Privacy Policy
Effective date: January 1, 2026 · Last updated: January 1, 2026
1. Who this policy covers
This policy explains how Proud Stars Inc. ("Proud Stars," "we," "us"), the company behind DealerFlow (the "Service"), collects, uses, discloses, and protects personal information in connection with the Service. It applies to two groups of people:
- Dealership users — staff at a dealership ("Dealer," "you") who sign in to DealerFlow to do their jobs.
- Customers — a Dealer's own customers, whose deal and delivery information a Dealer enters into DealerFlow, and who may visit a public delivery-status page linked to their deal.
Proud Stars is governed by the Personal Information Protection and Electronic Documents Act ("PIPEDA") and, where applicable, provincial private-sector privacy legislation. We act as a service provider (processor) with respect to Customer personal information entered by a Dealer, and the Dealer remains the organization accountable for that information under PIPEDA. This policy also describes our own practices as the organization accountable for Dealer account information.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account information | Name, work email, phone number, role, dealership affiliation | Provided by the Dealer user or their organization at sign-up (via Clerk) |
| Deal & delivery data | Customer name, phone, vehicle details, sale price, lender, delivery appointment, promised items | Entered by Dealer staff in the ordinary course of processing a sale |
| Documents | Proof of insurance, proof of income, identification, signed forms, photos uploaded via the customer portal | Uploaded by Dealer staff or by a Customer through their delivery-status link |
| Usage & log data | Sign-in timestamps, IP address, actions taken in the app (our audit log) | Generated automatically as the Service is used |
3. How we use personal information
- To provide the Service — tracking a deal from sale through funding to delivery.
- To notify the right person (a Dealer's own staff, or a Customer) when something needs their attention — a document received, an appointment confirmed, an item promised at delivery.
- To maintain a complete activity log for accountability and dispute resolution.
- To provide customer support and respond to inquiries.
- To maintain the security, integrity, and availability of the Service.
- To comply with legal obligations.
We do not use Customer personal information for our own marketing, and we do not build advertising profiles from it.
4. We do not sell personal information
Proud Stars does not sell, rent, or trade personal information to third parties, under any circumstance, for any dealership or customer data processed through the Service.
5. Who we share it with
We share personal information only with the subprocessors that operate the Service on our behalf, each bound by a written agreement to protect it and to use it solely to provide their service to us. See our Security page for the current list (currently: Supabase, Railway, Clerk, Twilio, and Sentry). We may also disclose information if required by law, court order, or to protect the rights, property, or safety of Proud Stars, our Dealers, or the public.
6. Where data is stored
Deal, delivery, and document data is stored with Supabase (PostgreSQL and file storage) in data centers located in North America. Application infrastructure runs on Railway, also hosted in North America. We do not knowingly store personal information outside North America. Where a subprocessor's infrastructure involves cross-border transfer within North America (e.g., a Canadian dealer's data processed on US-based infrastructure), it remains protected by contractual safeguards consistent with PIPEDA's accountability principle, and remains subject to lawful access requests in the jurisdiction where it is held.
7. Retention & deletion
- We retain Dealer account information for as long as the account is active, and for a limited period afterward to satisfy legal, accounting, or dispute-resolution needs.
- We retain deal, delivery, and document data for as long as the Dealer account is active, in accordance with the Dealer's own instructions and applicable record-keeping obligations (many provinces require dealers to retain deal records for several years).
- A Dealer may request deletion of specific Customer records at any time, subject to any legal retention obligation that overrides the request; we will confirm what, if anything, cannot be deleted and why.
- On termination of a Dealer's subscription, we delete or anonymize account and deal data within 90 days, except where retained copies are required by law or exist only in encrypted backups pending their normal rotation/expiry.
- A customer-portal link expires automatically 60 days after a vehicle is delivered.
8. Security
We protect personal information with encryption in transit and at rest, role-based access control, a complete audit log of who changed what, and tenant isolation between dealerships. Full detail is on our Security page.
9. Your rights under PIPEDA
Subject to limited exceptions, you have the right to:
- Know what personal information we hold about you and how it is used.
- Access and request a copy of your personal information.
- Request correction of inaccurate or incomplete information.
- Withdraw consent to our collection, use, or disclosure of your personal information, subject to legal or contractual restrictions.
- File a complaint about our handling of your personal information.
If you are a Customer of a dealership using DealerFlow, please direct access, correction, or deletion requests to that dealership first, since they control the underlying record. If you are a Dealer user, contact us directly using the details below.
If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the relevant provincial privacy regulator.
10. Cookies
The Service uses only the essential cookies required for authentication (via Clerk) and basic session state. We do not use third-party advertising cookies or cross-site tracking on the application. This marketing website does not set analytics cookies beyond what is necessary for it to function.
11. Children's data
DealerFlow is a business-to-business product intended for use by adults in a commercial context and is not directed at children.
12. Changes to this policy
We may update this policy from time to time. We will post the revised policy here with an updated "Last updated" date, and where changes are material, we will notify Dealer account administrators directly.
13. Our Privacy Officer & contact
Proud Stars Inc.'s Privacy Officer is accountable for our compliance with this policy and with PIPEDA. To reach them, or with any question about this policy, contact us at hello@proudstars.com.
Proud Stars Inc.
Ontario, Canada