Privacy Policy
is a dealer management system for Ontario motor vehicle dealers, operated by ("we", "us"). This policy explains what personal information we collect, why, who we share it with, how long we keep it and how to reach us. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
1. Two kinds of information
Account information. When a dealership applies or signs up, we collect the dealership's legal and operating names, address, phone number, Ontario registry (RIN), OMVIC dealer and salesperson registration numbers, HST/GST number, and the names, roles and e-mail addresses of its users. We use this to review the application, run the account and contact the dealership. We are responsible for this information.
Dealership records. Dealerships use the service to keep their own business records: vehicles, deals, customers and co-buyers, trade-ins, lenders, leads, tasks, service records and uploaded documents. These records often contain their customers' personal information. The dealership decides what goes in and is responsible for it under privacy law. We store and process these records only to provide the service to that dealership, and we do not use them for any purpose of our own.
2. How we use information
- To provide, secure and support the service, including printing the dealership's forms.
- To send service e-mails: invitations, password resets, application decisions and important notices.
- To fix problems and improve the service, using account and usage information. Where we study usage, we use aggregated information that does not identify a person or a dealership's customers.
- To meet legal obligations and enforce our Terms and Conditions.
We do not sell personal information. We do not use dealership records for marketing or advertising, and we do not share them with advertisers or data brokers.
3. Service providers
We share information only with providers that help us run the service, and only as much as each one needs:
- Cloudflare hosts the application, its database and stored files.
- Resend delivers our e-mails (recipient address and message content).
- Anthropic reads a document only when a user chooses to import one (for example a lender approval), so its details can be filled into a deal.
- The U.S. National Highway Traffic Safety Administration (NHTSA) receives a vehicle's VIN to decode its make, model and year. No personal information is sent.
These providers may store or process information outside Canada, including in the United States, where it may be accessible to authorities under local law. We may also disclose information where the law requires it, or to protect the rights, property or safety of our users or the public.
4. Cookies and browser storage
We use one essential cookie to keep you signed in, and the browser's local storage for a few display preferences such as print settings. We do not use advertising or tracking cookies. If you block cookies, you will not be able to sign in.
5. Security
All connections are encrypted. Each dealership's records are kept separate from every other dealership's, and users see only their own dealership. Passwords are scrambled in your browser before they are sent and scrambled again before they are stored, so no one, including us, can read them. Two-factor sign-in is available. Our staff access dealership records only when the dealership asks for support, to investigate a security issue, or when the law requires it.
If a breach of security creates a real risk of significant harm, we will notify the affected dealership and the Privacy Commissioner of Canada as PIPEDA requires.
6. Keeping and deleting information
We keep information while the dealership's account is active. When an account closes, the dealership can export its records for 30 days, after which we delete them. Copies in backups are removed as the backups expire. We keep application records and billing records as long as the law requires. Dealerships remain responsible for keeping their own records for as long as OMVIC and tax rules require, so they should export them before closing an account.
7. Your rights
You can ask to see, correct or delete personal information we hold about you, or withdraw consent, by e-mailing . We may need to confirm your identity first, and we will reply within 30 days. Some information may be kept where the law requires it, and closing or deleting information may stop the service from working for you.
If you are a customer of a dealership that uses , please contact that dealership first: it controls your records. We will help the dealership answer your request.
If you are not satisfied with our answer, you may contact the Office of the Privacy Commissioner of Canada.
8. Changes
We may update this policy. We will post the new version here with its effective date, and we will e-mail dealership administrators about significant changes.