Privacy Policy

1. Who we are and what this covers

DriveForma Inc., based in British Columbia, Canada, operates the drive. automotive sales workspace and its websites. Our primary website is driveforma.ai. This policy also covers related domains we operate that direct to the same Services.

This policy explains how we handle information about identifiable people when they visit our websites, contact us, use an account or have their information entered into a dealership workspace. It does not replace a dealership’s own privacy notice or a third-party service’s policies.

Applicable privacy requirements may include British Columbia’s Personal Information Protection Act and Canada’s Personal Information Protection and Electronic Documents Act, depending on the organization, activity and information flow. We do not treat this policy as consent to every possible use of personal information.

2. Your relationship with a dealership

For website inquiries, our account administration, support and security, DriveForma determines the purposes for which it handles information.

For customer and staff records entered by a dealership, we generally provide the workspace and process information to deliver the service and follow that dealership’s authorized instructions. The dealership is responsible for its customer relationship, workplace practices, collection notices, contact permissions and instructions to its staff. DriveForma remains responsible for the obligations that apply to its own handling of personal information.

If you are a dealership’s customer or employee, start with that dealership for questions about its records or business decisions. You can also contact us at info@driveforma.ai; we will help identify the appropriate organization and address information within our responsibility.

3. Information we handle

What we receive depends on how you use the Services and what an authorized user enters or connects. The principal categories are:

We receive information directly from you, from authorized dealership users, from a provider you connect and from the operation of the Services. A connected Google sign-in can provide your account identifier, verified email and profile name.

Do not enter more information than the task needs. Government identity documents, credit reports, bank details, passwords and payment-card data should not be placed in ordinary notes, prompts or screenshots. A financing estimate in the workspace is not the same as a credit application or credit decision.

4. Why we use information

We use information for the purposes reasonably connected with the Services, including:

• Responding to inquiries, arranging walkthroughs or bookings and providing support.
• Creating accounts, authenticating users and applying dealership access settings.
• Organizing inventory, customer work, appointments, follow-ups, team activity and materials users choose to create.
• Providing an AI or connected-service feature when an authorized user invokes it.
• Maintaining, troubleshooting and securing the Services; investigating suspected misuse and meeting legal obligations.
• Managing our business relationship and any agreed subscription, transaction or service records.

We limit use and disclosure to the identified purpose, a compatible lawful purpose or another purpose supported by appropriate consent or legal authority. A materially different purpose that needs consent will be explained before we seek that consent.

5. AI features and your information

AI drafting features use an external AI provider, currently Anthropic. When you use one, the request may include your instructions and relevant context such as vehicle facts, a customer’s name or preferred name, language, contact preferences, visit or follow-up details, deal information and notes. A screenshot-based reply feature can send the image you choose, including personal information visible in it.

A feature can select relevant context from the associated record automatically, so the request may contain more than the words you type into a prompt. Consider the information in that record and any uploaded image before invoking the feature. A dealership must have the appropriate authority and notices for this disclosure; avoid unnecessary sensitive information in records or images used with AI.

The application can retain AI prompts, selected facts, generated text, screenshot-derived text, model and usage details and associated account or record references as draft history. Deleting an original customer entry does not necessarily delete that separate history.

The AI provider processes requests under its applicable commercial agreement, data-processing terms and retention rules. Processing locations and retention depend on that arrangement, including any permitted security or legal retention. Anthropic’s commercial model-training explanation and retention explanation describe its standard practices and exceptions; the terms applicable to a particular service arrangement govern. This policy does not authorize DriveForma to repurpose confidential customer records for unrelated model training.

6. Who can receive information

Information may be disclosed to:

• Authorized people in your dealership. Depending on their access, workspace leaders can view team activity and administer staff. Other users can see records or work made available to their role. An activity summary may identify a customer or staff member.
• Service providers. Providers supporting hosting, storage, AI processing, sign-in, security and support receive information needed for their role. Services used include Render for hosting and Anthropic for AI; Google processes information when its sign-in option is used.
• Services or recipients you choose. This includes a connected dealership system, a recipient of a shared link or material, and an email or messaging application opened by a user. Those providers handle information under their own terms as applicable.
• Legal or business recipients. Where legally authorized or required, information may be shared to respond to lawful requests, protect people or systems, resolve a claim, or assess and complete a business reorganization or transfer with appropriate confidentiality and use limits.

Our permission to process dealership content is limited to operating, supporting and securing the service, authorized instructions and legal obligations. It is not permission to sell dealership customer lists or make confidential records public.

7. Connected services and messages

Before connecting an outside service, check the account and permissions requested. A connection may need to store provider identifiers, tokens, credentials or session details and import information into your workspace. Available capabilities depend on the particular connection; permission to read information is not necessarily permission to send a message.

Some messaging tools prepare an email or text in your device’s application. The recipient and draft can then be handled by that application and its provider. The workspace may also record message activity. A logged activity does not by itself establish delivery or consent.

You can disconnect supported connections through their settings or ask us for help. Revocation stops further authorized access as the connection permits; it may not remove information already saved in other workspace records or at an external service.

8. Cookies, storage and site activity

The Services use cookies and browser storage for functions such as keeping you signed in, applying language or display preferences and maintaining a secure session. Hosting systems can also process technical request information, including IP addresses and access logs.

You can manage cookies and local storage in your browser. Blocking necessary storage may stop sign-in or preferences from working. Interactive website examples use sample people and activity; avoid entering real customer information into a public demonstration.

If optional analytics or advertising technologies are introduced, we will describe them and provide any notice and choice required before using them. This policy does not provide blanket consent for undisclosed tracking.

9. Where information is processed

Information may be stored, accessed or processed in Canada, the United States or another country where DriveForma or a provider operates. We do not represent that all data remains in British Columbia or Canada. Foreign authorities may have lawful access under the laws of their jurisdiction.

When we arrange processing through a service provider, we remain accountable for the obligations that apply to information under our control and use appropriate contractual and other safeguards for the arrangement. Ask info@driveforma.ai if you need information about processing locations or providers for your proposed setup.

10. Retention and deletion

Retention depends on the information’s purpose, the dealership’s instructions, the account relationship, legal and recordkeeping requirements, security needs and the resolution of disputes. One fixed retention period does not apply to every record or provider.

Deactivating a staff member stops account access as configured; it does not erase that person’s work. Deleting a customer entry may leave associated message history, AI drafts, activity records or other records retained for a separate purpose. A deletion request should therefore identify the information and workspace involved, rather than assume a single interface action removes every copy.

Contact us about access, export, correction or deletion before closing an account. We assess requests under applicable law and the dealership’s authority. Some information may need to be retained, and backup or provider copies may follow a separate retention cycle. Subject to required retention, we destroy records containing personal information or remove identifying links when keeping them no longer serves the original purpose and is no longer necessary for legal or business reasons. Where British Columbia law requires it, information used to make a decision directly affecting an individual is retained for at least one year afterward. This retention process is separate from the customer-delete or staff-deactivation controls described above.

11. How information is protected

We use administrative, technical and organizational safeguards appropriate to the nature and sensitivity of the information. These include account authentication, access controls and protected handling of credentials. Access should be limited to authorized people and providers with a reason to handle the information.

No online service can guarantee absolute security. Use unique credentials, protect the devices you use, review staff access and report suspected misuse promptly. If a privacy incident occurs, we will assess and respond to it and make notifications or reports required by applicable law.

12. Your choices and privacy requests

Subject to applicable law, you can ask about our handling of your information, request access and correction, withdraw consent to a use that depends on consent, or raise a concern. You may also ask about deletion or export; the availability of a particular remedy depends on the law, the information and the organization responsible for it.

Email info@driveforma.ai with the subject “Privacy request.” Describe the request and your connection to the relevant dealership or account. Do not email passwords, identity documents or an entire customer file. We may need proportionate information to verify identity and authority, and will explain applicable restrictions or lawful reasons if a request cannot be fully fulfilled.

Withdrawing consent can affect a feature that needs the information, but is not a condition for unrelated uses. For marketing messages from DriveForma, use the unsubscribe option where offered or contact us. Essential account or service notices may continue where permitted. For a dealership’s messages, contact that dealership.

We respond within the time required by applicable law. If a concern remains unresolved, you can contact the Office of the Information and Privacy Commissioner for British Columbia or, where applicable, the Office of the Privacy Commissioner of Canada.

13. Children and business use

DriveForma account services are intended for authorized adult business users, not for children. A dealership should not add information about children unless it has an appropriate, lawful business reason and authority. If you believe information about a child has been provided inappropriately, contact us so it can be assessed.

14. Changes to this policy

We will show the updated date when this policy changes and provide additional notice for a material change where appropriate or legally required. If a new purpose requires consent, publishing an updated policy alone will not replace that consent.

15. Contact and accountability