DealerMap (“DealerMap,” “we,” “us,” “our”) provides a mobile app and related web console (the “Service”) that vehicle-warranty sales representatives and their organizations use to map dealerships, record prospecting notes, and manage follow-ups. This policy explains what we collect, why, and your rights. It applies to users in the United States and, where noted, the EU/UK. DealerMap is published and distributed by No Rest for the Wicked LLC (doing business as DealerMap), Washington, USA. Contact: support@dealermap.app.

1. Information we collect

• Account information you provide: your name and email address, and (if you belong to one) your organization and role. Passwords are handled by our authentication provider and stored only as secure one-way hashes — we never see or store your plaintext password.
• Content you enter (“CRM records”): the dealership prospecting notes, visit logs, statuses, follow-up dates, and related business details you record about vehicle dealerships.
• Identifiers: a unique account/user ID used to associate records with your account.
• Billing information (organization plans only): when an organization buys a plan on the web, our payment processor Stripe collects the payment card, billing name, address, and, where provided, tax ID. Full card numbers go directly to Stripe and are never stored on our systems — we keep only what billing requires: plan, billing status and history, the billing contact's email, and a Stripe customer reference. Individual in-app purchases, when offered, are handled entirely by Apple.
• Device location — used on the device only: with your permission, the app uses your location to center and recenter the map near you. We do not collect, store, transmit, or track your location; it never leaves your device and is never sent to our servers. You can deny or revoke this in your device settings; the app still works.
• We do not collect advertising identifiers, cross-app tracking data, contacts, photos, health data, or browsing history. DealerMap contains no advertising or ad-tracking SDKs.

2. Why we process it, and our legal bases

We process the above only to create and secure your account; store and sync your CRM records; show an organization’s shared records to its authorized members; send in-app follow-up reminders; and operate, maintain, secure, and improve the Service. We do not sell your personal information and do not use it for cross-app advertising or tracking.

For users in the EU/UK, our legal bases (GDPR/UK GDPR Art. 6) are: performance of a contract (providing the Service you signed up for); our legitimate interests (operating, securing, and improving the Service, and enabling organization features), balanced against your rights; and, where required, your consent (which you may withdraw at any time).

3. Data ownership and organization sharing

DealerMap supports individual reps and organizations. Notes you record as part of an organization are shared with and retained by that organization — your manager and other authorized members can see them, and the organization (not the individual rep) controls that business data. Records on a personal (non-organization) account remain associated with your account.

4. How information is shared

• Service providers: we host data with Supabase (cloud database, authentication, and hosting), which stores and processes it on our behalf under its security and data-processing terms; and we use Stripe (payment processing for organization plans), which processes billing data under its own privacy policy and security (PCI DSS) obligations.
• Within your organization, as described in Section 3.
• Legal/safety: where required by law or to protect our rights, our users, or the public.
• We never sell or rent personal information and do not share it for advertising.

5. International data transfers (EU/UK users)

We are based in the United States and store data on U.S.-based infrastructure. When we transfer personal data from the EU/UK to the U.S., we rely on appropriate safeguards — the EU Standard Contractual Clauses (and UK Addendum) with our hosting provider and/or the EU–U.S. Data Privacy Framework — together with the U.S. safeguards recognized by the European Commission.

6. Data retention

We retain account information and records while your account is active, except organization data, which follows the organization's plan (below). When you delete your account (Section 7), your personal information is deleted; business records you contributed to an organization are retained by that organization in de-identified form (your name is removed), because that business data belongs to the organization.

Organization data follows the organization's plan. When an organization's free trial ends without a plan, or its subscription ends, the organization becomes read-only for 90 days so its administrators can export its data. Its members then see a final export notice in the app and the console, and the organization closes 14 days later. Once 30 days have passed after closing, we delete the organization's data within ten business days: its shared notes (including the notes members wrote for it), reports, imported files, settings, members list, and audit log (see Section 7 of the Terms of Service). Your own account and the notes on your personal (non-organization) account are not part of that deletion. We keep billing and tax records, and anything else the law requires us to keep, for as long as the law requires.

Like most cloud services, we keep encrypted backups of our database for disaster recovery. When information is deleted from the live Service, copies may persist in those backups for up to thirty-five (35) days before they expire on a rolling basis. Backups are encrypted, are not accessible through the Service, and are used only to restore service after a failure — if we ever restore from a backup, we re-apply deletions that were completed before the restore.

7. Your rights and choices

• Delete your account in the app: Settings → About → Delete account — permanently deletes your account and personal information. (Org-shared notes remain with the organization, de-identified.)
• Access / correction: view and edit records in the app, or email support@dealermap.app.
• California (CCPA/CPRA): you have the rights to know, access, delete, correct, and limit use of your personal information, and not to be discriminated against for exercising them. We do not “sell” or “share” (as defined by the CPRA) your personal information, so there is no opt-out to offer.
• EU/UK (GDPR/UK GDPR): you have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent. You may also lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner’s Office). To exercise any right, email support@dealermap.app.

8. Security

We use industry-standard measures including encryption in transit (HTTPS/TLS), hashed passwords, and per-record database access controls (row-level security) so an organization can access only its own data. No method of transmission or storage is 100% secure.

9. Children

DealerMap is a business tool not intended for anyone under 18 and not directed to children; we do not knowingly collect data from children.

10. Changes to this policy

We may update this policy; we will post a new effective date and, for material changes, provide in-app or email notice.

11. Contact

Privacy questions or requests: support@dealermap.app — No Rest for the Wicked LLC (doing business as DealerMap), Washington, USA.