Privacy Policy
Last updated: 14 September 2026
Dealer Arsenal (“we”, “us”) provides a multi-tenant software platform for aftermarket and wholesale brands, covering dealer management, warranty administration, sales analytics and related integrations. This policy explains what we collect, why, how long we keep it, and who it is shared with.
Our customers are businesses (“brands”). A brand's own data — its dealers, orders, documents and analytics — belongs to that brand. We process it on their behalf and under their instructions.
Information we collect
Account information
Names, business email addresses, telephone numbers and role assignments for the people who use the platform, together with authentication records such as sign-in times and two-factor enrolment. We use this to operate accounts, secure them, and provide support.
Business data submitted by a brand
Dealer records, applications, agreements, pricing, warranty claims, sales and product data, and files uploaded to the platform. We store and process this to provide the service. We do not sell it, and we do not use it to build advertising profiles.
Data from connected services
Where a brand connects a third-party service — for example Shopify, NetSuite, Google Analytics, an e-signature provider or an email provider — we access that service using credentials the brand supplies or authorises, and only to the extent needed for the features they have enabled.
Technical information
Log data such as IP address, browser type, pages requested and timestamps, used for security, troubleshooting and service reliability.
Google user data
This section describes specifically how we handle data obtained through Google APIs, and applies in addition to everything above.
What we access
- Google Analytics (read-only) — with the
analytics.readonlyscope, used to list the Google Analytics properties the authorising account can access, and to read reporting data (such as active users, sessions, page views, device categories, geography and on-site search terms) for the single property that the brand selects. - Basic Google profile — the email address of the account used to authorise the connection, shown in the platform so an administrator can see which account is connected.
Why we access it
Solely to display website analytics inside the brand's own KPI dashboards alongside their sales data. There is no other purpose.
What we store
- An OAuth refresh token, held encrypted, used to obtain short-lived access tokens.
- The identifier and name of the Google Analytics property the brand selected.
- The email address of the authorising Google account.
We do not store copies of Google Analytics reporting data beyond short-lived caching required to render a dashboard.
How it is isolated
Each brand authorises its own Google account. The resulting credential can only read the Analytics properties that account already has access to, and it is used exclusively for that brand's dashboards. One brand's Google data is never visible to another.
Sharing
We do not sell Google user data, transfer it for advertising, use it for credit assessment, or allow humans to read it — except with the brand's explicit permission for support, where required by law, or in limited cases necessary for security investigations.
Limited Use
Dealer Arsenal's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Revoking access
An administrator can disconnect Google Analytics at any time from the platform's onboarding or settings screens, which deletes the stored refresh token and the selected property. Access can also be revoked directly from your Google Account permissions page. Revoking access stops all further reads immediately.
How we use information
- To provide, maintain and improve the platform and the features a brand has enabled.
- To authenticate users and protect accounts against unauthorised access.
- To provide support, and to communicate about service changes, billing and security.
- To meet legal, tax and accounting obligations.
We do not sell personal information, and we do not use customer business data to train models.
Sharing and sub-processors
We share information with service providers who help us run the platform — cloud hosting and databases, email delivery, payment processing, and the integrations a brand chooses to enable. They may process information only on our instructions and under confidentiality obligations. We also disclose information where required by law, or to protect the rights and safety of our users.
Retention
We retain business data for as long as an account is active, and afterwards only as long as needed for legal, tax or dispute-resolution purposes. Credentials for a connected service are deleted when that service is disconnected. A brand may request deletion of its data by contacting us.
Security
Each brand's data is held in a separate database. Credentials and secrets are encrypted at rest, access to production systems is restricted and logged, and traffic is encrypted in transit. No system is perfectly secure, but we take reasonable measures appropriate to the sensitivity of the information we hold.
Your rights
Depending on where you live, you may have rights to access, correct, export or delete personal information, or to object to certain processing. Where we process information on behalf of a brand, we will refer your request to that brand and support them in responding. Contact us at the address below to exercise these rights.
International transfers
The platform is hosted in the United States. If you access it from elsewhere, your information will be transferred to and processed in the United States.
Children
The platform is a business tool and is not directed to children under 16. We do not knowingly collect their information.
Changes
We may update this policy. Material changes will be notified to account administrators, and the date at the top of this page will change.
Contact
Questions about this policy or about how your information is handled: privacy@dealerarsenal.com.