GetDotFlow LLC ("GetDotFlow," "we," "us," or "our") respects privacy and is committed to handling personal information responsibly. This Privacy Policy explains how GetDotFlow collects, uses, discloses, retains, and otherwise processes personal information in connection with the GetDotFlow website, software platform, electronic inspection workflows, client portal, reports, reminders, subscriptions, support, and related services (collectively, the "Service"). It also explains certain privacy rights and choices that may be available under applicable law. Read it together with our Terms of Service.
This Privacy Policy applies to personal information that GetDotFlow processes in connection with: visitors to our website; prospective customers, including people who submit a demo request; Tenants and their Authorized Users; account administrators; repair shops, fleets, motor carriers, inspectors, and other business users; individuals who contact us for support or other inquiries; recipients of reports, reminders, portal links, or other communications sent through the Service; and other individuals whose information we process in connection with operating the Service.
GetDotFlow is a business-to-business software provider. Tenants may use the Service to enter, upload, manage, generate, store, or share information concerning their Clients, vehicles, personnel, inspectors, drivers, customers, or other individuals. When GetDotFlow processes personal information contained in Tenant Content solely to provide the Service on a Tenant's behalf, the Tenant generally determines why the information is collected and how it is used. In those circumstances GetDotFlow generally acts as a service provider, contractor, processor, or similar role under applicable privacy law, while the Tenant may act as the business, controller, or other responsible entity.
If your personal information was submitted to GetDotFlow by a repair shop, fleet, motor carrier, inspection business, employer, or another Tenant, requests concerning that information may need to be directed to that Tenant. Nothing in this section changes the allocation of responsibilities established by applicable law.
The information we collect depends on how you interact with GetDotFlow and how a Tenant configures and uses the Service.
We may collect first and last name; business name; business contact information; email address; telephone number; mailing or business address; account username or identifiers; role, title, or permissions; and login and authentication information. Passwords are stored only as one-way cryptographic hashes; we cannot read them. If you start a free trial on our website, we collect your company name, your name, your email address and, if you provide it, your phone number to create the Account. If you ask to reset a password, we email a one-time link to the address on the Account.
We may collect information about your company or organization, account plan, subscription status, billing status, transaction history, subscription dates and any evaluation-access dates, cancellation status, and related account and administrative information.
Subscriptions are purchased through Stripe-hosted checkout pages and managed through the Stripe customer portal. Stripe may collect payment-card information, billing name and address, bank or payment account information, transaction information, device and fraud-prevention information, and other information necessary to process or authenticate a payment. Card details are entered directly with Stripe and are not transmitted to or stored on GetDotFlow servers. We may receive limited payment-related information such as payment status, transaction identifier, card brand, the last digits of a payment method, billing contact information, and subscription status. Stripe processes information under its own privacy notices and contractual obligations.
Tenants may submit information in connection with vehicle inspections, maintenance, compliance workflows, customer management, and related business activities. Depending on how a Tenant uses the Service, this may include: Client or company names; contact names; email addresses; telephone numbers; addresses; vehicle identification numbers (VINs); unit or fleet numbers; license plate information; vehicle make, type, or other characteristics; odometer or mileage information; inspection dates; inspection results, findings, defects, or deficiencies; repair or maintenance notes; inspector name and qualification attestations; notes; uploaded files or documents (for example, registration or insurance documents a Tenant chooses to store); photographs, if supported and submitted; PDF reports; expiration dates; reminder information, including whether a reminder was sent and why a Tenant chose not to inspect a vehicle (for example, inspected elsewhere or no longer a client); invoices, including amounts, numbers, and payment status; portal-related information; and other information selected or entered by the Tenant.
The information collected through an inspection workflow is substantially determined by the Tenant. GetDotFlow does not independently determine whether particular inspection information is required by FMCSA, DOT, state law, or another regulatory regime merely because the Service permits it to be entered.
The Service may allow a Tenant to give Clients or other recipients access to inspection reports, documents, vehicle information, or other records through a client portal, email, or shared link. Depending on configuration, a person who has a valid link may be able to view the associated information without signing in. When someone uses such functionality, we may process the information the Tenant made available, portal or link identifiers, IP address, browser and device information, date and time of access, and related technical or security information.
The Tenant controls which Client or recipient receives a report or link and what Tenant Content is made available. Recipients should contact the applicable Tenant about the underlying inspection, vehicle, customer, or other Tenant-controlled information.
When you request a demo through our website, we collect your name, company name, business email, and, if you choose to provide them, your phone number, number of trucks or inspections per month, and message, together with your IP address. We use this information to respond to your request, send you an automatic acknowledgment, follow up about GetDotFlow, and prevent spam and abuse.
When you contact us for support or other inquiries, we may collect your name, email address, telephone number, company and Account information, the contents of your request, attachments or screenshots you voluntarily provide, and support history. We may retain communications as reasonably necessary for support, security, recordkeeping, dispute resolution, or other legitimate business purposes.
When you access the website or Service, we and our service providers may automatically collect technical information such as IP address; browser type and version; operating system; device type; language settings; referring pages; date and time of access; pages or screens viewed; session information; approximate location derived from IP address; diagnostic and error information; authentication activity; and security events. Currently this consists mainly of web-server and security logs, login-attempt records, an in-application activity log of actions taken in an Account, a record of application errors (the page, the error, the time, and the Account and User involved) used to find and fix problems, and problem reports that Users choose to send us. We use this information to operate, secure, troubleshoot, and improve the Service.
GetDotFlow and service providers acting on our behalf may use cookies and similar technologies, such as session cookies and browser local storage, for the following purposes:
Google Ads conversion measurement. To understand which of our ads work, our public website and the sign-up page may load the Google Ads tag (gtag.js) provided by Google LLC. It sets or reads advertising cookies and sends Google technical information such as the page address, a cookie identifier, your IP address and browser information, and the fact that a demo request or sign-up was completed. We do not send Google your name, email address, phone number, or any Tenant Content, we do not load the tag inside the app after you sign in, and we do not use Google remarketing or build Google advertising audiences from our visitors. Apart from the Meta Pixel described below, we do not use analytics cookies, session-replay tools, or other tracking pixels. You can opt out at any time as described in Your Privacy Choices; if your browser sends a Global Privacy Control signal, the tag is not loaded at all.
Meta Pixel (Facebook and Instagram ads). Our public website and the sign-up page may also load the Meta Pixel provided by Meta Platforms, Inc. It sets or reads cookies (such as _fbp) and sends Meta technical information such as the page address, a cookie identifier, your IP address and browser information, and the fact that you viewed a page, sent a demo request, or completed a free-trial sign-up. Meta may connect this information with a Facebook or Instagram account you are signed in to, and uses it to report how our ads perform, to improve their delivery, and to let us show our ads on Facebook and Instagram to people who visited our pages (custom audiences). We do not use Meta's advanced matching, so we do not send Meta your name, email address, phone number, or any Tenant Content, and we do not load the pixel inside the app after you sign in. Meta's own use of this information is described in the Meta Privacy Policy. The same opt-out applies: the button in Your Privacy Choices or a Global Privacy Control signal stops the pixel from loading on our pages.
The cookies and storage items in use are listed in Part C. If we add other analytics or advertising technologies, we will update this Policy and Part C first and provide any notices and opt-out mechanisms required by law. You may control cookies through your browser settings; disabling necessary cookies may prevent parts of the Service from working.
Depending on the context, we may use personal information to: provide, operate, maintain, and administer the Service; create and manage Accounts; authenticate Users; provide electronic inspection and record-management functionality; generate reports and PDFs requested by Tenants; operate client portal and shared-link functionality; send Tenant-directed reports, links, and reminders; manage subscriptions and billing; process or facilitate payments; provide customer support; communicate about Accounts or the Service; respond to inquiries and demo requests; diagnose errors and technical problems; maintain service reliability; protect Accounts and information; detect, investigate, and prevent fraud, abuse, or unauthorized access; maintain activity and security records; enforce our Terms of Service; comply with legal obligations and lawful requests; establish, exercise, or defend legal claims; understand usage and improve the Service; perform internal business operations; and carry out other purposes disclosed at collection or otherwise permitted by law.
When processing Tenant Content on behalf of a Tenant, we use it to provide and support the Service as directed by or for that Tenant and as permitted by our agreements and applicable law.
Tenants may use GetDotFlow to send inspection reminders (for example, before an inspection expires), reports, portal links, or other communications to their Clients or other recipients. GetDotFlow processes recipient contact and communication information to transmit these Tenant-directed messages, which may be sent through GetDotFlow's email service or through email or SMTP settings the Tenant configures. The Tenant is responsible for determining that it has the legal authority to provide recipient information and initiate the communication. Operational communications may be treated differently from marketing communications under applicable law. GetDotFlow may separately send its own Account, billing, security, administrative, or legally required communications to its Users and customers.
We provide personal information to companies that perform services for GetDotFlow. Currently these are: Hostinger (server hosting, database and file storage, backups, and GetDotFlow email delivery), Cloudflare (network delivery, DNS, and security), Stripe (payments and subscriptions), Google (Google Ads conversion measurement on our public website and sign-up page, as described in Section 7), and Meta Platforms (the Meta Pixel on the same pages, as described in Section 7). Our public pages also load fonts from Google Fonts and icons from jsDelivr, which receive visitors' IP addresses to deliver those files. The current list is maintained in Part D. If we add providers in other categories, such as analytics, we will update Part D. Providers may process information only as permitted by their agreements with us and applicable law.
When you purchase a Subscription, payment information is provided directly to Stripe. Stripe processes it under its own legal obligations, agreements, and privacy documentation. GetDotFlow may receive information necessary to manage the resulting Subscription, transaction, billing status, refund, chargeback, or Account.
Checkout may use Stripe Managed Payments. In that case Stripe (including its Link service) may act as the reseller of record for your purchase and may itself handle sales-tax calculation and collection, fraud screening, receipts, and payment support, using the information you provide at checkout under Stripe's own privacy documentation. GetDotFlow receives the information needed to run your Subscription, such as your name, business name, email, billing address, phone number, plan (Starter or Pro), number of vehicle document packs, and payment status.
We disclose or transmit Tenant Content when instructed through the Service by a Tenant or its Authorized Users — for example, when a Tenant sends an inspection report, sends a reminder, generates or shares a portal link, or provides access to a report or document.
We may disclose information when we reasonably believe it is necessary to comply with applicable law; respond to lawful process, a valid subpoena, court order, warrant, or governmental request; protect the rights or property of GetDotFlow; enforce our agreements; investigate fraud or security incidents; protect the safety of users or others; or establish, exercise, or defend legal claims. Where appropriate and legally permitted, we may seek to limit or object to requests we believe are invalid or excessive.
Personal information may be disclosed or transferred in connection with an actual or proposed merger, acquisition, financing, reorganization, sale of assets, change of control, bankruptcy, or similar transaction. Any recipient will remain subject to applicable legal obligations regarding personal information.
We may disclose information where reasonably necessary to attorneys, accountants, auditors, insurers, consultants, and other professional advisers subject to appropriate confidentiality obligations.
GetDotFlow is primarily a B2B software service. GetDotFlow does not sell personal information for money, and we do not sell or share Tenant Content. We do not use remarketing, build advertising audiences, or upload customer lists to advertising platforms.
As described in Section 7, our public website and sign-up page use Google Ads conversion measurement and the Meta Pixel, which allow Google and Meta to receive cookie identifiers and browsing information about visits to those pages; we also use the Meta Pixel to show our ads on Facebook and Instagram to people who visited those pages. Under the broad definitions of certain U.S. state privacy laws, this kind of advertising measurement may be considered "sharing" for cross-context behavioral advertising or "targeted advertising" even though no money changes hands. You can opt out at any time as described in Section 21 and Your Privacy Choices, and we treat a Global Privacy Control signal as a valid opt-out: when your browser sends it, neither the Google Ads tag nor the Meta Pixel is loaded.
Depending on Tenant use, Tenant Content could contain information that a particular privacy law classifies as sensitive. For example, uploaded documents such as driver medical certificates or identification documents may contain sensitive details. Tenants should not submit sensitive personal information unless it is reasonably necessary for a supported business purpose, the Tenant has authority to process it, its submission is consistent with applicable law, and GetDotFlow supports the intended use.
GetDotFlow does not use sensitive personal information for purposes that would require a right to limit under applicable law. GetDotFlow does not require Social Security numbers, medical records, biometric identifiers, precise geolocation, or similar highly sensitive information to create a standard Account. Please do not upload Social Security numbers, payment-card numbers, bank credentials, or passwords.
We retain personal information for as long as reasonably necessary for the purposes described in this Policy, including to provide the Service, maintain an active Account, fulfill Tenant instructions, preserve security and integrity, comply with legal and regulatory obligations, maintain financial and transaction records, resolve disputes, enforce agreements, and establish, exercise, or defend legal claims. Retention periods vary depending on the type of information, why it was collected, Account status, Tenant instructions, legal and recordkeeping requirements, security needs, and applicable limitation periods.
When personal information is no longer reasonably necessary, we may delete, de-identify, or otherwise dispose of it consistent with applicable law. Information may remain for a limited period in backups, security records, or other systems where immediate deletion is not technically practicable. Backup copies are kept on a rolling schedule and are overwritten in the ordinary course.
GetDotFlow does not determine how long a Tenant must retain inspection or regulatory records. Tenants remain responsible for their own federal, state, contractual, insurance, and other record-retention requirements. Closing or cancelling an Account does not relieve a Tenant of those obligations. Tenants should export records they must preserve before Account access ends.
GetDotFlow uses reasonable administrative, technical, and organizational measures designed to protect personal information against unauthorized access, acquisition, destruction, loss, alteration, or disclosure. These currently include encrypted HTTPS connections, one-way password hashing, per-Account data separation and access controls, login-attempt limiting, activity logging, and regular automated backups.
No internet transmission, storage system, software platform, or security measure is completely secure, and we cannot guarantee absolute security. Users are responsible for protecting their credentials, maintaining appropriate security over their devices, and promptly notifying us of suspected unauthorized access. If a security incident involving personal information requires notification under applicable law, we will provide notifications as that law requires.
We seek to collect and retain personal information reasonably appropriate to the operation, security, support, and legitimate improvement of the Service. Tenants should likewise avoid uploading personal information that is unnecessary for their use of GetDotFlow. The fact that a free-text field or document-upload feature technically permits particular information to be entered does not mean GetDotFlow requires or recommends that information.
We may create or use aggregated, statistical, or de-identified information for purposes such as security, service reliability, capacity planning, product improvement, and understanding Service usage. Where information is maintained as de-identified under applicable law, we will not attempt to reidentify it except as permitted by law, including to test whether our de-identification processes are effective.
GetDotFlow is a business software service and is not directed to children. The Service is not intended for use by children under 13, and we do not knowingly collect personal information directly from children under 13. If you believe a child has provided personal information to GetDotFlow, contact us at [email protected]. Tenants are responsible for ensuring that information they submit about other individuals is collected and processed lawfully.
Residents of certain U.S. states may have rights under applicable comprehensive state privacy laws. Depending on your state, our relationship with you, applicable exemptions, and whether the relevant law applies to GetDotFlow, these rights may include the right to: confirm whether we process your personal information; access it; obtain certain information about our processing; obtain a portable copy; correct inaccurate information; delete certain information; opt out of sale, sharing, or targeted advertising; opt out of certain profiling or automated decision-making; limit certain uses of sensitive personal information; obtain information about categories of third parties receiving personal information; and appeal a denial of a privacy request. You also have the right not to receive unlawful discriminatory treatment for exercising a privacy right. These rights are not absolute, and applicable law may permit us to retain or continue processing information for certain purposes.
This section supplements this Policy for California residents to the extent the California Consumer Privacy Act, as amended ("CCPA"), applies to the relevant processing.
Depending on the interaction, we may collect: Identifiers (name, email, phone, business address, IP address, Account identifiers); Customer records information (contact, business, subscription, and billing information); Commercial information (subscription, transaction, and Service-use information); Internet or other electronic network activity (browser, device, usage, session, authentication, and log information); Geolocation (approximate location derived from IP address); Professional information (company, business role, inspector role); Sensitive personal information (potentially, where submitted by a Tenant); and Inferences (limited inferences for security or fraud prevention). The Service may also process Tenant Content that does not fit neatly into these categories.
Directly from you; from the Tenant or organization you are associated with; from Authorized Users; from Clients or others using Service functionality; automatically through use of the website or Service; from our payment processor; from service providers; and from other sources where permitted by law.
The purposes described in Section 8, including providing the Service, account administration, billing, security, support, communications, legal compliance, and service improvement.
Hosting and infrastructure providers; our payment processor; email and communications providers; network security providers; advertising providers (Google and Meta, for ad measurement on our public pages and, for Meta, showing our ads to people who visited them); professional advisers; governmental or legal authorities where required; parties to a corporate transaction; and Clients or other recipients at a Tenant's direction.
Subject to applicable law, California residents may have rights to know and access, correct, delete, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive non-discriminatory treatment for exercising CCPA rights. As stated in Section 11, we do not currently sell or share personal information.
California residents may have rights under California Civil Code § 1798.83 regarding certain disclosures of personal information to third parties for their own direct marketing, where that statute applies. We do not disclose personal information to third parties for their own direct marketing. Requests may be sent to [email protected].
To submit a privacy request, email [email protected] with the subject line "Privacy Request." Include enough information for us to understand the request and identify the relevant relationship or Account. Do not send Social Security numbers, complete payment-card numbers, passwords, or other unnecessary sensitive information with a request.
We may need to verify your identity before completing certain requests. Verification depends on the nature of the request and the sensitivity of the information. If we cannot reasonably verify a request, we may be unable to fulfill it.
Where applicable law permits an authorized agent, we may request evidence of the agent's authority and take legally permitted steps to verify the request.
If we hold your information solely on behalf of a Tenant, we may direct your request to that Tenant or tell you that the Tenant is the appropriate party. Where required by law or contract, we will reasonably assist the Tenant in responding.
If applicable state law provides a right to appeal our decision, email [email protected] with the subject line "Privacy Request Appeal." We will process qualifying appeals as required by law.
We do not sell personal information for money. To opt out of the Google Ads conversion measurement and the Meta Pixel described in Section 7 (and any "sharing" or "targeted advertising" it may involve under applicable law), you can: (a) use the button in Your Privacy Choices, which stores an opt-out cookie for getdotflow.com and panel.getdotflow.com in that browser; (b) turn on Global Privacy Control in your browser, which we honor automatically; (c) manage ad personalization in your Google account at adssettings.google.com and in your Facebook or Instagram account at Meta ad preferences; or (d) email us at [email protected]. We will not discriminate against you for opting out. A browser's legacy "Do Not Track" setting is distinct from legally recognized universal opt-out signals; unless applicable law requires otherwise, we do not treat a Do Not Track signal by itself as a universal request.
The Service may link to or integrate with third-party websites, products, or services, such as Stripe's checkout and billing portal. This Policy does not govern the independent privacy practices of third parties when they process information for their own purposes. We encourage you to review their privacy notices.
GetDotFlow is operated from the United States and intended for U.S. customers. If you access the Service from outside the United States, your information may be processed in the United States and in other countries where GetDotFlow or its service providers operate, where data-protection laws may differ. If GetDotFlow becomes subject to specific international data-transfer requirements, additional contractual or legal mechanisms may apply.
We may update this Policy to reflect changes in the Service, our data practices, technology, legal requirements, or business operations. When we do, we will revise the "Last Updated" date. If a change materially affects how we process personal information, we will provide additional notice where required by law, and where the law requires consent before a materially different use of previously collected information, we will seek that consent rather than rely solely on posting an updated Policy.
This Policy explains GetDotFlow's privacy practices; the Terms of Service govern contractual access to and use of the Service. Capitalized terms not defined here may have the meanings given in the Terms of Service. The Data Processing Addendum in Part E applies to Tenant Personal Data as described there. A separately signed data-processing or privacy agreement between GetDotFlow and a Tenant may provide additional or more specific obligations.
Questions, concerns, complaints, or privacy requests may be directed to:
GetDotFlow LLC
New Jersey, United States
Email: [email protected]
For a privacy-rights request, use the subject line "Privacy Request." If GetDotFlow designates an additional privacy contact, mailing address, or request portal, this Policy will be updated accordingly.
This notice summarizes the categories of personal information we collect directly from you, the purposes, and how long we keep it. We do not sell personal information for money, and we do not use sensitive personal information to infer characteristics about you. Visits to our public website and sign-up page may be measured with Google Ads conversion measurement and the Meta Pixel (Section 7), which some state laws may treat as "sharing" or "targeted advertising"; you can opt out as described in Your Privacy Choices.
| Who | Categories collected | Purposes | Retention |
|---|---|---|---|
| Website visitors | IP address, browser/device and request data; on our public website and sign-up page, advertising cookie identifiers and page information (Google Ads conversion measurement and the Meta Pixel, unless you opt out) | Deliver and secure the website; measure which of our ads lead to demo requests and sign-ups; show our Facebook and Instagram ads to people who visited our pages | As needed for security and operations; Google's advertising cookies up to 13 months; Meta's _fbp cookie up to 90 days |
| Demo / contact requests | Name, company, business email, phone, fleet size, message, IP address | Respond to your request, send an acknowledgment, follow up, prevent spam | As needed to respond and follow up; deleted on request |
| Account holders and users | Name, username, email, phone, company, role, password hash, login and activity logs | Provide the Service, authenticate, secure Accounts, support, administrative notices | While the Account is active, then per Section 13 of Part A |
| Subscribers | Billing contact, plan, number of vehicle packs, billing interval, payment status and history (card data held by Stripe) | Process subscriptions, billing, tax and accounting | As required for legal and accounting purposes |
Information that Tenants enter about their own customers is collected by the Tenant, not by GetDotFlow directly; the Tenant is responsible for providing any notice required at the point that Tenant collects it. Full details are in Part A.
We use a small number of cookies and browser-storage items that are necessary for the Service to work, and, on our public website and sign-up page only, Google Ads conversion measurement and the Meta Pixel. We do not use analytics cookies, session-replay tools, Google remarketing, or other tracking pixels, and no advertising cookies are used inside the app after you sign in.
| Name / type | Set by | Purpose | Duration |
|---|---|---|---|
| PHPSESSID (cookie) | GetDotFlow application | Keeps you signed in and protects forms from request forgery. Marked Secure and HttpOnly. | Session / until sign-out or expiry |
| __cf_bm and similar (cookie) | Cloudflare | Security and bot protection for traffic to our sites, where applied by Cloudflare | Short-lived (typically up to 30 minutes) |
| _gcl_au, _gcl_aw and similar (cookies); Google cookies such as IDE or test_cookie | Google LLC (Google Ads tag), on getdotflow.com and the sign-up page only | Measure whether a visit from a Google ad led to a demo request or a free-trial sign-up. Not set if you opted out or your browser sends Global Privacy Control. | Google's _gcl cookies up to 90 days; other Google advertising cookies up to 13 months |
| _fbp (cookie); Meta cookies such as fr | Meta Platforms, Inc. (Meta Pixel), on getdotflow.com and the sign-up page only | Measure whether a visit from a Facebook or Instagram ad led to a demo request or a free-trial sign-up, and let us show our ads to people who visited our pages. Not set if you opted out or your browser sends Global Privacy Control. | _fbp up to 90 days; Meta's fr cookie up to 90 days |
| gdf_ads_optout (cookie) | GetDotFlow | Remembers that you opted out of advertising measurement, so the Google Ads tag and the Meta Pixel are not loaded | 2 years, or until you clear it |
| Interface preferences (browser local storage) | GetDotFlow application | Remembers interface choices such as whether you viewed release notes, completed the product tour, or saw a notification, whether the menu is shown full or compact, and which reminders you already sent from this browser | Until cleared from your browser |
Third-party resources. Our pages load fonts from Google Fonts and icons from jsDelivr. When your browser requests these files, those providers receive your IP address and standard request information as needed to deliver the files. We do not use these providers to track you.
Analytics. We do not use Google Analytics or another web-analytics service. If we start, we will update this Part C and Part D first.
Privacy signals. If your browser sends a Global Privacy Control (GPC) signal, the Google Ads tag and the Meta Pixel are not loaded on our pages. A legacy browser "Do Not Track" setting is distinct from GPC.
Your Privacy Choices
Advertising measurement in this browser: checking…
You can block or delete cookies through your browser settings. Blocking strictly necessary cookies will prevent sign-in and other features from working.
GetDotFlow uses the following providers to host, secure, and operate the Service. Subprocessors may process Tenant Personal Data on our behalf under written obligations.
| Provider | Purpose | Data involved |
|---|---|---|
| Hostinger | Virtual private server hosting: application, database, uploaded files, backups; business email and SMTP delivery for GetDotFlow-sent messages | All Service data, including Tenant Content, uploaded documents, and email content |
| Cloudflare, Inc. | Content delivery, DNS, TLS, and security/DDoS protection for traffic to our sites | IP addresses, request data, and content in transit |
| Google LLC | Google Ads conversion measurement on our public website and sign-up page (not inside the app) | Cookie identifiers, IP address, browser and page information of website visitors; no Tenant Content |
| Meta Platforms, Inc. | Meta Pixel on our public website and sign-up page (not inside the app): Facebook and Instagram ad measurement and ad audiences of past visitors | Cookie identifiers, IP address, browser and page information of website visitors; no names, emails, phone numbers, or Tenant Content |
| Stripe, Inc. | Payment processing, subscriptions, billing portal, and (with Managed Payments) reseller of record and sales-tax handling | Billing contact information, payment details, transaction history |
Tenant-selected email providers. Where a Tenant configures its own email or SMTP account (for example, a Gmail, Outlook, or company mailbox), messages the Tenant sends through the Service are transmitted through that provider, which the Tenant selects and contracts with directly; such providers are not GetDotFlow subprocessors.
Other third-party resources. Google Fonts (Google LLC) and jsDelivr deliver fonts and icons and receive visitors' IP addresses as described in Part C; they do not receive Tenant Content.
Updates. We will update this list before a new subprocessor begins processing Tenant Personal Data. Tenants who wish to receive notice of changes may request it at [email protected].
This Data Processing Addendum ("DPA") forms part of the agreement between GetDotFlow LLC, a New Jersey limited liability company ("GetDotFlow"), and the customer, subscriber, business, organization, or other entity using the Service ("Tenant"). It applies where GetDotFlow processes Personal Data on behalf of Tenant in connection with the Service and applicable Data Protection Law requires, or the parties otherwise agree, that such processing be governed by a data-processing agreement.
"Agreement" means the GetDotFlow Terms of Service, any applicable order form, master services agreement, or other written agreement governing Tenant's use of the Service. "Data Protection Law" means U.S. federal or state privacy or data-protection law applicable to the Processing of Tenant Personal Data under the Agreement. "Personal Data" means information relating or reasonably linkable to an identified or identifiable individual that is protected as personal information or personal data under applicable Data Protection Law. "Tenant Personal Data" means Personal Data in Tenant Content that GetDotFlow Processes on behalf of Tenant to provide the Service. "Process" or "Processing" means any operation performed on Personal Data, including collecting, accessing, using, storing, transmitting, disclosing, modifying, retrieving, or deleting it. "Security Incident" means unauthorized acquisition of, access to, use of, alteration of, or disclosure of Tenant Personal Data for which notification or other action is required under applicable Data Protection Law; unsuccessful attempts that do not result in unauthorized access, such as failed logins, scans, pings, or denial-of-service attempts, are not Security Incidents solely by occurring. "Subprocessor" means a third party engaged by GetDotFlow to Process Tenant Personal Data on Tenant's behalf. Other capitalized terms have the meanings given in the Agreement.
Tenant determines the purposes and means of Processing Tenant Personal Data to the extent Tenant acts as a controller, business, or equivalent regulated entity. GetDotFlow Processes Tenant Personal Data on Tenant's behalf as a processor, service provider, contractor, or equivalent role to the extent provided by applicable Data Protection Law. The legal characterization of each party will ultimately be determined by applicable law and the particular Processing activity. Nothing in this DPA makes GetDotFlow a controller or business with respect to Tenant Personal Data solely because it provides the Service.
GetDotFlow will Process Tenant Personal Data (a) to provide, maintain, secure, support, and improve the Service as permitted by the Agreement; (b) through Tenant's and its Authorized Users' use and configuration of the Service; (c) according to Tenant's documented instructions consistent with the Agreement; (d) to prevent fraud, abuse, or security incidents; (e) as otherwise permitted for processors, service providers, or contractors under applicable Data Protection Law; and (f) as required by law. If the law requires Processing contrary to Tenant's instructions, GetDotFlow will inform Tenant where legally permitted. GetDotFlow is not required to follow an instruction it reasonably believes violates applicable law.
To the extent required by applicable Data Protection Law, GetDotFlow will not (a) sell Tenant Personal Data; (b) retain, use, or disclose it outside the direct business relationship with Tenant except as permitted by law and the Agreement; (c) retain, use, or disclose it for purposes other than providing the Service and other purposes permitted by law; (d) combine it with Personal Data obtained from unrelated third parties or from GetDotFlow's own direct consumer interactions where the law prohibits such combination; or (e) use it for targeted or cross-context behavioral advertising where doing so would be inconsistent with GetDotFlow's obligations as Tenant's processor. Nothing in this section prohibits Processing expressly permitted to a processor, service provider, or contractor by applicable law.
GetDotFlow will take reasonable measures designed to ensure that persons authorized to Process Tenant Personal Data are subject to appropriate confidentiality obligations, and will limit access to personnel and service providers with a legitimate need for access in connection with their duties.
GetDotFlow will maintain commercially reasonable administrative, technical, and organizational safeguards designed to protect Tenant Personal Data under its control against unauthorized access, acquisition, destruction, loss, alteration, or disclosure, appropriate to the nature of the Service and the information Processed. GetDotFlow may modify its security measures as technology, threats, and the Service evolve, provided it does not materially reduce the overall level of protection required by applicable law or an applicable written security commitment. Nothing in this DPA guarantees that a Security Incident can never occur.
If GetDotFlow confirms a Security Incident involving Tenant Personal Data, it will notify Tenant without unreasonable delay where notification is required by applicable Data Protection Law or the Agreement. To the extent reasonably known and legally permitted, the notice may describe (a) the nature of the incident; (b) categories of affected information; (c) known or estimated scope; (d) mitigation or remediation measures; and (e) information reasonably necessary for Tenant to meet its legal obligations. GetDotFlow may provide information in phases as facts become available. Notification is not an admission of fault, liability, or violation of law. Tenant is responsible for its own notification, reporting, and remediation obligations unless applicable law expressly assigns them to GetDotFlow.
Tenant generally authorizes GetDotFlow to engage Subprocessors as reasonably necessary to provide, secure, support, and maintain the Service. GetDotFlow will require Subprocessors that Process Tenant Personal Data to be bound by privacy, confidentiality, and security obligations appropriate to their services and as required by applicable law. The current list of Subprocessors is maintained in Part D. Where applicable law or a signed agreement requires advance notice of a new Subprocessor, GetDotFlow will provide it through a reasonable mechanism, and Tenant may raise a reasonable, good-faith data-protection objection, which the parties will attempt to resolve in good faith. GetDotFlow remains responsible for its Subprocessors to the extent required by applicable law and the Agreement.
If GetDotFlow receives a request that it can reasonably determine relates to Tenant-controlled information, it may direct the requester to Tenant. Where required by applicable law or the Agreement, GetDotFlow will reasonably assist Tenant in responding to verified requests concerning access, correction, deletion, portability, opt-out rights, limitation rights, and other qualifying privacy rights. GetDotFlow is not required to respond on Tenant's behalf where Tenant is legally responsible for responding, except as required by law.
During an active Subscription, Tenant may use available Service functionality to access or export Tenant Content. After expiration or termination, Tenant Personal Data will be handled under the Agreement, the Privacy Policy, GetDotFlow's retention practices, and applicable law. On Tenant's valid request, and where required by applicable law or a signed agreement, GetDotFlow will delete or return Tenant Personal Data unless retention is required or permitted by law. Tenant Personal Data may remain temporarily in backups, security records, or other systems where immediate deletion is not technically practicable; such data remains protected and is deleted or overwritten in the ordinary course.
On reasonable written request and to the extent required by applicable law, GetDotFlow will provide information reasonably necessary to demonstrate compliance with its processor, service-provider, or contractor obligations under this DPA. Any assessment, questionnaire, or audit is subject to reasonable confidentiality, security, scope, timing, and frequency limits. GetDotFlow is not required to disclose information that would compromise another customer's confidentiality, system security, privileged information, trade secrets, or third-party contractual obligations.
Tenant is responsible for (a) determining that its collection and Processing of Personal Data is lawful; (b) providing required privacy notices; (c) obtaining required consents or authorizations; (d) configuring the Service appropriately; (e) ensuring its instructions comply with applicable law; (f) responding to privacy requests for which it is legally responsible; (g) determining applicable regulatory record-retention requirements; and (h) avoiding submission of unnecessary or unsupported sensitive information.
Where GetDotFlow receives or creates information that qualifies as de-identified under applicable law and is required to keep it de-identified, it will take reasonable measures to prevent reidentification and will not attempt to reidentify it except as permitted by law.
If this DPA conflicts with the Agreement regarding the Processing or protection of Tenant Personal Data, this DPA controls solely with respect to that subject matter; the remainder of the Agreement remains in effect.
This DPA remains effective for as long as GetDotFlow Processes Tenant Personal Data subject to it.
Unless applicable Data Protection Law requires otherwise, this DPA is governed by the governing-law provisions of the Agreement.
This DPA does not by itself establish a mechanism for international transfers requiring Standard Contractual Clauses, a United Kingdom International Data Transfer Addendum, or another jurisdiction-specific transfer instrument. If such requirements become applicable, the parties may enter into an appropriate additional transfer mechanism.
| Item | Details |
|---|---|
| Subject matter | Provision, operation, maintenance, security, support, and administration of the GetDotFlow Service. |
| Duration | For the duration of the Agreement and any limited period thereafter during which GetDotFlow lawfully retains Tenant Personal Data. |
| Nature and purpose | Processing necessary to provide inspection workflow, record management, reporting, client portal, reminders, accounts, subscriptions, support, security, and related functionality. |
| Categories of data subjects | Depending on Tenant's use: Tenant personnel, Authorized Users, administrators, inspectors, drivers, Clients, vehicle owners, customer contacts, report or portal recipients, and other individuals whose information Tenant submits. |
| Categories of Personal Data | Depending on Tenant configuration and use: names; business contact information; email addresses; telephone numbers; business addresses; Account identifiers; roles and permissions; vehicle information; VINs and unit numbers; inspection information; inspector information; uploaded documents; photographs where supported; portal activity; communications; technical information; IP addresses; security and authentication information; and other Tenant Personal Data submitted through supported functionality. |
| Sensitive Personal Data | GetDotFlow does not require Social Security numbers, medical records, biometric identifiers, precise geolocation, or similar highly sensitive information to establish a standard Account. Tenant must not submit sensitive Personal Data unless its Processing is reasonably necessary, lawful, and supported by the Service. |
| Subprocessors | As listed in Part D. |