Privacy Policy
This policy explains what lease-findr collects, why, and who it's shared with. lease-findr is operated by lease-findr. Contact: [email protected].
1. What we collect
| What | Details |
|---|---|
| Account | Your email address, your display name and a Firebase user ID. This comes from Google or from the email sign-in link. |
| Saved searches | Make, models, years, trims, ZIP code, search radius, inventory types and the lease defaults you set. |
| Your activity on listings | Favorites, tags, notes and saved lease deals you add to cars in your results. |
| Dealer messages | If you use Deals: dealer emails you forward or paste in, the notes and calls you log, dealer reps, quotes and follow-up dates. See section 2. |
| Credits and billing | Your credit balance and ledger: purchases, search charges, the starter credit, refunds and any manual adjustments. Also an identifier that links your account to your Stripe customer record. |
| Technical records | Standard server and security records, such as IP address and request time. Kept for up to 30 days. |
| Usage events | Which pages and features you use, collected by lease-findr itself (no third-party analytics): for example a page view, a saved search, a run, an offer written or a help topic opened, with the time, your account ID, and your device type (desktop or phone) and browser family. They hold no messages, notes, VINs, dealer names, ZIP codes or email addresses, and no IP address. On the public home page they aren't linked to an account. If your browser sends Do Not Track or Global Privacy Control, the app sends no page or click events from your browser; actions our server handles for you, such as signing in or saving a search, are still counted. |
| Cookies and browser storage | One essential session cookie (HttpOnly) that keeps you signed in. The Firebase sign-in library keeps its sign-in state in your browser's storage. lease-findr also saves your theme, filter presets and lease settings in your browser's local storage; they never leave your device. Cloudflare may set security cookies (such as __cf_bm) to filter bot traffic. Checkout happens on Stripe's own site, under Stripe's cookie policy. We don't use advertising or analytics cookies. |
We never see or store your card number. Stripe handles card payments.
2. Dealer messages
If you use Deals, lease-findr stores what you give it about your talks with dealers:
- Emails you forward to your lease-findr address or paste in: the sender, recipients, date, subject and message text.
- Notes and calls you log, the dealer reps you add, the quotes you save and your follow-up dates.
Before a message is stored, we strip numbers that look like Social Security numbers, card numbers, bank account numbers, ID numbers and birth dates. This works by matching patterns, so it can miss some. Please don't forward credit applications or other documents that contain this kind of information.
- Attachments: we keep only each file's name, type and size. The contents of attachments are never stored.
- Messages are deleted automatically 180 days after they arrive. Quotes you saved keep their numbers until you delete them.
- Contract check: the contract PDF or text you check is read in your browser and is not uploaded. Only the dollar amounts, rates, term and mileage from the disclosure box are sent and kept with the car, and they are deleted with your other dealer data.
- You can delete all your messages, reps and quotes at any time in Deals, on the Connect tab. Deleting your account deletes them too (section 7).
- The text of your messages, your dealer reps and their contact details are shown only to you. The app gives lease-findr staff no way to read them.
- The numbers from your quotes and contract checks (money factor, residual, monthly payment, due at signing, term and miles), with the car's make, model and trim, the month and the region, may be pooled with other users' numbers to show typical lease programs to everyone. Before pooling we remove names, email addresses, phone numbers, dealer reps and the message text.
3. How we use it
- To run your account and sign you in.
- To run your saved searches, show results, and calculate lease estimates.
- To show typical lease programs, from quote and contract check numbers pooled across users with personal details removed (section 2).
- To track and charge credits, and to process refunds.
- To send service emails: sign-in links, low-balance notices, paused-search notices and search update emails (daily or weekly, you can turn them off).
- To keep the service secure, reliable and working.
We don't sell personal data, and we don't run advertising.
4. Who we share it with
We share data only with the service providers we need to run lease-findr:
| Provider | What they handle |
|---|---|
| Google (Firebase Authentication) | Sign-in with Google or an email link. |
| Google Cloud | Hosting in the United States, and Google Cloud Storage for database backups. Backups are stored in Google Cloud Storage in Iowa, United States (us-central1), encrypted at rest by Google. |
| Cloudflare | The network in front of the service: DNS, TLS and traffic filtering. Cloudflare also receives the dealer emails you forward to your lease-findr address (Email Routing) and passes each message to our server (an Email Worker). |
| Stripe | Payments through Stripe Checkout, and the payment records that go with them. |
| Resend | Delivering the service emails listed in section 3. |
| Our vehicle-listings data provider | Vehicle listings. When you run a search, its settings (make, model, year, search area as a ZIP code and radius, states or nationwide, and inventory type) are sent to the provider to fetch listings. The provider doesn't receive your name or email from us. |
Some parts of the inventory and sign-in pages load directly from other servers. Your browser contacts them itself, so they see your IP address and which site asked, but we send them nothing about your account:
| Server | When, and what it receives |
|---|---|
| cdnjs (Cloudflare) | The map library, when the inventory page shows the map. The inventory page also opens a connection to it in advance. |
| OpenStreetMap tile servers | Map images for the area you're viewing, while the map is open. |
| Dealer and listing photo hosts | The listing's stock photo, when you open a car. Your browser doesn't tell them which page it came from. |
| Google (gstatic.com) | The Firebase sign-in library, on the sign-in page. |
| Leasehackr (leasehackr.com) | Only if you open a calculator link. The link sends the lease inputs (price, MSRP, residual, money factor, term, mileage, fees, tax rate) and a note with the car's year, trim, VIN, stock number and dealer name. Leasehackr is a separate website with its own privacy policy. It is not affiliated with lease-findr. |
5. Where data is stored
The service runs on Google Cloud in the United States, with Cloudflare in front of it. Database backups are stored in Google Cloud Storage.
6. How long we keep it
- Account, search and billing records are kept while your account is active.
- When you delete your account, we delete your personal data within 30 days. Billing records (purchases, refunds and the ledger) are kept as long as tax and accounting law requires, generally seven years, without your name or email (section 7).
- Dealer messages are deleted 180 days after they arrive (section 2).
- Vehicle listings that aren't tied to any active search are deleted after 30 days. Sold listings are deleted after 90 days.
- Usage events are kept for 30 days. After that only daily totals remain, which aren't linked to any account.
- Database backups are kept for 7 days, then overwritten.
7. Deleting your account
You can delete your account yourself: on the Account page, open Credits, then Delete account, and type your email to confirm.
- Deleted right away: your saved searches and the cars they found, your tags, notes and favorites, your dealer messages, reps, quotes and forwarding address, and your login and email address on lease-findr. Your sign-in record at our login provider (Google Firebase) is deleted within 7 days.
- Kept: your credit and payment history (purchases, search charges, refunds and adjustments), with your name and email removed. We keep it for tax records and to answer chargebacks, for as long as tax and accounting law requires.
- Also kept: a one-way hash of your email address, used only to stop the starter credit from being granted to the same email again.
- Unused credits end when you delete your account and aren't refunded, except as our refund policy says.
- Pooled quote and contract check figures already stripped of personal details (section 2) may remain after you delete your account; they can't be linked back to you.
- Copies in database backups are overwritten within 7 days.
- If one of your searches is running, wait for it to finish, then try again.
8. Your choices
- You can view and change your saved searches and notes in the app.
- To delete your account and personal data, use Delete account on the Account page (section 7), or email [email protected].
- Depending on where you live, you may have rights to access, correct, delete or move your data. To use any of them, email [email protected] from your account email. We answer within 30 days, and we don't treat you differently for asking.
9. Security
Connections to lease-findr are encrypted with HTTPS. Sign-in is handled by Firebase, and the session cookie is HttpOnly, so scripts in the page can't read it. No system is perfectly secure. If we learn of a breach that affects your data, we'll tell you as the law requires.
10. Children
lease-findr isn't meant for children. You must be 18 or older to use it. We don't knowingly collect data from anyone under 18; if we learn we have, we delete it.
11. Changes to this policy
We may update this policy. For material changes we'll tell you by email, at least 30 days before they take effect.
12. Contact
Privacy questions and requests: [email protected]