Privacy Policy

FloorStream ("FloorStream," "we," "us") provides an AI-powered engagement platform for car dealerships — web chat, voice, SMS, and social messaging that answers customer inquiries, records inquiry details, and books appointments — together with a CRM portal at app.floorstreamhq.com (the "Service"). This policy describes how we collect, use, share, and protect information when you visit floorstreamhq.com or use the Service. Questions: hello@floorstreamhq.com.

Our dealership customers ("Dealers") use the Service to communicate with their own customers and prospects ("Consumers"). For Consumer conversations and inquiry data, the Dealer is the data controller and FloorStream processes that data on the Dealer's behalf. Consumers with questions about a specific dealership's data practices should contact that dealership; we will also assist directly at the email above.

• Dealer account data — name, business name, email address, password (stored hashed), phone number, business profile details (hours, address, website domain), and settings you configure.
• Billing data — subscriptions are processed by Stripe. Stripe collects your payment card details directly; we never store full card numbers. We retain your Stripe customer identifier, subscription status, and invoice history.
• Customer inquiries and conversations — when Consumers interact with a Dealer through the Service (website chat, phone, SMS, web forms, or social messaging), we collect the content of those conversations, transcripts and call recordings where applicable, and contact details the Consumer provides (such as name, phone number, and email), plus vehicle interest and appointment details.
• Calendar data — if a Dealer connects a Google or Microsoft calendar, we store the appointment events we create and the connection tokens needed to manage them (see Section 4).
• Usage and technical data — log data such as IP address, browser type, pages viewed, and request identifiers, used for security, debugging, and abuse prevention.

• Provide, operate, and secure the Service — including generating AI responses to Consumer inquiries, recording inquiry details, and booking appointments.
• Sync appointments to the Dealer's connected calendar and send appointment confirmations and reminders.
• Bill and manage subscriptions, and send service and account notifications.
• Monitor for abuse, enforce usage limits, and comply with legal obligations.
• Improve the reliability of the Service using aggregated, de-identified usage metrics.

Conversation content is processed by large-language-model providers solely to generate responses within the Service. We do not sell personal information, and we do not use Consumer conversation data for advertising.

Dealers may optionally connect a Google account so appointments booked through the Service appear on their Google Calendar. When a Dealer grants access via Google OAuth:

• What we access: the Google Calendar events scope (create, view, update, and delete calendar events). We do not access Gmail, Drive, contacts, or any other Google data.
• How we use it: solely to create calendar events for appointments booked through FloorStream, and to update or remove those events when an appointment is rescheduled or canceled. We only manage events FloorStream created.
• Storage and protection: OAuth access and refresh tokens are stored encrypted-in-transit and access-controlled in our production database, are used only server-side, and are never exposed to other users or third parties.
• Sharing: we do not transfer, sell, or share Google user data with third parties, and no humans read it except as needed for security, compliance with law, or with the Dealer's explicit consent for support.
• Revoking access: Dealers can disconnect their calendar at any time in Settings, or via their Google account permissions. On disconnect, we delete the stored tokens.

FloorStream's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Dealers may optionally connect their Facebook Page and Instagram professional account so that FloorStream can answer the direct messages Consumers send to that dealership. When a Dealer connects through Facebook Login:

• What we access: the list of Pages the Dealer manages (so they can pick one), and, for the Page they choose, its Messenger conversations and the linked Instagram account's direct messages. We read the Consumer's name and Instagram username as shown to the business, so the Dealer knows who wrote in. We do not access the Dealer's personal profile, friends, posts, ads, or any other Page content.
• How we use it: solely to reply to Consumers who messaged that dealership, record their inquiry and appointment in the Dealer's CRM, and show the conversation to the Dealer. Replies are sent only within the messaging window Meta allows after the Consumer's last message; we never message people who did not contact the dealership.
• Storage and protection: the Page access token is stored access-controlled in our production database, used only server-side, and never exposed to other users or third parties. Message content is stored with the Dealer's other conversations.
• Sharing: we do not sell or share data received from Meta, and we do not use it for advertising or to build profiles. It is processed by the AI model provider listed in Section 6 only to generate replies.
• Disconnecting and deletion: Dealers can disconnect Facebook or Instagram at any time in Settings, or remove FloorStream from their Facebook Business Integrations; on disconnect we unsubscribe from the Page and delete the stored token. To delete conversation data received through Facebook or Instagram, see our data deletion instructions.

We share information only with service providers who process it on our behalf under contract:

• Payment processing — Stripe
• Cloud hosting and databases — Railway; site delivery — Cloudflare
• Transactional email — Resend and Google Workspace
• AI model inference — DeepInfra (conversation content, to generate responses)
• Calendar providers — Google and Microsoft, when a Dealer connects a calendar
• Telephony and messaging providers, when voice or SMS channels are enabled for a Dealer
• Meta Platforms, when a Dealer connects a Facebook Page or Instagram account (replies are delivered through Meta's APIs)

We may also disclose information if required by law, to protect rights and safety, or as part of a merger or acquisition (with notice). We never sell personal information. Mobile phone numbers and SMS opt-in and consent data are never shared with third parties for marketing or promotional purposes (see Section 7).

FloorStream is software that a dealership uses to communicate with its own customers. When a Dealer enables SMS, text messages are sent in that dealership's own name, and only to Consumers who contacted that dealership (for example, by calling, texting, submitting a web form, or chatting on its website) or who otherwise gave that dealership consent to be texted. Messages relate to the Consumer's inquiry — such as replies to questions, appointment confirmations, and appointment reminders. FloorStream does not buy, sell, or broker contact information, and we do not send messages on behalf of any business the Consumer did not contact.

• Mobile phone numbers and SMS opt-in/consent data are not shared with, sold to, or rented to third parties or affiliates for their marketing or promotional purposes.
• The only exception is service providers — such as the telecommunications carrier and messaging platform — that process this information solely to deliver messages on our behalf or on behalf of the dealership the Consumer contacted.
• Consent to receive texts from one dealership is not transferred to, or used by, any other business, including other dealerships that use FloorStream.
• You can reply STOP to any message to opt out, or HELP for help. Message and data rates may apply. See our Terms of Service for full SMS terms.

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

We retain Dealer account data for as long as the account is active, and inquiry and conversation data for as long as the Dealer's account retains it. Dealers can delete customer inquiry records (and their associated conversations and calendar events) from the CRM at any time. When an account is closed, we delete or de-identify its data within 90 days, except where retention is required by law (e.g., billing records). You may request deletion at any time by emailing hello@floorstreamhq.com.

All traffic is encrypted in transit (TLS). Access to production systems is restricted and credential-gated; passwords are stored hashed; OAuth tokens and API keys are held as protected environment secrets. No method of transmission or storage is 100% secure, but we work to protect your information against unauthorized access, alteration, and destruction.

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing. To exercise these rights, email hello@floorstreamhq.com. If you are a Consumer whose data was collected on behalf of a dealership, we may refer your request to that dealership, or assist directly.

The Service is for business use and is not directed to children under 16. We do not knowingly collect personal information from children.

We may update this policy from time to time. We will post the revised version here and update the "Last updated" date; material changes will be communicated to Dealers by email or in-app notice.