Privacy Policy

DealerStak Canada Inc. is committed to protecting the privacy of our Dealer customers and their clients in accordance with PIPEDA and applicable provincial privacy legislation. This Privacy Policy explains what information we collect, how we use it, and how we protect it.

1. Information We Collect

1.1 — Dealer Business Information

During onboarding we collect: legal business name, operating name, address, phone number, email address, dealer license number (AMVIC or equivalent), GST/HST number, and dealership logo. This information is used to populate generated documents including Bills of Sale, invoices, and exports.

1.2 — User Account Information

For each User added to a Dealer portal we collect: first name, last name, email address, phone number, role, salesperson license number (where applicable), and account activity timestamps. This information is used for authentication, access control, and the audit trail.

1.3 — Deal and Transaction Data

Dealers enter vehicle inventory data, deal financial records, client information, and operational data into the platform. This data is the property of the Dealer and is processed by DealerStak solely to provide platform services.

1.4 — Client Data (Retail Module, when launched)

In the planned Retail Module, Dealers may collect client personal information including name, address, phone number, email, employment information, banking information, and Social Insurance Numbers for credit application purposes. SIN numbers, if collected, will be stored encrypted and never displayed in plain text. This data is the property of the Dealer.

1.5 — Technical Data

We automatically collect IP addresses at the time of signup and contract signing (for legal record purposes), device type and browser information, and session activity logs. This data is used for security, the audit trail, fraud prevention, and step-up authentication.

1.6 — Payment and Subscription Data

For each Dealer we store a Stripe customer ID and a Stripe subscription ID, which reference Dealer payment instruments held securely by Stripe. DealerStak does not store credit card numbers, bank account numbers, or other payment instrument details. Payment processing is governed by Stripe's Privacy Policy.

1.7 — StakScore Contributed Data

To build and maintain the StakScore wholesale valuation index, we take a de-identified record of vehicles moved on the platform. That record contains: year, make, model, trim, body style, cab configuration, drivetrain, transmission, engine description and displacement, fuel type, indicators of factory-fitted options, the odometer reading and its 5,000 km band, the wholesale purchase price, the wholesale sale price, the aggregate of reconditioning and other deal costs, the deal type, and the date the record was created.

The vehicle identification number is stored only as a one-way salted cryptographic hash together with its final six characters, and only so the same vehicle is never counted twice. The dealership's account identifier is stored only as a one-way salted cryptographic hash, and only so a dealer is never shown their own transaction back as an independent comparable. Neither hash is reversible, neither is published, and neither is disclosed to anyone.

This record never contains client or personal information of any kind, never contains a vehicle identification number in plain text, and never identifies the contributing dealership. We do not return or publish a value derived from fewer than five separate records, so no single dealership's transaction can be inferred from an output.

Dealers may opt out at any time using the StakScore contribution setting in the platform or by writing to support@dealerstak.com. Opting out stops future contributions and removes previous ones from the index; because the index is reciprocal, a dealer who has opted out does not receive StakScore valuations while the opt-out is in effect. Section 10 of the Terms and Conditions governs this in full.

2. How We Use Information

• To provide, maintain, and improve the DealerStak platform
• To generate documents including Bills of Sale, invoices, and financial reports
• To send transactional emails on behalf of Dealers when instructed to do so
• To send Dealer-facing communications including partial payment receipts, billing notifications, and platform updates
• To enforce access controls and maintain the audit trail
• To process subscription payments through Stripe
• To communicate with Dealer Principals about their account, billing, and platform updates
• To build, maintain and commercialise the StakScore wholesale valuation index using de-identified transaction data that cannot be traced to a dealership or a person (see Section 1.7)
• To investigate and respond to security incidents

3. How We Share Information

DealerStak does not sell, rent, or trade Dealer or client data to any third party for commercial purposes. That commitment covers Dealer and client data. It does not cover the de-identified StakScore aggregated outputs described in Section 1.7 — valuation ranges, scores and market statistics — which are DealerStak's own work product, contain no personal information, and cannot be traced back to any dealership or individual. We share information only with the categories of subprocessor described in Section 6 of the Terms and Conditions, in the following manners:

• With our cloud application infrastructure provider, for application data persistence and authentication
• With our object storage provider, for file storage — that provider does not access, scan or share the contents of your files
• With Stripe, for payment processing
• With our email delivery provider, for transactional and Dealer-facing email
• With an artificial intelligence provider, for automated extraction from documents you upload and for the in-app support assistant — see Section 3.1 below
• With a second artificial intelligence provider, for background replacement on vehicle photographs (vehicle imagery only)
• With our error monitoring and security alerting provider, for application errors and authentication-anomaly alerting (staff email addresses and IP addresses)
• With a vehicle data provider, for specification lookup from a VIN (VIN only)
• With vehicle manufacturers' own public document servers, to retrieve a vehicle's original factory window sticker (VIN only). We send nothing but the VIN, and the document we receive is the manufacturer's own, served back to you unmodified
• With our push notification provider, for mobile notification delivery (device token and notification text)
• With weather and radar data providers, for hail-risk forecasting and radar imagery
• With our administrative tooling provider, which hosts the Control Panel our staff use to administer accounts and to fulfil data-access requests
• With a messaging provider, for SMS and MMS vendor quote requests — configured but not yet in use
• With an IP geolocation provider, for sign-in geolocation — configured but not yet in use
• With law enforcement or regulatory authorities when required by applicable Canadian law
• In the event of a merger, acquisition, or sale of DealerStak Canada Inc. — Dealers will be notified before data is transferred to a new entity

The identity of each provider above, the country in which it operates, and the categories of information it receives are recorded in our subprocessor register. We will send you the current register on request to privacy@dealerstak.com.

3.1 — Automated and AI Processing

Several features work by sending a document you upload to a third-party artificial intelligence provider, which reads it and returns structured data to your portal. This is how statement import, Bill of Sale scanning, invoice scanning, licence expiry detection, contact parsing and run-list parsing work, and it is how the in-app support assistant answers questions.

What reaches that provider depends on what you upload. A bank statement includes your account number and the names of people and businesses you transacted with. A scanned Bill of Sale includes the seller's name, address, telephone number, business and tax registration numbers, and any government-issued identification number printed on the form. A licence document includes the licence holder's name.

Vehicle photographs — and nothing else — are sent to a second artificial intelligence provider when the background-replacement tool is used.

We do not use your data, or your clients' data, to train AI models, and our AI subprocessors are not permitted to do so either. Every feature listed above has a manual-entry alternative; if you would prefer nothing be processed this way, do not use the scanning and import tools.

3.2 — Where Your Information Is Processed

DealerStak's primary application database is hosted by our cloud infrastructure provider on infrastructure located in the United States (Oregon). Documents you upload are stored with our object-storage provider in Western North America. Several of the subprocessors above also operate in the United States or elsewhere outside Canada. Information transferred to them is subject to the laws of that country, which may permit access by foreign courts, law enforcement and government authorities. We require comparable data protection terms from every subprocessor, but we cannot exempt them from the laws that apply where they operate.

4. Data Security

DealerStak implements the following security measures to protect Dealer and client data:

• TLS 1.2 or higher for all data in transit
• Encryption at rest in our object storage and application database
• Row-level security policies in the application database
• Role-based access controls preventing unauthorized data access within portals
• Comprehensive audit trails logging all data access and modifications
• Mandatory approval gate for new User access to Dealer portals
• Step-up authentication for sensitive actions
• Account suspension protocols for payment failures
• Data deletion protocols upon contract termination
• Automated anomaly detection on authentication logs

While we implement commercially reasonable security measures, no system is one-hundred percent secure. In the event of a data breach, we will notify affected Dealers within seventy-two (72) hours as required by PIPEDA.

5. Data Retention

Dealer and client data is retained for the duration of the active subscription and for thirty (30) days following contract termination to allow data export. After this period all data is permanently deleted, except as outlined in Section 9.4 of the Terms and Conditions.

6. Dealer Rights Under PIPEDA

Under PIPEDA, Dealers and their clients have the right to:

• Know what personal information we hold about them
• Access their personal information
• Correct inaccurate personal information
• Withdraw consent to data collection (subject to legal and contractual limitations)
• File a complaint with the Office of the Privacy Commissioner of Canada

To exercise any of these rights contact us at privacy@dealerstak.com.

7. Cookies and Tracking

The DealerStak platform uses session cookies for authentication purposes only. We do not use advertising cookies or third-party analytics cookies that track Dealer activity across other websites.

8. Children's Privacy

The DealerStak platform is intended for business use only and is not directed at individuals under the age of eighteen (18). We do not knowingly collect personal information from minors.

9. Changes to This Privacy Policy

DealerStak may update this Privacy Policy from time to time. Material changes will be communicated to Dealer Principals via email at least thirty (30) days before taking effect. Continued use of the platform after the effective date constitutes acceptance of the updated policy.

10. Contact Information

For privacy-related inquiries, data access requests, or breach notifications, contact:

DealerStak Canada Inc.

privacy@dealerstak.com

support@dealerstak.com

dealerstak.com