Luminest LLC ("Luminest," "we," "our," or "us"), based in Indiana, United States, operates CarFlow, a vehicle reconditioning and dealer-management application for used-car dealerships. This Privacy Policy explains what information we collect, why we collect it, how we use and share it, and the rights you have over it. It covers our mobile apps, desktop app, website, and related services (the "Service").
CarFlow is a tool for businesses. In most cases your dealership decides what data goes into the Service and how it is used. For that data, your dealership is the data controller and Luminest acts as a data processor on its behalf. For account and billing data, and for the website, Luminest is the controller. By using CarFlow, you agree to this policy.
1. What We Collect
Account information
- Email address and display name
- Password (stored securely through Firebase Authentication; we never see it in plain text)
- Business name, the dealer management system your dealership uses (if you tell us), and your team role (Owner, Field Agent, Sales, or Accountant)
Vehicle and business data
- Vehicle details (VIN, year, make, model, trim, mileage, purchase price, sale price)
- Repair tasks (descriptions, status, costs, vendor assignments)
- Vendor records (names, types, contact details, addresses, spending history). Vendor addresses may be converted to map coordinates ("geocoded") to show vendor locations on the lot map.
- Financial data (repair costs, profit figures, and, on the Enterprise plan, deals, payments, and ledger entries)
- Vehicle location data: GPS positions reported by tracking hardware your dealership installs on its own vehicles (Enterprise GPS features). Your dealership is responsible for using vehicle tracking lawfully, including any notice or consent the law requires for test drives or financed vehicles.
Photos and documents
- Vehicle photos and before/after repair images
- Receipt images uploaded for cost scanning
- Title and document photos
Usage and device data
- Device type, operating system, and app version
- Analytics events (feature usage, screen views, crash reports)
- Push-notification tokens
2. How We Use Your Information
- Run the Service: manage your inventory, track repairs, coordinate your team, and generate reports.
- Process payments: handle subscription billing through our payment processor, Stripe.
- Read receipts: extract amounts from receipt images to fill in cost information.
- Decode VINs: look up vehicle details from the NHTSA public API using the VIN you enter.
- Send notifications: alert you to task assignments, status changes, and team activity.
- Improve the Service: understand how features are used and fix problems.
- Support you: answer your questions and resolve issues.
We do not sell your personal information, and we do not use it for third-party advertising.
3. AI Features and Automated Processing
Some CarFlow features use artificial intelligence, and we want you to know exactly when and how:
- The CarFlow assistant is a conversational AI. When you use it, your messages and the inventory data needed to answer them are processed by Google's Gemini models. Assistant surfaces are labeled in the app so you know you are talking to an automated system.
- Receipt scanning uses on-device text recognition and AI to read amounts and vendor names from photos you take. The photo and extracted text are used to prefill cost entries for your review.
- Vendor address geocoding sends vendor street addresses (business addresses, not personal data in most cases) to OpenStreetMap's Nominatim service to place vendor pins on the lot map.
AI output can be wrong. Every AI-produced value in CarFlow is a draft that a person on your team confirms; nothing posts to your books or listings automatically. We do not use your data to train our own AI models, and our AI providers process it under agreements that limit use to providing the service. If you prefer to avoid AI processing, do not use the assistant and enter costs manually; the rest of the Service works without it.
4. Legal Bases for Processing
If you are in the European Economic Area, the United Kingdom, or another region with similar law, we rely on these legal bases under the GDPR:
- Performance of a contract: to provide the Service you or your dealership signed up for, and to process payments.
- Legitimate interests: to secure the Service, prevent abuse, and improve our product, balanced against your rights.
- Legal obligation: to meet tax, accounting, and record-keeping requirements.
- Consent: where we ask for it, such as optional communications. You can withdraw consent at any time.
5. Data Storage and Security
Your data is stored on Google Firebase, including:
- Cloud Firestore: vehicle, task, vendor, team, business, and financial records.
- Cloud Storage: photos and document images.
- Firebase Authentication: credentials and session tokens.
All data travels over encrypted connections (TLS) and is encrypted at rest. Firebase holds SOC 1, SOC 2, and SOC 3 certifications. We apply security rules that limit access to the authorized members of your business only, and we keep audit logs of sensitive actions. No system is perfectly secure, but we take reasonable technical and organizational measures to protect your information.
6. How We Share Data
We do not sell your personal information. We share it only with the service providers that help us run CarFlow, each bound to protect it:
- Google Firebase: cloud infrastructure for storage, authentication, and analytics.
- Google AI (Gemini): assistant conversations and the data needed to answer them, when you use the AI assistant.
- Stripe: subscription payments. Stripe receives only billing-related information.
- NHTSA: the VIN you enter is sent to the National Highway Traffic Safety Administration's public lookup API.
- OpenStreetMap / Nominatim: vendor street addresses, to place vendor locations on the lot map.
We may also disclose information when the law requires it, to enforce our agreements, or to protect the rights and safety of our users and the public. If Luminest is involved in a merger or acquisition, we will give you notice before your information becomes subject to a different privacy policy.
7. International Data Transfers
Luminest is based in the United States, and our infrastructure providers store data on servers in the United States and other countries. If you access CarFlow from outside the United States, your information will be transferred to and processed there. Where we transfer personal data out of the EEA or the UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
8. Data Retention
We keep your data for as long as your account is active. When you delete your account or ask us to delete your data:
- Account data is deleted within 30 days.
- Vehicle, task, and vendor data tied to your business is deleted within 30 days.
- Photos and documents in Cloud Storage are deleted within 30 days.
- Backups are purged within 90 days.
- Analytics data is kept only in anonymized form that cannot identify you.
We may retain limited records longer where the law requires it, for example tax and accounting records, or to resolve an active dispute. See our Data Deletion page for the full breakdown.
9. Your Privacy Rights
Depending on where you live, you have some or all of these rights over your personal data:
- Access: get a copy of the data we hold about you.
- Rectification: correct inaccurate or incomplete data, in the app or by contacting us.
- Erasure: ask us to delete your account and data. See Data Deletion.
- Restriction: ask us to pause processing while a concern is resolved.
- Portability: export your vehicle and financial data as PDF or CSV from within the app.
- Objection: object to processing based on our legitimate interests.
- Withdraw consent: withdraw any consent you gave, without affecting earlier processing.
- Opt out of notifications: turn off push notifications in your device settings.
To exercise any of these rights, email support@carflow.vin. We respond within 30 days. If your data was entered by your dealership, we may direct your request to them as the controller. You also have the right to lodge a complaint with your local data-protection authority. If you are in California, you have the right to know what we collect and to ask us not to sell your personal information, which we do not do.
10. Cookies and Local Storage
The CarFlow website uses only the storage it needs to work. We do not use advertising or cross-site tracking cookies. The account portal uses local storage and a session cookie to keep you signed in. We use privacy-respecting analytics to understand general usage of our website and app. You can clear this storage in your browser settings at any time.
11. Children's Privacy
CarFlow is a business tool and is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.
12. Third-Party Services
The Service relies on these providers, each with its own privacy policy:
13. Changes to This Policy
We may update this policy from time to time. We will post the new version in the app and on this page and update the "Last updated" date. If a change is significant, we will give you clearer notice. Continued use of the Service after a change takes effect means you accept the updated policy.
Questions about this policy or your data? Reach the Luminest team: