Privacy Policy

FloorStream ("FloorStream," "we," "us") provides an AI-powered engagement platform for car dealerships — web chat, voice, SMS, and social messaging that answers customer inquiries, captures leads, and books appointments — together with a CRM portal at app.floorstreamhq.com (the "Service"). This policy describes how we collect, use, share, and protect information when you visit floorstreamhq.com or use the Service. Questions: hello@floorstreamhq.com.

Our dealership customers ("Dealers") use the Service to communicate with their own customers and prospects ("Consumers"). For Consumer conversations and lead data, the Dealer is the data controller and FloorStream processes that data on the Dealer's behalf. Consumers with questions about a specific dealership's data practices should contact that dealership; we will also assist directly at the email above.

• Dealer account data — name, business name, email address, password (stored hashed), phone number, business profile details (hours, address, website domain), and settings you configure.
• Billing data — subscriptions are processed by Stripe. Stripe collects your payment card details directly; we never store full card numbers. We retain your Stripe customer identifier, subscription status, and invoice history.
• Leads and conversations — when Consumers interact with a Dealer through the Service (website chat, phone, SMS, web forms, or social messaging), we collect the content of those conversations, transcripts and call recordings where applicable, and contact details the Consumer provides (such as name, phone number, and email), plus vehicle interest and appointment details.
• Calendar data — if a Dealer connects a Google or Microsoft calendar, we store the appointment events we create and the connection tokens needed to manage them (see Section 4).
• Usage and technical data — log data such as IP address, browser type, pages viewed, and request identifiers, used for security, debugging, and abuse prevention.

• Provide, operate, and secure the Service — including generating AI responses to Consumer inquiries, capturing leads, and booking appointments.
• Sync appointments to the Dealer's connected calendar and send appointment confirmations and reminders.
• Bill and manage subscriptions, and send service and account notifications.
• Monitor for abuse, enforce usage limits, and comply with legal obligations.
• Improve the reliability of the Service using aggregated, de-identified usage metrics.

Conversation content is processed by large-language-model providers solely to generate responses within the Service. We do not sell personal information, and we do not use Consumer conversation data for advertising.

Dealers may optionally connect a Google account so appointments booked through the Service appear on their Google Calendar. When a Dealer grants access via Google OAuth:

• What we access: the Google Calendar events scope (create, view, update, and delete calendar events). We do not access Gmail, Drive, contacts, or any other Google data.
• How we use it: solely to create calendar events for appointments booked through FloorStream, and to update or remove those events when an appointment is rescheduled or canceled. We only manage events FloorStream created.
• Storage and protection: OAuth access and refresh tokens are stored encrypted-in-transit and access-controlled in our production database, are used only server-side, and are never exposed to other users or third parties.
• Sharing: we do not transfer, sell, or share Google user data with third parties, and no humans read it except as needed for security, compliance with law, or with the Dealer's explicit consent for support.
• Revoking access: Dealers can disconnect their calendar at any time in Settings, or via their Google account permissions. On disconnect, we delete the stored tokens.

FloorStream's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We share information only with service providers who process it on our behalf under contract:

• Payment processing — Stripe
• Cloud hosting and databases — Railway; site delivery — Cloudflare
• Transactional email — Resend and Google Workspace
• AI model inference — DeepInfra (conversation content, to generate responses)
• Calendar providers — Google and Microsoft, when a Dealer connects a calendar
• Telephony and messaging providers, when voice or SMS channels are enabled for a Dealer

We may also disclose information if required by law, to protect rights and safety, or as part of a merger or acquisition (with notice). We never sell personal information.

We retain Dealer account data for as long as the account is active, and lead and conversation data for as long as the Dealer's account retains it. Dealers can delete leads (and their associated conversations and calendar events) from the CRM at any time. When an account is closed, we delete or de-identify its data within 90 days, except where retention is required by law (e.g., billing records). You may request deletion at any time by emailing hello@floorstreamhq.com.

All traffic is encrypted in transit (TLS). Access to production systems is restricted and credential-gated; passwords are stored hashed; OAuth tokens and API keys are held as protected environment secrets. No method of transmission or storage is 100% secure, but we work to protect your information against unauthorized access, alteration, and destruction.

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing. To exercise these rights, email hello@floorstreamhq.com. If you are a Consumer whose data was collected on behalf of a dealership, we may refer your request to that dealership, or assist directly.

The Service is for business use and is not directed to children under 16. We do not knowingly collect personal information from children.

We may update this policy from time to time. We will post the revised version here and update the "Last updated" date; material changes will be communicated to Dealers by email or in-app notice.