1. Scope and Role of the Parties
This Privacy Policy describes how LeasingStack and its affiliated entities ("LeasingStack," "we," "our," or "us") collect, use, disclose, and protect personal information in connection with our websites, applications, platform services, APIs, and related offerings (collectively, the "Services"). In many workflows, dealership and brokerage customers using LeasingStack act as the business or controller for applicant information, while LeasingStack acts as a service provider or processor on their behalf.
2. Categories of Personal Information We Collect
Depending on your interaction with the Services, we may collect: identifiers (name, email, phone number, address); account and authentication data; commercial information and transaction records; professional or employment information; financial or application-related details submitted in intake workflows; vehicle and deal-structure data used in Deal Desk (such as VIN, year, make, model, trim, style identifiers, ZIP code, selling price, trade details, and credit-tier assumptions entered by a broker); internet or network activity data (such as device, log, and usage data); uploaded content and documents; and support communications. We may also collect inferences derived from these categories to improve fraud prevention, security, and service quality.
3. Sources of Information
We collect personal information directly from individuals, from our customer organizations and their authorized users, from integrations and licensed data providers supporting Deal Desk and related tools (including automotive program, incentive, vehicle-description, inventory, and tax-rate services), from other service providers supporting our Services, and automatically from devices and browsers through logs, cookies, and similar technologies.
4. Business and Commercial Purposes for Use
We use personal information to provide and maintain the Services; authenticate users; process leasing, financing, quoting, and related operational workflows (including Deal Desk program lookups and cached program responses); communicate with customers and applicants; secure systems; detect fraud and abuse; monitor performance; perform analytics; comply with legal obligations; and enforce agreements. We may also use data for internal research and product improvement in a manner consistent with applicable law and contractual obligations. Credit-tier values entered in Deal Desk are structuring assumptions supplied by the brokerage customer. They are not a consumer credit report or a credit decision by LeasingStack unless a separate credit product is enabled and described to you.
5. Disclosures of Personal Information
We may disclose personal information to: (a) service providers and contractors that support hosting, infrastructure, security, communications, analytics, payments, customer support, and Deal Desk operations; (b) licensed automotive data, tax-rate, VIN/vehicle-description, and inventory providers needed to return programs, residuals, rebates, and estimates; (c) customer organizations that control the relevant workflow data; (d) professional advisors such as auditors, insurers, and counsel; (e) government authorities, regulators, or law enforcement where legally required; and (f) parties involved in a merger, acquisition, reorganization, or asset sale. We require recipients handling personal information on our behalf to use appropriate safeguards and process data only for authorized purposes.
6. Deal Desk and Licensed Automotive Data
When a brokerage uses Deal Desk or related quoting tools, we may transmit vehicle identifiers (such as VIN, year, make, model, trim, and style identifiers), ZIP code, vehicle status, and similar deal-structure inputs to licensed third-party automotive data providers and tax-rate services so those providers can return lender programs, residuals, rebates, vehicle descriptions, and tax estimates. We may store program responses in an organization-scoped cache so the same lookup is not repeated while the cache is valid. Those providers process data under their own terms. We do not sell this information. We do not treat a Deal Desk lookup as a consumer credit pull or credit decision unless a separate credit product is enabled and described to you.
7. Cookies and Similar Technologies
We and our service providers use cookies, local storage, and similar technologies to operate the Services, maintain session integrity, remember preferences, analyze usage, and improve reliability. Browser settings may permit limiting certain cookie behaviors; however, disabling technical cookies may affect functionality.
8. Data Retention
We retain personal information for as long as reasonably necessary to fulfill the purposes described in this Policy, provide the Services, satisfy contractual commitments, resolve disputes, enforce our agreements, and comply with legal, accounting, tax, and regulatory requirements. Retention periods vary by data type, sensitivity, and legal obligations. Cached Deal Desk program responses are retained for a limited period needed to operate the quoting tools and then expire or are replaced.
9. Security
LeasingStack maintains administrative, technical, and organizational measures designed to protect personal information against unauthorized access, loss, misuse, or alteration. These measures include access controls, monitoring, and security hardening practices. No method of transmission or storage is fully secure, and we cannot guarantee absolute security.
10. Cross-Border Processing
Where permitted by law, personal information may be processed in jurisdictions other than where it was collected, including the United States. When cross-border transfers occur, we use legally recognized mechanisms and contractual controls where required.
11. California Privacy Rights (CCPA/CPRA)
If you are a California resident, you may have rights to request: (a) access to categories and specific pieces of personal information; (b) deletion of personal information, subject to exceptions; (c) correction of inaccurate personal information; and (d) information about disclosures for business purposes. You also have the right to non-discrimination for exercising your rights. We will verify requests using commercially reasonable methods and may require additional information to confirm identity and authority.
12. Sale/Sharing and Sensitive Personal Information (California)
LeasingStack does not sell personal information for monetary consideration. We also do not share personal information for cross-context behavioral advertising as those terms are defined under California law. We use and disclose sensitive personal information only for limited business purposes reasonably necessary to provide and secure the Services, perform requested services, comply with legal obligations, and prevent fraud or illegal activity.
13. Exercising Privacy Rights
To submit a privacy request, contact us using the information in the Contact section below. For requests tied to a specific financing, leasing, or intake submission, contact the brokerage or dealership that collected your information first, as they are often the primary business/controller for that dataset. Authorized agents may submit requests on behalf of California residents where permitted by law.
14. Children's Privacy
The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13 through consumer-facing portions of the Services. If we learn that personal information from a child under 13 was collected without appropriate authorization, we will take reasonable steps to delete it.
15. Policy Updates
We may update this Privacy Policy periodically to reflect legal, operational, or product changes. When we make material changes, we will update the effective date and provide additional notice where required by law.
