Legal

Privacy Policy

How The DAS Board LLC handles personal information in DealerTech.io.

Last updated August 27, 2026

The short version

There are two kinds of personal information here and they are not treated the same.

Yours, if you contacted us. Name, email, phone, dealership. We use it to reply to you and nothing else. We do not sell it, share it for advertising, or send it anywhere except the four vendors listed below. Ask and we will show you what we hold or delete it.

Your dealership’s customers’. That belongs to the dealership, not to us. We hold it for them, under their instruction, and we do not use it for our own purposes. If you are a vehicle owner asking about your record, the dealership is the company to ask — we will help them answer, but the answer is theirs to give.

And what these marketing pages measure. They run Google Analytics, which sets two cookies and tells Google which pages you read. It never runs inside the product, never runs on a link sent to a customer, and does not run at all if your browser sends Global Privacy Control. Section 2 says exactly what goes and what does not.

This summary is written to be read. The sections below are the actual policy, and where they differ from the summary, they govern.

1. Two roles, and which one applies to you

The DAS Board LLC operates DealerTech.io. Depending on the data, we act in one of two capacities, and the difference decides who you ask about what.

We are the business (controller) for our own contacts

When you fill in the demo-request form on this site, or hold an account with us, we decided to collect that information and we decide what it is for. Requests about it come to us.

We are a service provider (processor) for everything in the product

Customer names, contact details, VINs, service history, declined work, inspection measurements, uploaded service contracts, consent records — the dealership put those there and the dealership decides what happens to them. We act on their instruction, under their agreement with us. We do not sell that data, use it to build our own products, or use it for any purpose other than providing the service to that dealership.

2. What we collect as a business

Demo requests

The form on this site asks for, and stores, exactly these: your name, your email address, your phone number, your dealership’s name, your role, how many rooftops the group has, which DMS you run, and whatever you type in the message box. It also records which page the form was submitted from. All of it except name, email and dealership is optional.

We use it to reply to you, to prepare a walkthrough that is about your store rather than a generic one, to schedule that walkthrough and keep the date in our own calendar, to keep track of where the conversation has got to — whether we have called, whether a walkthrough happened, and if it went nowhere, that it did and why — and, if we give you a tour code, to know whether you have used it. That is the whole list.

Alongside the form’s answers we keep a short activity log against your request: notes of what was said on a call, the walkthrough’s date, and entries the software writes itself when it issues a code or sets your dealership up. It is written by us rather than by you, it is only ever added to, and it is only read by DealerTech staff. If your request becomes a dealership account, we record which account it became — the link is what stops us chasing a customer as though they were still a prospect.

Tour codes

If we arrange a walkthrough we may issue you an access code for a guided tour of a demonstration dealership. What we store against it is a label naming who it was issued to (usually your dealership and your name), a link to your demo request, when it expires, how many times it has been used and when it was last used. We never store the code itself, only an irreversible hash of it — which is also why we cannot tell you what it was afterwards and will issue a new one instead.

The tour signs you into a fictional dealership built for your code alone — nobody else sees it, and it is deleted about a week after the code expires. Nothing you do inside it is recorded against you personally beyond the count above and a log entry noting which of the roles you chose; there is no real customer data in there, and please do not put any in.

Accounts

A user account holds an email address, a name, the dealership and role that account was granted, and the sign-in records our authentication provider keeps. We use it to sign you in and to attribute actions in the product to the person who took them — which is a deliberate feature, not a side effect: the audit log records who confirmed what, and that is the record a dealership relies on when a coverage answer is later disputed.

Analytics, on the marketing pages only

The public pages of this site — the homepage, the coverage demo, and the legal and trust pages you are reading now — run Google Analytics 4. We use it for one thing: to find out which of these pages get read, and whether anybody arrives from a search. It sets two first-party cookies, both named and explained in the cookie policy.

What goes to Google: the address of the marketing page you are on, the page or search that sent you there, an approximate location worked out from your IP address, and your browser, device type and screen size. That is the ordinary analytics set and it is the whole of it.

What never goes to Google: anything at all from inside the product. No workspace page, no customer record, no VIN, no appointment, no dealership name. No address containing an access code — a menu link sent to a customer, a photo-capture link, an invitation, a tour code. Nothing you type into the demo-request form. Analytics is switched on by an allowlist of marketing pages rather than switched off on everything else, so a page nobody has written yet is untracked by default.

Global Privacy Control is honoured. If your browser or an extension sends that signal, the analytics script is never requested, the cookies are never set, and Google does not learn you were here. The tag is also configured with Google Signals and ad-personalisation signals switched off, so what it collects cannot be joined to your Google account across other sites or used to target advertising.

What we do not collect

No advertising identifiers, no cross-site tracking, no fingerprinting, no session recording or heatmaps. Google Analytics as described above is the only measurement on this site, and there is none of it inside the product.
No cookies before you sign in beyond those two analytics ones. See the cookie policy, which is short.
No card numbers. Payment details are entered on Stripe’s own hosted pages and never touch our application.
No SMS. We do not send text messages — customer links are copied and pasted by a person.

3. Data we hold for a dealership

A dealership using DealerTech.io puts customer records into it: names and contact details, vehicles and VINs, service history, work that was quoted and declined, inspection measurements, prepaid maintenance and service contracts (including uploaded copies of the contract document itself, which can carry a signature), appointment history, and consent records showing what a customer agreed to and when.

That data is the dealership’s. We hold it to run the product for them and for no other reason. Concretely, that means:

We do not sell it, and we do not share it for advertising.
We do not use it to train machine-learning models — ours or anyone else’s.
We do not use one dealership’s data to serve another. Isolation is enforced in the database rather than in queries; see the security page.
Our staff access it only to operate and support the service, and granting that access is itself written to the audit log, when it starts and when it ends.

If you are a vehicle owner and this is about your record: contact the dealership you visited. They control that data and they are the ones who can change or delete it. If they need us to act, they tell us and we do. Writing to us first is not wrong — we will point you at the store and let them know you asked.

4. Who else touches it

The complete list of subprocessors — every company that receives data from the product. There is no fifth, and adding one means updating this page in the same change.

Supabase

Postgres database, authentication, and the private bucket customer documents are stored in. This is where dealership data lives.

Stripe

Subscription billing. Stripe holds the card; we never receive or store card numbers.

Anthropic

The model that reads uploaded service contracts and answers Co-Pilot questions. API data is not used to train models.

Netlify

Hosting and the scheduled jobs that run overnight.

Google is deliberately not on that list, and the reason is the point of the list rather than an exception to it. Google Analytics runs on the marketing pages and receives nothing from the product — no dealership data, no customer record, not one address from inside the workspace. The four above are the companies that touch what a dealership puts here. Google is named in full in the section above and in the cookie policy so that nobody has to find it out.

Data is hosted in the United States. We do not offer the product outside the United States and do not transfer dealership data abroad.

We may also disclose information where the law requires it — a subpoena, a court order — or to establish or defend a legal claim. Where a demand covers a dealership’s data and we are permitted to tell them, we will.

5. How long we keep things

Stated as what the software actually does, which is less tidy than a table of retention periods and more honest than inventing one.

Demo requests

Kept while they are useful as a business record, and deleted on request. There is no automatic expiry. The activity log described in section 2 is attached to the request and goes with it — deleting a demo request deletes what we wrote about the conversation.

Tour codes

A code stops working seven days after it is issued, or sooner if we withdraw it. The demonstration dealership behind it is deleted about a day after that, and everything in it goes with it. The row recording that the code existed is not deleted — that is how we can answer who was given a way in and when — and it survives both the deletion of that dealership and the deletion of the demo request it was attached to, with the links to each cleared. Deleted on request, like the rest.

Dealership data

Kept for as long as the dealership’s account is active, because deleting a service history is deleting the product. When an account ends, the data remains available to the dealership — the billing state that closes an account deliberately keeps export permitted, and we will export it for them on request — and we delete it on the dealership’s verified instruction.

Audit records

The audit log is append-only by design: no update or delete policy exists on it, and the product contains no code path that edits an entry. That is what makes it worth having. Credentials and tokens are redacted before anything is written to it.

We are not going to claim automated retention schedules we have not built. Where deletion happens on request rather than on a timer, this page says so. If your dealership needs a contractual retention period, ask and we will agree one in writing.

6. Your rights

California’s privacy law applies above revenue and volume thresholds that we do not currently meet. We grant these rights anyway, to everyone, because at our size it costs nothing but the willingness to answer an email — and a policy that only works once we are big enough to be forced is not a policy.

Know. What we hold about you, where it came from, and who we disclosed it to.
Access. A copy of it.
Correct. Fix anything wrong.
Delete. Remove it, unless we are required to keep it.
Non-retaliation. Exercising any of these changes nothing about the service you get.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. There is no advertising technology on this site: no pixel, no remarketing tag, no ad network. The one measurement tool we do run, Google Analytics on the marketing pages, is configured with Google Signals and ad-personalisation signals switched off — in our code, not in a settings panel somebody could change — so what it collects cannot be joined to an advertising profile or sold on. That is why there is no “Do Not Sell My Information” link anywhere on this site: the honest version of that page is this paragraph, plus the fact that a browser sending Global Privacy Control gets no analytics at all.

To exercise any of these, email info@dealertech.io. We will verify that you are who you say you are before acting — for an account, by the email address on it. Requests about a dealership’s customer records go to the dealership, as described in section 3.

7. Children

DealerTech.io is a tool for dealership staff. It is not directed at children and we do not knowingly collect information from anyone under 16. If a dealership has loaded such a record and tells us, we will help them remove it.

8. Changes to this policy

When this changes, the “last updated” date at the top changes with it. Where a change materially affects a dealership under contract, we tell them directly rather than relying on them re-reading a page.

9. Contact

The DAS Board LLC, operator of DealerTech.io — info@dealertech.io.

This document was written from the software it describes, and has not been reviewed by counsel. It is the honest starting text, not legal advice. If a term here matters to your dealership’s decision, tell us and we will get it right rather than argue it later.