Privacy Policy

Information we collect

• Account data: name, email, dealership name, role, and authentication credentials for people who sign in to ShedFollow.
• Business data the dealership imports or types: lead sources, lot details, quotes, notes, and customer records (name, email, phone, building, quote amount, status).
• Usage data: sign-in, billing, follow-up activity, and integration events used to operate and improve the service.

Meta (Facebook) Lead Ads

When a dealership connects a Facebook Page, we receive Platform Data from Meta so that dealership can follow up on Instant Form leads. That typically includes:

• Contact fields the person submitted on the form (for example full name, email, phone number).
• Answers to custom form questions, which we store as lead notes.
• Form, Page, ad, ad set, and campaign identifiers and names, used to show which ad produced the lead.
• The leadgen id Meta assigns to that submission, used to avoid duplicates.

We process this data only for that dealership's follow-up (worklist, lead record, optional message drafts, and performance reporting inside their account). We do not sell it, use it to retarget people on or off Meta, or mix one dealership's Platform Data with another dealership's.

How we use it

We use the data to provide ShedFollow: surfacing leads that need follow-up, generating optional message drafts, computing rep performance, authenticating users, and billing the subscription. A dealership's leads are visible only to that dealership's team.

Processors

We share personal data with service providers only as needed to run ShedFollow:

• Vercel Inc. — hosts the application. Functions for this project run in the United States.
• Supabase, Inc. — database and authentication. Project data is stored in the United States; Supabase's privacy policy also lists Singapore for some company processing.
• OpenAI OpCo, LLC — optional AI follow-up drafts. We send the customer's first name, building, and notes (not email or phone) when a rep asks for a draft. API inputs are not used to train OpenAI models.
• Plus Five Five, Inc. (Resend) — transactional email (invites, support, marketing signups). We do not send Instant Form follow-ups through Resend today.
• Stripe, Inc. — subscription billing. Stripe does not receive Facebook Instant Form lead records.

Retention and deletion

We keep dealership data while the account is active. Diagnostic logs that can contain lead details are deleted after 30 days.

Dealership admins can delete an individual lead in ShedFollow (lead detail → delete). That removes the lead record and its follow-up history from the app.

Anyone — including a person who submitted a Facebook Instant Form — can request access, correction, or deletion of their personal data by emailing support@shedfollow.com. Say which dealership and how we can identify the record (name, email, phone, or approximate date). We will delete the matching Platform Data from ShedFollow unless we are required by law to keep it. Dealerships that connected the Page remain responsible for data they copied out of the app.

To close a dealership account or delete all of that org's Meta data, the owner should email the same address. There is no self-service org delete.

Security reports

To report a security vulnerability in ShedFollow, email support@shedfollow.com with "security" in the subject.

Contact

Privacy questions and deletion requests: support@shedfollow.com. You can also use our support form.