Privacy Policy

PITDRAFT is a CRM for car dealers, importers and exporters. Two different groups appear in this policy: dealers (our customers, who sign in and run their business in the product) and their customers (car buyers whose details a dealer records as leads).

1. Organization, station and user account data

When a dealer creates a workspace we store the organization name, its stations (name, country, city, address, phone, currency), and each user's name, email address, role and station assignment, plus interface preferences such as theme and sidebar state. Authentication (email/password, magic link, Google sign-in) is handled by our infrastructure provider; we never see or store your password.

2. Lead and customer data entered by dealer staff

Leads contain a customer name, phone number, email address, the car they're interested in, source, status, notes and follow-up dates. Reservations and sales additionally hold buyer name and phone, deposit and price details, payment method, and — where financing is used — an instalment schedule. This data is entered by the dealer's own staff, or submitted by a car buyer through that dealer's Greeting Bot link, which walks a visitor through a few questions and creates a lead in that dealer's workspace.

3. Car and public listing data

Vehicle records (chassis number, make, model, year, colour, status, purchase and selling prices, shipping and arrival dates, port of entry, import costs, photos, condition reports). Cost and margin figures are private to the dealer's organization. A car is only visible on a public listing page if the dealer explicitly marks it as publicly listed, and even then only make, model, year, colour, photos, the station's contact details and — at the dealer's choice — the asking price are shown.

4. Demo requests and contact messages

If you submit the demo or contact form on this website we store your name, company, email, phone, country, the package you were interested in and your message, plus a one-way hash of your IP address used solely for abuse rate-limiting. We use this to reply to you and to run our own sales process. It is never shared with or shown to any dealer organization in the product.

5. Operational records

We keep an audit log of create, update and delete actions on leads, cars, sales and reservations within an organization (what changed, by which user, when), in-app notifications, and standard server logs needed to run and secure the service.

Customer personal information entered by a dealer belongs to that dealer's organization. The dealer is the data controller for it; we process it on their behalf so they can run the product. Every record carries an organization identifier and access is enforced in the database itself with row-level security, not just in the interface — one organization cannot read, list or search another organization's leads, cars, sales, reservations, brokers, notifications or audit history. Within an organization, access is further scoped by role and station.

We do not sell personal data, share one customer's data with another customer, or use dealer or lead data to train external AI models. The AI insight summaries in the dashboard are generated on demand for that organization only, from aggregate figures for that organization, and are not used to improve any third-party model.

• Users the dealer has invited into their organization, according to their role.
• Our own staff, only where strictly necessary to operate, support or secure the service.
• Infrastructure and service providers acting as processors: our hosting and database provider, our transactional email provider, and the AI provider used for dashboard summaries.
• Anyone, but only for cars a dealer has deliberately published to a public listing page.

Business records are kept for as long as the organization's account is active. If a dealer deletes a record it is removed from the product; backups roll off on our provider's normal cycle. Demo requests and contact messages are kept while they're relevant to our sales follow-up. Write to us and we'll delete on request.

If you are a car buyer and want to know what a dealer holds about you, contact that dealer first — they control the record. If they can't help, or you dealt with us directly through the demo or contact form, email us at sales@pitdraftcrm.com and we'll action access, correction or deletion requests.

Data is encrypted in transit, isolated per organization at the database level, and public write endpoints (Greeting Bot, demo and contact forms) are rate-limited. Report any suspected vulnerability to sales@pitdraftcrm.com.

We'll update this page as the product changes. Questions go to sales@pitdraftcrm.com or through our contact page.