Privacy Policy

Including SMS Messaging and Two-Factor Authentication Terms

Effective Date: Last Updated:

At a glance: PowerTrack is a business CRM platform. We use personal information to provide, secure, support, and improve the service; to process communications and records at the direction of our business customers; and to comply with law. We do not sell personal information or use mobile numbers or SMS opt-in data for third-party advertising. The sections below provide the full details and control.

1. Scope and Our Role

This Privacy Policy explains how PowerTrack ("PowerTrack," "we," "us," or "our") collects, uses, discloses, retains, and protects personal information in connection with powertrack-crm.com, the PowerTrack CRM platform, account authentication, demo and support requests, communications, integrations, and related services (collectively, the "Services").

Your access to and use of the Services is also governed by the PowerTrack Terms of Service and any applicable Customer Organization agreement.

PowerTrack is primarily a business-to-business platform used by dealerships and other organizations (each a "Customer Organization"). Our privacy role depends on the context:

  • PowerTrack-controlled information. We determine how to process information used to operate our website, manage business-user accounts, secure the Services, respond to demo or support requests, administer our own communications, and meet our legal obligations.
  • Customer-controlled CRM information. A Customer Organization generally determines why and how its customer, prospect, employee, vehicle, transaction, and communication records are processed. For that information, PowerTrack generally acts as a service provider or processor under the Customer Organization's instructions and agreement with us.

If your information was provided to PowerTrack by a dealership or another Customer Organization, that organization's privacy notice also applies. Submit requests about those records to the organization that collected the information when practical; we will assist it as required by contract and applicable law. This Policy does not govern independent third-party websites or services that have their own notices.

A Customer Organization's service agreement, data processing terms, or other written agreement may provide additional terms. If those terms conflict with this Policy for Customer-controlled information, the applicable agreement controls to the extent permitted by law.

2. Information We Collect

The information processed depends on the features a Customer Organization enables, the integrations it connects, and how an individual interacts with the Services. We may process the following categories:

Category Examples
Account and organization data Name, work email, username, password hash, employee or user identifiers, role, permissions, organization and location assignments, phone number, phone-verification and 2FA status, notification settings, account status, login time, and login IP address.
Contact and CRM data Names, company, postal address, email addresses, phone numbers, identifiers, source records, contact preferences, suppression status, notes, and, where supplied by a Customer Organization, demographic details such as birth date or gender.
Vehicle, service, and commercial data Vehicle identification number (VIN), year, make, model, mileage, ownership or interest, appointments, repair orders, service history, store visits, opportunities, deals, purchases, invoices, finance-related transaction fields, and related business records.
Communications and content SMS/MMS and email content, call details, recordings and transcripts when enabled and lawfully collected, voicemail indicators, conversation history, chatbot or support content, notes, comments, forms, files, documents, images, and other attachments.
Messaging and consent data Sender and recipient numbers, message identifiers, timestamps, delivery status, message length, opt-in selections, opt-out or suppression records, notification preferences, and consent source or evidence when recorded by PowerTrack or a Customer Organization.
Integration data Information imported from or synchronized with dealership management systems, Microsoft 365, email and calendar accounts, telephony and messaging providers, address services, storage providers, and other Customer Organization-authorized systems. This can include connection metadata and authorization tokens used to maintain the integration.
Technical and usage data IP address, browser and device type, operating system, request headers, pages or features accessed, referring URL, timestamps, session and cookie identifiers, authentication and security events, error data, and diagnostic logs.
AI and derived data Prompts and relevant CRM context supplied to an AI feature, generated drafts or summaries, classifications, sentiment or intent indicators, extracted fields, confidence indicators, and operational metadata about an AI request.
Demo and support data Name, email, phone, dealership or company, requested date and time, inquiry details, correspondence, and information supplied while requesting a demonstration or support.

Sources of information

We receive information from:

  • You, when you create or secure an account, submit a form, communicate, upload content, or use a feature.
  • Your employer, account administrator, or other Customer Organization.
  • Customers, prospects, and other individuals who communicate with a Customer Organization.
  • Customer-authorized integrations, imports, dealership systems, communications providers, and public or licensed business sources.
  • Browsers, devices, servers, cookies, security tools, and service providers automatically when the Services are used.
  • Our processing, when we organize records, match identities, generate summaries, or derive operational insights.

Sensitive information

Some records may include information considered sensitive under applicable law, such as account login credentials, private communication content, precise identifiers, or finance-related fields. Do not upload Social Security numbers, full payment-card data, account passwords, health information, or other highly sensitive data unless the Customer Organization has confirmed that the applicable PowerTrack feature and agreement authorize it. PowerTrack does not use sensitive personal information to infer characteristics about individuals for unrelated advertising.

3. How We Use Information

PowerTrack may use personal information to:

  • Provide, configure, maintain, and troubleshoot the Services.
  • Create and administer accounts, authenticate users, provide 2FA, and manage permissions.
  • Organize CRM records, resolve identities, support workflows, and provide customer service.
  • Send or receive communications at the direction of a user or Customer Organization.
  • Schedule appointments, manage tasks and opportunities, and support sales, service, and follow-up activity.
  • Operate AI-assisted drafting, extraction, classification, summarization, and automation features.
  • Honor contact preferences, consent choices, suppression records, and opt-out requests.
  • Monitor reliability, prevent abuse and fraud, enforce agreements, and protect users, customers, and the Services.
  • Respond to demo, support, privacy, and other requests.
  • Comply with law, legal process, audits, tax or accounting duties, and valid government requests.
  • Create aggregated or de-identified information for analytics, service planning, and improvement.

Account-alert and 2FA consent is not consent to marketing. We send promotional communications only when there is an appropriate legal basis and any required, separate choice. A Customer Organization is responsible for the lawfulness and content of communications it sends through PowerTrack.

Where a law requires a legal basis, we rely as appropriate on performance of a contract, steps requested before entering a contract, legitimate interests that are not overridden by individual rights, consent, and compliance with legal obligations. PowerTrack processes Customer-controlled CRM information under the Customer Organization's instructions; the Customer Organization determines its own legal bases. Consent can be withdrawn for future processing, but withdrawal does not affect processing already performed lawfully.

4. SMS Messaging and Two-Factor Authentication Terms

This section is both a privacy disclosure and the terms for PowerTrack text messaging. PowerTrack uses separate SMS purposes and does not treat entry of a phone number, by itself, as consent to receive texts.

Message frequency varies. The number of messages you receive depends on verification activity, account activity, and enabled alert settings. Message and data rates may apply.

Mobile-number non-sharing: We do not share mobile numbers, SMS opt-in data, or SMS consent with third parties or affiliates for their marketing or promotional purposes. This does not prevent limited disclosures to messaging providers and wireless carriers solely to deliver and support requested messages, or disclosures required by law.

SMS programs and message types

  • 2FA and account security. If you opt in to SMS 2FA, PowerTrack may use automated technology to send one-time verification codes and closely related security messages when enrollment, sign-in, resend, or recovery activity triggers a code. PowerTrack does not use this opt-in for advertising.
  • Account and message alerts. When enabled, PowerTrack may send recurring operational alerts about account, workflow, conversation, task, appointment, or system activity. Alert frequency varies with account activity and enabled settings. These alerts do not include marketing unless you separately and expressly opt in to a marketing program.
  • Customer Organization communications. A dealership or other Customer Organization may use PowerTrack to send appointment reminders, service updates, requested sales follow-up, and other business messages. That identified organization is the sender and is responsible for obtaining consent for each messaging purpose. Consent to PowerTrack account texts does not automatically consent to a Customer Organization's separate messaging campaign, or vice versa.

By selecting a specific SMS opt-in checkbox, you confirm that you are the subscriber or customary user of the mobile number provided, you authorize texts for the purpose described beside that checkbox, and you agree to these terms. Keep the number current and notify your administrator if it is reassigned. Consent to the required SMS security and account-alert configuration is required to complete the current PowerTrack phone-enrollment flow. It is not consent to receive advertising and is not a condition of purchasing goods or services from a PowerTrack Customer Organization.

PowerTrack and Customer Organizations may maintain consent, preference, and suppression information as needed to administer messaging, demonstrate compliance, and honor withdrawal requests. The exact records maintained depend on the program and system configuration.

Frequency, charges, and delivery

  • 2FA messages are sent when a verification event is requested or triggered; alert frequency varies.
  • Message and data rates may apply. Check your mobile plan for details.
  • Carriers are not liable for delayed or undelivered messages. Delivery is not guaranteed.
  • SMS is not an emergency service and should not be used for urgent or life-safety communications.

How to opt out or get help

Reply STOP to a supported sending number to withdraw SMS consent. Other recognized requests may include STOPALL, UNSUBSCRIBE, END, QUIT, REVOKE, OPTOUT, or CANCEL. We may send one final, non-promotional message confirming the opt-out. No further messages covered by that opt-out will be sent unless you opt in again. Because carrier and sender controls can apply a STOP request broadly, opting out may stop both alerts and security codes from the same sender.

If SMS 2FA is required for your account, opting out or losing access to the enrolled number may prevent sign-in until an administrator resets 2FA or another approved recovery method is available. For help, reply HELP where supported or email support@powertrack-crm.com. You may also manage available alert preferences in PowerTrack.

Mobile information privacy

We use mobile numbers, SMS consent or withdrawal records, and messaging metadata to deliver requested messages, authenticate and secure accounts, provide support, prevent abuse, troubleshoot delivery, honor preferences, and comply with law. We do not sell or share mobile numbers, SMS opt-in data, or SMS consent with third parties or affiliates for their own marketing or promotional purposes, and we do not use phone numbers collected for 2FA for advertising.

We may disclose mobile information to Twilio, wireless carriers, messaging aggregators, infrastructure providers, and other processors only as needed to deliver, secure, support, and document messaging, or as required by law. These limited operational disclosures are not permission for those parties to use the information for their own marketing.

5. How We Disclose Information

We may disclose personal information in the following circumstances:

  • Customer Organizations and authorized users. Account administrators and authorized users may access information within their organization and locations based on assigned roles and permissions.
  • Service providers. Vendors may process information to provide cloud hosting, databases, storage, security, support, SMS/MMS, voice, email, calendar, maps and address services, document processing, AI services, monitoring, and other operational functions.
  • Customer-directed integrations and recipients. We disclose information when a user or Customer Organization connects a system, sends a communication, exports data, or otherwise directs us to do so.
  • Legal and safety reasons. We may disclose information to comply with law, legal process, or lawful government requests; enforce agreements; investigate abuse; or protect rights, safety, property, and the integrity of the Services.
  • Business transactions. Information may be reviewed or transferred in connection with financing, due diligence, reorganization, merger, acquisition, sale, bankruptcy, or a similar transaction, subject to appropriate confidentiality and legal requirements.
  • With consent. We may disclose information for another stated purpose with valid authorization.

We do not sell personal information for money. Based on our current practices, we also do not share personal information for cross-context behavioral advertising. We do not knowingly sell or share personal information of individuals under 16. If these practices change, we will update this Policy and provide any legally required opt-out method before the change applies.

Service providers used by or through PowerTrack can include Microsoft Azure and Microsoft Graph, Twilio, mapping or address-validation providers, Customer Organization-selected dealership systems, and other configured integration providers. Providers and available integrations may change as the Services evolve.

6. AI-Assisted Features

PowerTrack includes AI-assisted tools that may draft messages, extract information, summarize conversations or opportunities, classify content, recommend workflow actions, and support automation. To provide a requested feature, relevant prompts, communication content, and CRM context may be sent to an AI service provider and processed through safety and reliability systems.

  • AI-generated content may be inaccurate, incomplete, or inappropriate and should be reviewed by an authorized user.
  • Do not place secrets, passwords, full payment-card data, or unnecessary sensitive information in AI prompts.
  • PowerTrack may keep AI request and response data or operational metadata when needed for the feature, support, safety, auditing, or Customer Organization records.
  • We do not use AI outputs as the sole basis for decisions that produce legal or similarly significant effects about an individual unless separately disclosed, authorized, and subject to required safeguards.

AI provider processing, region, filtering, and retention can vary by feature and Customer Organization configuration. A Customer Organization is responsible for deciding which of its records may be used with enabled AI features and for providing any notices or permissions it is legally required to provide.

7. Cookies and Technical Data

PowerTrack uses cookies and similar browser storage needed for authentication, security, session management, trusted-browser choices, 2FA enrollment, request validation, user-interface preferences, and reliable service operation. Some cookies expire when the browser session ends; others persist for a limited period so the selected function continues to work.

Customer-enabled integrations or embedded third-party features may use their own technical mechanisms and are governed by the applicable provider's notice. PowerTrack does not use the login or 2FA phone-number opt-in to build advertising profiles. We do not currently use advertising cookies or use the Services for cross-context behavioral advertising.

You can control cookies through browser settings, but blocking authentication, security, or session cookies may prevent sign-in or cause parts of the Services to stop working. Some browsers offer Do Not Track or Global Privacy Control signals. We honor legally required browser-based opt-out signals for processing to which they apply. Because we do not currently sell information or share it for cross-context behavioral advertising, such a signal may not change our current practices.

8. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, as directed by the applicable Customer Organization, and as required or permitted by law. Retention periods vary by record type, feature, Customer Organization configuration, and legal or contractual need.

Retention decisions consider:

  • The duration of an account, customer relationship, workflow, communication, or transaction.
  • Customer Organization instructions, configuration, exports, and contract terms.
  • The sensitivity, volume, and operational value of the information.
  • Security, fraud prevention, consent evidence, suppression, dispute, audit, and legal-hold needs.
  • Applicable tax, accounting, records, communications, and privacy laws.
  • Backup, disaster-recovery, and provider deletion cycles.

Deletion from active systems may not immediately remove information from encrypted backups or immutable security records. Backup copies are isolated from ordinary use and expire or are overwritten through the applicable recovery cycle unless preservation is legally required. We may retain de-identified information that cannot reasonably be linked to an individual and will not attempt to re-identify it except as permitted by law.

9. Security and International Processing

Security

We use administrative, technical, and organizational safeguards designed for the nature of the Services and information involved. Depending on the system, these measures can include access controls, role and tenant restrictions, password hashing, encryption in transit, secret management, authentication controls, 2FA, rate limiting, logging, monitoring, backups, and vendor risk controls. No service, network, or storage system is completely secure, and we cannot guarantee that unauthorized access, loss, or misuse will never occur.

Protect your credentials, use a phone number you control, keep account and contact information current, review AI-generated work, and notify us or your administrator promptly about suspected misuse. When a security incident requires notice, PowerTrack or the responsible Customer Organization will provide notice in the manner and timeframe required by applicable law.

International processing

PowerTrack and its service providers may process information in the United States and other countries where they operate. Those countries may have privacy laws different from the place where information originated. When legally required, the responsible party uses an approved transfer mechanism or contractual safeguard. Customer Organizations are responsible for configuring their use of the Services consistently with their own localization and transfer obligations.

10. Your Privacy Rights and Choices

Depending on where you live and the context, you may have rights to request access to or a copy of personal information; correct inaccurate information; delete information; restrict or object to processing; withdraw consent; obtain data portability; opt out of sale, targeted advertising, or certain profiling; and appeal a denied request. You may also complain to an applicable privacy or data-protection authority.

To submit a request concerning information PowerTrack controls, email support@powertrack-crm.com with the subject "Privacy Request" and describe the right you wish to exercise. For Customer-controlled CRM information, contact the dealership or other Customer Organization that collected the information. If you contact us first, we may refer the request to that organization and assist it in responding.

We may verify identity and authority before completing a request. Authorized agents may submit requests where permitted, but we may require proof of authorization and direct identity verification. Rights are not absolute; exemptions may apply for security, legal obligations, other individuals' rights, privileged data, or information processed solely on behalf of a Customer Organization. We will not unlawfully discriminate against you for exercising a privacy right.

If applicable law provides an appeal and we deny a request, reply to the decision email with "Privacy Appeal" and explain why you believe the decision should be reconsidered. Marketing email choices, if such emails are offered, can also be changed through the unsubscribe method in the message. SMS choices are described in How to opt out or get help above.

EEA, United Kingdom, and similar jurisdictions

Where applicable, individuals may object to processing based on legitimate interests, request restriction, withdraw consent, and lodge a complaint with their local supervisory authority. PowerTrack generally acts as a processor for Customer-controlled CRM information, so the relevant Customer Organization is usually responsible for the response. Contact us for information about the applicable controller or transfer mechanism.

11. California Notice at Collection and Privacy Rights

This section supplements the rest of the Policy for California residents. In the preceding 12 months, PowerTrack may have collected the categories below, depending on the Services and Customer Organization configuration. The examples are illustrative and do not mean every item is collected about every person.

California category Representative examples and purposes Operational recipients
Identifiers Names, account IDs, email, phone, address, IP address, VIN, and provider identifiers used for accounts, CRM records, communications, support, and security. Customer Organizations, authorized users, hosting, communications, integration, and security providers.
Customer-record information Contact details, signature or consent records, vehicle and transaction fields, and related records used to provide CRM workflows and customer-directed services. Customer Organizations, authorized users, and processors supporting the relevant workflow.
Protected characteristics or demographic data Age or birth date, gender, or similar fields when supplied by a Customer Organization and used for authorized recordkeeping or service. Customer Organizations, authorized users, and necessary service providers.
Commercial information Vehicle interests, purchases, service history, repair orders, appointments, deals, invoices, and related activity used for CRM and business operations. Customer Organizations, authorized users, and configured business integrations.
Internet or network activity Browser, device, requests, feature activity, sessions, logs, and security events used to operate, secure, and improve the Services. Hosting, infrastructure, diagnostics, and security providers.
Geolocation General location inferred from IP or address coordinates supplied for CRM and address functions; used for security, routing, and location-based business records. Customer Organizations and infrastructure or address-service providers.
Professional or employment information Employer, dealership, role, employee code, location, assignments, and activity used to administer business-user accounts and permissions. Customer Organization administrators and operational service providers.
Audio, electronic, or visual information Calls, recordings, transcripts, SMS/MMS, email, images, documents, and attachments used for communications, records, support, and authorized AI features. Customer Organizations, intended recipients, communications, storage, and AI providers.
Inferences Summaries, classifications, sentiment, intent, matching, and workflow indicators used to organize records and provide AI-assisted features. Customer Organizations, authorized users, and AI or infrastructure providers.
Sensitive personal information Account credentials and private communications, and other sensitive fields a Customer Organization lawfully supplies, used only for permitted service, security, and compliance purposes. Customer Organizations and processors necessary for the specific permitted purpose.

The categories of sources are described in Sources of information; business purposes are described in How we use information; retention criteria are described in Data retention. PowerTrack may disclose each category for the business purposes described above. We do not sell these categories or share them for cross-context behavioral advertising, and we do not offer a financial incentive for their collection.

Subject to applicable law and exemptions, California residents may request to know, access, correct, or delete personal information; opt out of sale or sharing; limit certain uses of sensitive personal information; and receive equal service. Because our current practices do not include sale, cross-context behavioral advertising, or use of sensitive information beyond permitted service and security purposes, we do not currently provide "Do Not Sell or Share" or "Limit" links. Use the request method in Your privacy rights and choices. PowerTrack often acts as a service provider for Customer-controlled records, in which case the Customer Organization handles the request.

12. Children, External Links, Policy Changes, and Contact

Children

The Services are designed for businesses and authorized business users, not for children. PowerTrack does not knowingly permit anyone under 18 to create a business-user account or knowingly collect personal information online from a child under 13 in a manner subject to the Children's Online Privacy Protection Act. A Customer Organization may place records involving minors in its CRM only when it has lawful authority and complies with applicable notice and consent requirements. Contact us if you believe a child supplied information directly to PowerTrack without appropriate authorization, and we will investigate and take action required by law.

The Services may link to third-party sites or permit Customer Organizations to connect external systems. Those parties' notices govern their independent processing. Review their terms before providing information or enabling an integration.

Changes to this Policy

We may update this Policy to reflect changes in the Services, our practices, or law. We will post the updated version here and change the "Last Updated" date. If a change is material, we will provide additional notice through the Services, by email, or by another appropriate method when required. If new processing requires consent, we will request it rather than treating continued use as consent.

Contact us

For privacy questions, requests, or complaints, contact:

PowerTrack Privacy Team
Website: https://powertrack-crm.com
Privacy, SMS, or technical support: support@powertrack-crm.com

We respond within the period required by applicable law. If you need this Policy in an accessible alternate format, contact us using the email address above.