1. Scope and Role of the Parties
This Privacy Policy describes how LeasingStack and its affiliated entities ("LeasingStack," "we," "our," or "us") collect, use, disclose, and protect personal information in connection with our websites, applications, platform services, APIs, and related offerings (collectively, the "Services"). In most workflows, the auto brokerage or dealership using LeasingStack is the business or controller for applicant and customer information, and we act as a service provider or processor on its behalf.
2. Categories of Personal Information We Collect
Depending on how you interact with the Services, we may collect: identifiers (name, email, phone number, address); account and authentication data; commercial information and transaction records; professional or employment information; financial and application details submitted in intake workflows; vehicle and deal-structure data used in Desking (such as VIN, year, make, model, trim, style identifiers, ZIP code, selling price, trade details, and credit-tier assumptions entered by a broker); internet or network activity data (such as device, log, and usage data); uploaded content and documents; and support communications.
3. Sources of Information
We collect personal information directly from you, from the brokerages and dealerships that use the Services and their authorized users, from licensed third-party automotive data providers and tax-rate services that support Desking, from other service providers that support the Services, and automatically from devices and browsers through logs, cookies, and similar technologies.
4. How We Use Personal Information
We use personal information to provide and maintain the Services; authenticate users; process leasing, financing, quoting, and related workflows (including Desking program lookups and cached program responses); communicate with brokerages, customers, and applicants; secure our systems; detect fraud and abuse; monitor performance; comply with legal obligations; and enforce our agreements.
Credit-tier values entered in Desking are structuring assumptions supplied by the brokerage. They are not a consumer credit report or a credit decision by LeasingStack.
5. Disclosures of Personal Information
We may disclose personal information to: (a) service providers that support hosting, infrastructure, security, email delivery, payments, analytics, and customer support; (b) licensed third-party automotive data providers and tax-rate services, limited to the vehicle and deal inputs they need to return programs, residuals, rebates, and estimates; (c) the brokerage or dealership that controls the relevant data, the lenders and dealers that brokerage works with to process an application you submit, and credit prequalification services the brokerage chooses to use with your authorization; (d) professional advisors such as auditors, insurers, and counsel; (e) government authorities or law enforcement where legally required; and (f) parties involved in a merger, acquisition, reorganization, or asset sale.
We require service providers that handle personal information on our behalf to protect it and use it only for the services they provide to us.
6. Desking and Licensed Automotive Data
When a brokerage uses Desking or related quoting tools, we may send vehicle identifiers (such as VIN, year, make, model, trim, and style identifiers), ZIP code, vehicle status, and similar deal inputs to licensed third-party automotive data providers and tax-rate services so they can return lender programs, residuals, rebates, vehicle descriptions, and tax estimates. We do not send applicant names, Social Security numbers, or credit applications to these providers.
We may store program responses in a brokerage-scoped cache so the same lookup is not repeated while the cache is valid. A Desking lookup is not a consumer credit pull or credit decision.
7. Sensitive Personal Information
Credit applications can include sensitive personal information: Social Security numbers (SSNs), Canadian Social Insurance Numbers (SINs), driver's license numbers, dates of birth, income and employment details, housing payments, and uploaded income or identity documents.
We protect this information with extra safeguards. SSNs, SINs, and driver's license numbers receive an additional layer of AES-256-GCM field encryption on top of AES-256 encryption at rest. They are masked to the last four digits by default, and every full view and PDF export is logged. Uploaded documents are kept in private storage and shared only through expiring secure links.
We use sensitive personal information only to process the application you submitted and the related services the brokerage requested, to secure the Services, and to comply with law. We do not use it to infer characteristics about you, and we never sell it or use it for advertising.
8. AI and Automated Processing
Milo, our in-app AI assistant, only helps brokerage staff use LeasingStack. We do not send customer records, SSNs, credit applications, lender programs, or quote results to Milo or to any AI provider. Messages a staff member types to Milo are sent to our AI provider to generate a reply, so staff should not type customer personal information into Milo.
LeasingStack does not make automated credit, lending, or leasing decisions about you. Those decisions are made by the lenders and dealers the brokerage works with.
9. Cookies, Advertising, and Global Privacy Control
We and our service providers use cookies, local storage, and similar technologies to operate the Services, keep sessions secure, remember preferences, and measure usage and reliability. Disabling essential cookies may affect how the Services work.
The LeasingStack website uses an advertising tag to measure our own ads. Brokerage websites and credit applications do not load it. We honor Global Privacy Control (GPC) signals as a request to opt out of sale and sharing: when your browser sends GPC, the advertising tag does not load. You can also opt out on our privacy choices page.
Do Not Sell or Share My Personal Information
10. Data Security
We protect personal information with administrative, technical, and physical safeguards, including: HTTPS with HSTS on every connection; AES-256 encryption at rest; additional AES-256-GCM field encryption for SSNs, SINs, and driver's license numbers; masking and logged full views and exports for those fields; brokerage data isolation enforced in the database on every request; role-based access; two-factor authentication available to all staff and enforceable across a brokerage; private document storage with expiring links; rate limits on public forms; and a PCI-compliant payment processor, so card numbers never touch our servers. Our hosting providers hold SOC 2 Type 2 and ISO/IEC 27001:2022 certifications.
We maintain a written information security program designed to meet the FTC Safeguards Rule under the Gramm-Leach-Bliley Act (GLBA). It includes a designated individual responsible for the program, periodic risk assessments, oversight of the service providers that handle customer information, and multi-factor authentication for our internal staff.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Read how we protect data
11. Security Incidents and Breach Notification
If we confirm a security incident that compromises personal information we process for a brokerage, we will notify the affected brokerage without undue delay and provide the information it needs to meet its own obligations. We will also notify individuals, regulators, and other parties as required by applicable law.
12. Data Storage and Retention
Personal information is hosted and stored in the United States.
Because brokerages control their customer data, they can delete applications and documents sooner than the periods below. Unless a brokerage deletes data sooner or the law requires us to keep it longer, we keep: credit applications and uploaded documents for 25 months after the brokerage's last activity on the application; brokerage account and staff data for as long as the account is active plus 12 months; security and access logs for 12 months; and cached Desking program responses only for the short period needed to operate quoting tools before they expire or are replaced.
When a brokerage closes its account, we delete or return its customer data as described in our Data Processing Addendum.
Data Processing Addendum
13. California Privacy Rights (CCPA/CPRA)
If you are a California resident, you may have the right to request: (a) access to the categories and specific pieces of personal information we hold about you; (b) deletion of personal information, subject to exceptions; (c) correction of inaccurate personal information; (d) information about our disclosures for business purposes; and (e) to opt out of sale or sharing and to limit the use of sensitive personal information. You also have the right not to be discriminated against for exercising these rights.
14. Sale and Sharing of Personal Information
We do not sell personal information, and we never sell or share credit application data. The advertising tag on the LeasingStack website may count as sharing for cross-context behavioral advertising under California law. You can opt out at any time on our privacy choices page or by sending a GPC signal. We use sensitive personal information only for the limited purposes allowed by law and described in Section 7, so a request to limit its use is not needed.
Do Not Sell or Share My Personal Information
15. Your State Privacy Rights
Residents of states with comprehensive privacy laws, such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island, may have the right to: (a) confirm whether we process your personal information and access it; (b) correct inaccuracies; (c) delete personal information; (d) receive a portable copy of your data; (e) opt out of targeted advertising, sale, and profiling in furtherance of decisions that produce legal or similarly significant effects; and (f) give or withhold consent before we process sensitive data where the law requires consent.
We do not use personal information for profiling that produces legal or similarly significant effects. Some information, such as information covered by the Gramm-Leach-Bliley Act, may be exempt from some of these laws.
Appeals: if we decline to take action on your request, you can appeal by emailing us with the subject line "Privacy Appeal" within a reasonable time after our decision. We will respond within the time required by your state's law, usually 45 or 60 days, and explain our decision. If your appeal is denied, you may contact your state Attorney General.
16. How to Submit a Privacy Request
Email us at the address in the Contact section below with your request and the state you live in. We will verify your identity using reasonable methods before acting, and we respond within 45 days unless the law allows an extension. Authorized agents may submit requests on your behalf where the law permits.
If your request is about a specific credit application, lease, or trade-in, contact the brokerage or dealership that collected your information first, because it controls that data. When we receive a request about data a brokerage controls, we forward it to the brokerage and help it respond.
17. Children's Privacy
The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that we collected personal information from a child under 13, we will delete it.
18. Policy Updates
We may update this Privacy Policy to reflect legal, operational, or product changes. When we make material changes, we will update the effective date and provide additional notice where required by law.
