Privacy policy

Who we are

Flash Fender Software, Inc. ('Flash Fender', 'we', 'us') operates the Flash Fender dealer-management platform. We are the data controller for the personal data processed to provide the service. The dealership that runs the tenant is the data controller for its customer data — we are the processor on their behalf.

What we collect

For tenant owners and authorized users: work email, name, role, IP, and audit events tied to your account. For end-customers of a dealership: only the data the dealership chooses to enter (name, contact, deal history, vehicle preferences). For voice calls: recording, transcript, and sentiment — only if the dealership has voice enabled.

• Account: name, work email, role, password hash (Argon2id).
• Usage: pages visited, features used, error events.
• Voice: opt-in recording, transcripts, sentiment scores.
• Support: anything you send us at support@flashfender.com.

How we use it

To provide the service you signed up for, to bill you, to secure your tenant, and to improve the product. We do not sell personal data. We do not use your data to train third-party models without your opt-in.

Sub-processors

Cloudflare (hosting), Stripe (billing), Resend (transactional email), ElevenLabs (voice synthesis), PostHog Cloud (product analytics, EU region). A live list and 30-day change notice is at /legal/sub-processors.

Your rights

Access, correction, deletion, export, restriction, portability. Use the in-app Privacy Console or email privacy@flashfender.com. We respond within 30 days; usually much faster.

Retention

Account data: lifetime of the account + 30 days, then deleted. Tenant data: owned by the dealership — they decide. Backups: 35 days rolling, encrypted at rest with per-tenant keys.

Security

SOC 2 Type II (cert 2026). End-to-end TLS. Per-tenant encryption keys (AWS KMS). Audit chain HSM-signed. See /security and /security/verify.

Contact

Privacy questions, DSAR, complaints: privacy@flashfender.com. EU representative available on request.