Privacy policy

This is the privacy policy for FlashFender, Inc. ("we", "us", "our"). It explains what personal data we collect from people who visit flashfender.com ("the site") and from people who use the FlashFender dealer management system ("the service"). It also explains why we collect it, who we share it with, and how to ask us to delete it.

We tried to write this in plain English. If something is unclear, email privacy@flashfender.com and we'll rewrite the section.

From visitors to the site

When you visit flashfender.com we collect: pages viewed, time on page, referrer, country, device type, and (if you submit a form) the form fields you fill in. We use this to understand which sections of the site are working and to respond to your inquiry.

From customers of the service

When a dealer group uses FlashFender, we collect data about their employees (name, work email, role), their customers (name, address, driver's license data, phone, email), their vehicles (VIN, photos, history), their deals, and their documents. We process this data on the dealer's behalf to provide the service.

We do not sell customer data, end-customer data, or visitor data to third parties. Ever.

We process personal data on the following bases:

• Legitimate interest — to operate the site, respond to inquiries, and secure the service.
• Contract — to provide the service to paying customers.
• Consent — for marketing emails, cookies that aren't strictly necessary, and similar opt-in purposes.
• Legal obligation — to maintain tax, audit, and law-enforcement records when required.

We share data with a small set of sub-processors that help us run the service. The full list, with purpose and region, is on our security page. We notify customers 30 days before adding a new sub-processor.

We will also disclose data when required by law or in response to a valid legal process, and we will notify the affected customer before disclosure when we are legally permitted to do so.

We keep customer data for the lifetime of the customer's account, plus 90 days for off-boarding. After that, it is deleted from primary storage within 30 days and from backups within 180 days. Audit logs are retained for 24 months.

Depending on where you live, you have some or all of the following rights:

• Access the data we hold about you
• Correct inaccurate data
• Delete your data
• Object to or restrict processing
• Port your data to another service
• Withdraw consent at any time

To exercise these rights, email privacy@flashfender.com from the email address you want acted on. We respond within 30 days.

We use a minimal set of cookies: a session cookie for authenticated users, a CSRF cookie, and a first-party analytics cookie (no third-party trackers, no Facebook Pixel, no Google Analytics Advertising features).

See the security page for the full breakdown of how we protect customer data.

When we change this policy in a material way, we email active customers and post a notice on the dashboard. The "last updated" date at the top of this page reflects the current version.

Email privacy@flashfender.com. Or write to us at: