Privacy policy

Who this policy covers

This policy covers dealership staff using DriveMatch and people whose information is submitted to or stored in a dealership's workspace. The dealership decides which leads to collect, which staff may use its records, and how to follow up. We provide the workspace and process information to operate, support, and secure it. The dealership may also have its own privacy notice and obligations.

The vehicle-shopping website has a separate privacy notice. The browser extension also has a Marketplace Assistant privacy policy.

Information we handle

• Accounts and operations: staff names, usernames, contact details, organization and role, authentication/session records, support requests, billing status, and security or activity records.
• Facebook connections: the authorization granted through Facebook Login for Business, Page names and identifiers, selected lead forms, access tokens, assigned recipients, and connection/import status.
• Lead submissions: the name, phone number, email address, location, vehicle interests, and other answers a person submits on a selected form, together with submission time and associated Page, form, lead, and ad identifiers when supplied.
• Workspace content: contacts, notes, messages, attachments, appointments, and follow-ups entered or received by the dealership. Optional features may also handle private appraisal photos, credit-application details and identity documents, or call recordings and transcripts, depending on what the dealership enables and what the person submits.

Facebook credentials are entered on Facebook's authorization screens. DriveMatch receives access tokens; the lead connection does not require you to give DriveMatch your Facebook password.

How we use information

We use information to authenticate users, connect authorized Pages, import submissions from selected forms, route leads to the chosen staff member, maintain customer history, and provide the workspace features the dealership uses. We also use relevant information to provide support, manage billing, troubleshoot failures, prevent misuse, and protect the service.

Importing a Facebook lead does not automatically send a customer text or record consent to receive marketing texts. Dealerships are responsible for ensuring their follow-up has the required permission and honours opt-outs. Optional AI features process relevant workspace information to produce requested or configured drafts, summaries, or suggestions for staff review.

We do not sell personal information received through the Facebook integration or use it for unrelated advertising. The lead connection does not publish posts to a personal profile or create or spend on ads.

Who may receive information

Records are available to authorized staff in the relevant dealership workspace, including administrators and staff assigned access. DriveMatch personnel may access information when needed to operate, support, or secure the service and handle privacy requests.

Service providers process information needed for hosting and storage, communications, payments, notifications, and enabled AI features. These include Railway and Supabase for infrastructure, Telnyx for communications, Stripe for payments, Expo for push notifications, and the configured AI provider, such as DeepSeek or OpenAI. Which providers receive information depends on the features in use. Information may be processed outside your province or Canada and be subject to laws where it is processed.

Meta independently handles information on its services under Meta's privacy policy. We may also disclose information where required by law or necessary to address fraud, security incidents, or legal claims.

Security, storage, and retention

We use HTTPS, authenticated accounts, access controls, and server-side encryption for stored Facebook connection credentials. These safeguards reduce risk; no service can guarantee absolute security.

We retain information while needed to provide the authorized service, maintain relevant records, meet applicable obligations, or resolve disputes. Retention depends on the record and the dealership's use. Disconnecting a Facebook Page stops new imports but does not automatically erase previously imported leads or related customer history.

After a successful disconnect, the saved Page token is cleared. If removal of the Meta subscription fails, it may be retained to retry that cleanup. Expired temporary authorization sessions are pruned. Contact us to request deletion of retained records; limited information may need to remain for a stated legal or security reason. Backup copies may remain until the applicable backup cycle expires and are restricted from ordinary use.

Cookies and your choices

The app uses session cookies and browser storage for sign-in, connection setup, and workspace preferences. These public policy pages do not load advertising or analytics scripts. Advertising measurement on the separate vehicle-shopping website is explained in that website's notice.

You can ask for access to or correction of your personal information, request deletion, or raise a privacy concern with us or the dealership. You can disconnect a Page in Team → Facebook leads and remove DriveMatch's access through your Facebook settings. Revoking access and deleting previously imported data are separate actions. Follow our data-deletion instructions to make a request without signing into DriveMatch.

Contact and changes

Email info@onespec.io with the subject “DriveMatch privacy request.” We may need limited information to verify your identity or authority and locate the relevant records.

We may update this policy as the service changes. The effective date identifies the current version. Material changes will be communicated through an appropriate notice.