leads. Deletion removes the lead post and all related meta values from the database.
• Export the current view to CSV. The export respects the active filters.

The CSV export is the supported way to provide a copy of inquiry data to a person who has submitted an inquiry, when such a request is made under the applicable privacy law.

Anti-abuse measures

The plugin applies several measures to reduce form abuse:

• A WordPress nonce is required for every submission.
• A hidden honeypot field silently rejects automated submissions.
• A short-lived rate limit (5 submissions per IP per 5 minutes) is enforced through a WordPress transient. The IP address is hashed with a site salt before use and is not stored with the lead.

Operational notes

• The lead post type is registered as non-public and is intentionally not exposed in the WordPress REST API or the standard posts UI. Use the plugin's Leads tab to manage submissions.
• The plugin does not implement an automatic retention period for leads. Site operators are responsible for deleting leads that are no longer needed, using the Leads tab.
• The plugin does not register a WordPress personal-data exporter or eraser hook. Requests for export or deletion of personal data should be handled manually using the search, CSV export and delete functions in the Leads tab. Verify this behavior in the current plugin version before publishing process documentation that depends on it.
• If Delete data on uninstall is enabled, all lead posts are deleted when the plugin is uninstalled. See Data Storage Overview.
• Email content (especially the customer confirmation template) typically contains personal data. Operators should ensure that the configured mail transport is appropriate for transmitting that data.

Troubleshooting

• Lead notifications are not arriving — check the site's general email delivery (try sending a test mail), confirm the Lead recipient email is set correctly, and verify that the mail is not being filtered as spam.
• Submissions are silently accepted but no lead appears — this can occur when the honeypot field is filled (automated submission) or the rate limit is reached. Both cases are intentional and do not produce visible errors.
• The consent checkbox is not visible — confirm that **Consent checkbox enabled** is on, and that the consent label is configured.
• A visitor asks to delete their inquiry — locate the lead in the Leads tab using the email or name search, optionally export it to CSV first, then delete it.

Related documents

• Data Storage Overview
• Analytics Retention
• Search Alerts Double Opt-In
• Access Control and Capabilities