Ironhead Privacy Policy

1. Overview

Ironhead is a software-as-a-service (SaaS) platform operated by Tinmen Enterprises LLC ("Ironhead," "we," "us," or "our"), a Louisiana limited liability company. This Privacy Policy explains how we collect, use, store, and protect information when you use the Ironhead platform at app.ironheadapp.com and related services (collectively, the "Service").

By using the Service, you agree to the practices described in this Privacy Policy. If you do not agree, do not use the Service.

2. Who This Policy Applies To

This Privacy Policy applies to:

• Dealership clients and their authorized users (sales managers, salespeople) who access the Service
• Dealership customers whose lead and contact information is managed within the Service on behalf of our dealership clients

Ironhead processes dealership customer data as a service provider acting on behalf of our dealership clients. Dealership clients are responsible for their own compliance obligations regarding their customers' data.

3. Information We Collect

3.1 Account and User Information

When a dealership creates an account or adds users, we collect:

• First and last name
• Email address
• Phone number
• Role and dealership affiliation
• Login credentials (passwords are hashed and never stored in plain text)

3.2 Lead and Customer Data

Ironhead stores lead and customer data imported from or entered into the platform, including:

• Prospect first and last name
• Phone number and email address
• Vehicle of interest, budget, and lead source
• Pipeline stage and sales activity history
• Notes entered by dealership sales representatives
• CRM identifiers from connected dealership CRM systems

3.3 Activity and Usage Data

When users interact with the Service, we automatically collect:

• Actions taken within the platform (messages sent, leads updated, stages changed)
• Timestamps of all activities
• Device type and browser information
• IP address

3.4 Communications Data

When the Service is used to send SMS or email communications to dealership customers, we store:

• Message content generated by or edited within the platform
• Delivery status and timestamps
• Channel used (SMS or email)

4. How We Use Information

We use the information we collect to:

• Provide, operate, and maintain the Ironhead platform
• Display leads and activities to authorized dealership users
• Generate AI-powered follow-up message suggestions using the Anthropic Claude API
• Send SMS communications via Twilio on behalf of dealership users
• Send email communications via SendGrid on behalf of dealership users
• Sync lead and activity data with connected dealership CRM systems (VinSolutions, eLeads/CDK, and others)
• Authenticate users and enforce access controls
• Improve platform performance and reliability
• Respond to support requests
• Comply with legal obligations

We do not sell, rent, or trade any personal information or lead data to third parties for marketing purposes.

5. Third-Party Services

Ironhead uses the following third-party service providers to operate the platform. Each provider has its own privacy practices:

• Anthropic (Claude AI) — AI message generation. Lead context (name, vehicle, pipeline stage) is transmitted to Anthropic's API to generate suggested follow-up messages. Anthropic's privacy policy applies: anthropic.com/privacy
• Twilio — SMS delivery. Phone numbers and message content are transmitted to Twilio to deliver text messages. Twilio's privacy policy applies: twilio.com/legal/privacy
• SendGrid (Twilio) — Email delivery. Email addresses and message content are transmitted to SendGrid to deliver email communications. SendGrid's privacy policy applies: sendgrid.com/policies/privacy
• Supabase — Database and authentication infrastructure. All platform data is stored in Supabase's hosted PostgreSQL database with encryption at rest. Supabase's privacy policy applies: supabase.com/privacy
• Cox Automotive / VinSolutions — CRM integration. Lead and activity data is synchronized with VinSolutions for dealership clients using that CRM. Cox Automotive's privacy policy applies.
• CDK Global / Fortellis / eLeads — CRM integration. Lead and activity data is synchronized with eLeads/CDK for dealership clients using that CRM. CDK Global's privacy policy applies.
• Zapier — Workflow automation bridge. For dealership clients using the Zapier integration path, lead data passes through Zapier's platform. Zapier's privacy policy applies: zapier.com/privacy
• Stripe — Payment processing. Billing information for dealership subscriptions is processed by Stripe. We do not store payment card data. Stripe's privacy policy applies: stripe.com/privacy

6. Data Storage and Security

• All data is stored in Supabase-hosted PostgreSQL databases with encryption at rest
• All data in transit is encrypted using TLS 1.2 or higher (HTTPS)
• Row-level security policies ensure each dealership's data is isolated — no dealership can access another dealership's data
• User passwords are hashed using industry-standard algorithms and never stored in plain text
• Access to production systems is restricted to authorized Tinmen Enterprises personnel
• We implement commercially reasonable technical and organizational measures to protect against unauthorized access, alteration, disclosure, or destruction of data

No system is completely secure. While we work hard to protect your information, we cannot guarantee absolute security.

7. Data Retention

• Active account data is retained for the duration of the subscription
• Upon account cancellation, dealership clients may request an export of their data within 30 days
• After 30 days following cancellation, data may be permanently deleted from our systems
• Activity logs and CRM sync records may be retained for up to 12 months for debugging and audit purposes
• Backup copies may persist for up to 90 days following deletion

8. Your Rights

Depending on your location and applicable law, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your information
• Object to or restrict certain processing
• Request a portable copy of your data

To exercise any of these rights, contact us at TINMAN@tinmenenterprises.com. We will respond within 30 days.

Note: Ironhead processes most lead and customer data on behalf of dealership clients. For requests related to dealership customer data, we will direct you to the appropriate dealership client.

9. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us information, contact us immediately at TINMAN@tinmenenterprises.com.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify dealership account holders by email at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

11. Governing Law

This Privacy Policy is governed by the laws of the State of Louisiana without regard to its conflict of law provisions.

12. Contact Us

For questions, concerns, or requests related to this Privacy Policy: