Privacy Policy

LotFlow ("we," "our," or "us") provides a cloud-based Dealership Management System (DMS) to automotive dealers ("Dealers" or "Tenants") and their retail buyers ("Customers" or "End-Users"). This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our platform, website, and native mobile applications.

1. Information We Collect

We collect information directly from Dealers, automatically through platform usage, and from Customers on behalf of the Dealer.

• Dealer Profile Information: Business name, physical address, employer identification number (EIN), dealer license details, administrator name, business email, and phone number.
• Customer & Deal Data: Personally Identifiable Information (PII) of buyers uploaded by Dealers, including full names, physical addresses, driver's licenses, social security numbers, credit profiles, employment history, and references.
• Vehicle Inventory Data: Vehicle Identification Numbers (VINs), mileage, vehicle history, purchase costs, sale price, and photos.
• Financial & Payment Data: Payment history, contract parameters, interest rates, payment schedules, and billing information.
• Technical & Usage Data: IP address, device type, operating system, browser type, and navigation paths collected via native application logs and cookies.

2. How We Use Your Information

• To Provide the Services: Generating truth-in-lending (TILA) installment contracts, syncing inventory, and managing vehicle deals.
• To Process Payments: We use Stripe to process SaaS subscription fees from Dealers, and to facilitate rent/installment payment routing between Customers and Dealers.
• To Send Alerts & Notifications: Automating payment reminders, contract finalizations, and receipts via email or SMS (e.g., Twilio).
• To Secure the Platform: Isolating tenant data via Supabase Row-Level Security (RLS) policies and verifying login sessions.

3. How Information is Shared

• No Sale of Data: We do not sell, trade, or rent Dealer or Customer personal data to third parties.
• With Service Providers: We share data with essential sub-processors, including hosting providers (Supabase/Vercel), email service providers (Resend), and text messaging APIs (Twilio).
• Stripe Connect Transactions: Financial transactions are handled directly through Stripe. Customer billing data is processed by Stripe under their privacy policies.
• Compliance with Law: We may disclose information if required to do so by law, regulation, or court order (e.g., DMV audit requirements, truth-in-lending compliance).

4. Data Security & Retention

• Isolation: All customer and dealership data is logically isolated via database RLS, ensuring one Dealer cannot view another's records.
• Encryption: Data is encrypted in transit using SSL/TLS protocols and at rest.
• Retention: We retain records as long as a Dealer account remains active, or as required by state-specific auto sales record retention laws (typically 3–7 years).